HL7 FHIR Security 2018-03-27

Call Logistics

Weekly: Tuesday at 02:00 EST

Web conference desktop and VOIP https://www.freeconferencecall.com/join/security36 
Online Meeting ID: security36
Phone: +1 515-604-9567, Participant Code: 880898
 Please be aware that teleconference meetings are recorded to assist with creating the meeting minutes 

Back to HL7 FHIR security topics

Attendees

	Member Name			Member Name			Member Name
x	John Moehrke Security Co-Chair		x	Kathleen Connor Security Co-Chair		.	Alexander Mense Security Co-chair
x	Suzanne Gonzales-Webb CBCC Co-Chair		.	Mike Davis		x	Joe Lamy AEGIS
x	Ali Massihi		.	Johnathan Coleman CBCC Co-Chair		.	Glen Marshal
.	Diana Proud-Madruga		.	Rob Horn		x	Beth Pumo
.	Irina Connelly		.	Mario Hyland AEGIS		.	Mark Underwood NIST
x	Peter Bachman		x	Grahame Greve FHIR Program Director		x	Kevin Shekleton (Cerner, CDS Hooks)
x	Luis Maas EMR Direct

Agenda

• Roll;
• approval of agenda
• approval of HL7 FHIR Security 2018-03-20 Minutes
• Note new time at 2:00 Eastern Time every Tuesday (just prior to full Security WG meeting)
• Polling zulip community to determine if a dedicated stream or continued use of "Implementers" is better.
  • https://chat.fhir.org/#narrow/stream/social/topic/Security.20.26.20Privacy.20topics
• Proposed FHIR Connectathon track for Cologne -- GDPR
  • Alex has agreed to be a SME. John to support.
  • http://wiki.hl7.org/index.php?title=201805_GDPR
• Blockchain FHIR Connectathon
  • Grahame is trying to find a community wanting to 'play' with blockchain. He is willing to standup the infrastructure.
  • See blockchain zulip stream https://chat.fhir.org/#narrow/stream/blockchain
• HEART
  • HEART is starting an initiative to get HEART to be used. Starting with education.
• Johnathan specific guidance given a paper from ONC that might guide improvements to the security guidance
  • Johnathan sends his regrets... again...
  • KEY PRIVACY AND SECURITY CONSIDERATIONS FOR HEALTHCARE APPLICATION PROGRAMMING INTERFACES (APIS)
• All security open http://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemBrowse&tracker_id=677&tracker_query_id=4967
• Grahame suggestion for future topics
  • when are we going to issue a profile around app registration (profiling standard rfc to match smart app launch so we're interoperable at that level too
  • what are we going to do about Smart App Launch scopes? What's the relationship between scopes and consent?
  • when are we going to work on a protocol to leverage to OAuth to enable to different FHIR servers to communicate directly with each other?
  • are we going to back backend services and adopt that? Do we need to say anything about certificate management? Are we going to adopt openID tokens for communicating user in focus on backend services?
  • what questions should I be asking that are blocking patients|providers|payers from actually accessing the information they should be able to get?
• New business