April 21st 2009 Security Conference Call

Security Working Group Meeting

• Meeting Information

==Attendees== (expected)

• Bernd Blobel Security Co-chair, absent
• Steven Connolly
• Ed Coyne
• Mike Davis Security Co-chair
• Suzanne Gonzales-Webb CBCC Co-chair
• Russ Hamm
• Bob Horn
• Glen Marshall Security Co-chair
• Rob McClure
• John Moehrke
• Milan Petkovik
• Pat Pyette
• Scott Robertson
• Richard Thoreson CBCC Co-chair
• Ioana Singureanu
• Tony Weida
• Craig Winter

Agenda

postponed to next week:

1. (05 min) Roll Call, Approve Minutes & Accept Agenda
2. (55 min) Object Vocabulary - Q&A Object Ontology ~ Steve Connolly

Note: Object List is a Normative spec published by ANSI in 2008

1. Comments
   1. terms should not be deleted but deprecated with a note that states why the term is being changed (i.e. duplicate, substituted with another term)
   2. Descriptive types notes, summary, report - we had to determine if there were consistency in each of these types. if they are well defined descriptions then we will have to deal with them in another way. We will need to determine singular or plural form of an object and how we portray that. (current list is not consistent)
   3. 2a - terms lean toward verbiage that is common usage or possibly external code systems.
      1. OpenEHR object vocabulary: Clinical Investigator Record Ontology" spreadsheet
   4. another place to look would be in ActInformationCategory Code used in Canada and based on domain data. This would allow the information to blend. (X-type)
   5. recapture some of the original confidentiality code outside of HL7 and it would be useful if all healthcare objects have the same vector and have the same naming here.

We are labeling things toward the type of information. When you label something for confidentiality you are labeling content i.e. type of data Lab Result, content - low white blood cell count which may indicate a disease and limited people may view. This is where patient preference may enter. (Security vs confidentiality differences, align respresentations between the two despite the differences) (John/Glen) will be speaking offline

1. 1. Bolded information (add link from RBACObjectVocabulary.xls) is added to clarify information needed to protect rather that confusion with a process
   2. All objects have a level of sensitivity to them.

1. (15 min) Security Use Cases Ioana Singureanu/Steve Connolly
2. (5 min) Other Business

Action Items

Back to Meetings