HL7 FHIR Security 2017-10-03

Call Logistics

Weekly: Tuesday at 05:00 EST (2 PM PST)

Web conference desktop and VOIP https://www.freeconferencecall.com/join/security36 
Online Meeting ID: security36
Phone: +1 515-604-9567, Participant Code: 880898
 Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes 

Back to HL7 FHIR security topics

Attendees

	Member Name			Member Name			Member Name
x	John Moehrke Security Co-Chair		x	Kathleen Connor Security Co-Chair		.	Alexander Mense Security Co-chair
.	Suzanne Gonzales-Webb CBCC Co-Chair		.	Johnathan Coleman CBCC Co-Chair		.	Mike Davis
.	Reed Gelzer RM-ES Lead		.	Glen Marshal		x	Joe Lamy
.	Diana Proud-Madruga		x	Rob Horn		.	Beth Pumo
.	Irina Connelly		.	Firstname Lastname		.	Firstname Lastname

Agenda

• Roll;
• approval of agenda
• approval of the HL7 FHIR Security 2017-09-26 Minutes
• All security open http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemBrowse&tracker_id=677&tracker_query_id=4967
• Clarification that Resource.Identifier can hold ANY identifier even those that are not identifiers of FHIR Resources
  • http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=13570&start=0
  • http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=13571&start=0
• Can we provide a Provenance pattern that would be added by a FHIR Server that has done a validation against StructureDefinitions and added tags of compliance to Resources?
• Plan resolution of CR (see below)
• SMART engagement
  • reminder that we plan to ballot the SMART on FHIR App Launch Protocol in the upcoming cycle (voting in August, with reconciliation to begin at the September WGm). The content we intend to ballot has been prepared (and is being refined) at https://github.com/smart-on-fhir/smart-on-fhir.github.io/tree/into-hl7 and our list of open issues during this refinement period is at https://github.com/smart-on-fhir/smart-on-fhir.github.io/issues (Josh).
• Setting up Test Plans for Security / Privacy topic
  • Connectathon scenario -- Pattern that shows how Provenance, AuditEvent, Consent, security-labels, and other can be overlaid on <any> other connectathon scenario
  • TestScript resource based tests
    • AuditEvent tests for well understood audit log
    • Provenance tests for well understood provenance use
  • Test bench?
    • some automated environment that people can use to test their: ( a ) client, ( b ) server, or other? Can this be done?
• New business?

Minutes

• John Chaired
• Approval of last weeks minutes unanimous
• Reviewed GF#11071 https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=11071
  • Try to create a valueset that is made up of the most used codes, not to imply that other codes are not used, just to focus discussion.
    • Keep all Confidentiality codes as there are few and the are valuable
    • PurposeOfUse -- Start with existing GeneralPurposeOfUse valueset, add HTEST, HQUALIMP, and LABELING
    • Sensitivity - ETH, HIV, SDV, GDIS, PSY, SDV, SEX, and STD; ...
  • This is when we realized that there are differnet subsets that exist that are used in different ways. Some codes would appear on clinical data, but not on identity resources; where as others would only appear on identity resorurces and never appear on clinical data. And that those different uses are already valuesets, and FHIR already has catagorized FHIR.
  • See http://build.fhir.org/resourceguide.html
• ACTION: Kathleen to start withthe FHIR resourceguide, put into WORD, and annotate with the existing HCS subsets that are appropriate for each, as discussed above.