HL7 May 2018 WGM MINUTES - Cologne, Germany
Contents
Monday Q3
Joint CBCP - Security
See CBCC Minutes
Monday Q4
Joint CBCP - Security
See CBCC Minutes
Tuesday Q1
Opening Security WG Meeting
Attendees:
- Trish Williams trish.williams@flinders.edu.au
- John Moehrke John.Moehrke@gmail.com
- Alexander Mense alexander.mense@hl7.at
- Kathleen Connor Kathleen.connor@comcast.net
- Hideyuki Miyohara HL7 Japan Miyohara.Hideyuki@ap.MitsubishiElectric.co
- David Pyke david.pyke@readycomputing.com
Chaired by Alex
1. Introductions
2. Approval of agenda
- Discussion on content in relation to Blockchain and its potential impact. This will be included in the agenda and discussion of the potential use cases.
Proposed - Kathleen Seconded - John Approved: 5:0:0
3. International Report outs (given at meeting with CBCP Monday Q3)
- Japan: In 2020, Japan will have a full patient national ID.
- EU: * EU NIS (cybersecurity) directive deadline for national transposition into law was last week. Many countries (Austria) have missed the deadline. There for in Austria only critical infrastructure is applicable.
- Australia: Privacy breaches reporting has begun in Australia, 25% were healthcare providers
- Canada has begun requiring statistics collection of Privacy breaches, the privacy commissioner will report out nationally
- In the US, ransomware is a breach
- Switzerland: Launched a working model for a national HIE based on an upcoming new restricted national ID and IHE profiles. Double opt-in (clinicians and patients may) should be live by 2022. Privacy restrictions will be patient based. Documentation will be sent to the CBCP list
4. Liaison Reports: ISO, IHE, ONC
- ISO (Hide): ISO: Audit trail discussions (27789 Audit Trail for EHR) Change proposal to keep conformance with ATNA, etc. Some vocabulary, such as purpose of use, is not harmonized among SDOs. ISO will harmonize/constrain/map these vocabularies as part of their process.
- OASIS
- IHE: AS4 Security has been mandated and IHE is setting up a new Document Sharing set of options based on AS4 requirements.
5. FHIR Security Report out - John Moehrke
6. HL7 Project status and updates:
- Trust Framework for Federated Authorization (TF4FA) Ballot outcomes and reconciliation plans - Kathleen for Mike Davis and Chris Shawn
- Trust Framework for Federated Authorization (TF4FA) Ballot outcomes and reconciliation plans - Kathleen for Mike Davis and Chris Shawn
- TF4FA Volume 3 for Audit, Provenance, and Blockchain Development Plans - Kathleen for Mike Davis and Chris Shawn
- TF4FA Volume 3 for Audit, Provenance, and Blockchain Development Plans - Kathleen for Mike Davis and Chris Shawn
- Is Privacy Obsolete Study Group -Kathleen for Mike Davis
- DAM Need to progress to publication, was not completed from last meeting as new information in form was required. Alex and Trish to progress.
- Status of PASS Audit
- At the request of SOA, the status of PASS Audit has been requested as this is still sitting at reconciliation for the normative publication. SEC WG will request Mike to clarify what content for PSAF is in relation to PASS Audit.
- All PASS projects need to be with SEC not SOA. This was historical but it now makes more sense for the PASS work to sit with SEC. Trish and Alex to talk to Dave Hamill and SOA about making this happen.
- Status of PASS Audit
Tuesday Q2
Joint with CBCP - FHIR Connectathon Report Out/July Harmonization
Attendees:
1.July Harmonization Focus
- Sharing with Protections - TEFCA Minimum Necessary given expanded Purposes of Use and need to establish Legitimate Relationships - Provisioning with ABAC Clearances & Security Labels
- Possible GDPR Security Label vocabulary - Kathleen
2. Findings from Cologne GDPR and Blockchain Connectathon Tracks
3. EU Security Items - TBD
Tuesday Q3
Joint CBCP, Hosting Security
- Brian Postlethwaite regarding new PSS
- Report out on FHIR Privacy and Security ballot outcomes - Dave and John
Tuesday Q4
Security TF4FA Ballot Reconciliation Work Session
Attendees:
Chaired by
Wednesday Q1
Joint with EHR, CBCP, FHIR, SOA, Security(EHR hosting)
See EHR Minutes
Includes discussion about:
- Standards support for key GDPR Policies - Rene Spronk
- TF4FA Ballot Outcome and Next Steps - Kathleen for Mike Davis and Chris Shawn
Wednesday Q2
No meeting
Wednesday Q3
Security WG deep FHIR topics
Attendees:
Chaired by
Wednesday Q4
Security WG European Privacy and Security Issues Meeting
Attendees:
Chaired by
- Rene Spronk Video on Standards support for GDPR
- FHIR Chat Zulip - GDPR POU
- GDPR wiki (General Data Protection Regulation)
Thursday Q1
Security hosting CBCP, FHIR-I Joint
Attendees:
Chaired by
1. FHIR Security Agenda TBD
Thursday Q1
Security WG Admin Meeting
Attendees:
Chaired by
- Workgroup Health Update - Cochairs
- See PBS Metrics 2018May Interim Report Need to publish S&P DAM May 2014 Informative Ballot
- S&P DAM May 2014 - still needs publication request to complete this missing WG Health Item
- Governance Documents - Cochairs
- 3 Year Plan Refresh - Cochairs
- WGM Minutes Drafting - Cochairs
- Conference Call Scheduling - Cochairs