Develop and maintain FHIR security resources

Description

This project will identify and define resources, terminology, profiles, extensions as well as security label metadata necessary to support Healthcare Security and Privacy requirements. These requirements include those identified by international and US domains as articulated in legislation, policy, related standards, and those documented in HL7 Privacy and Security related domain analysis, architectural frameworks, services, and functional models, and various v2, v3, CDA, and FHIR interchange specifications. Specifically, this includes the AuditEvent resource, Provenance resource, Signature datatype, assigned to Security by the FMG as well as profiles and implementation guides created against these resources. The development and maintenance of these artifacts will be conducted in collaboration with other relevant domain work groups as outlined in the Security WG mission and charter. The Security WG will develop guidance regarding use of HL7 Security Standards (e.g. Role and Attribute-based access controls and vocabularies. In addition, the Security WG will work with appropriate external standards organizations to develop appropriate guidance on the use of general purpose security technologies, such as user authentication and authorization, that would aid with the secure and privacy protecting use of FHIR; and guide the FHIR community on the appropriate use of these solutions through the security pages of the FHIR specification, assigned to Security WG by the FMG.

Misc Notes
2019 August: KConnor: Work to mature FHIR artifacts are ongoing – right now focused on prepping FHIR AuditEvent and Provenance for normative in next FHIR ballot. JMoehrke: This is our project for ongoing maintenance of the FHIR core specification. This is very active. 2018 May: VMcCauley: Project #1264 should be transferred from SOA as the primary sponsoring Workgroup to Security. Security will then be the only associated workgroup as SOA’s input to this work was completed some time ago and it remains for Security to reconcile Domain specific comments from the last ballot 2017 Nov: J. Moehrke: At the San Diego meeting the Security WG agreed to extend our project 1209 that enables us to work on FHIR security topics until January 2019 (Post the Release 4). This work will be part of the FHIR ballot. This project will not ballot directly. Instead, content will be combined with resources from other committees and jointly balloted as part of the next FHIR DSTU ballot (managed as a distinct TSC project).