HIT Standards Committee

HIT Standards CommitteeHIT Standards Committee

Privacy and Security Workgroup: Privacy and Security Workgroup:

Standards for Consumer Engagement

Dixie Baker, SAIC

Steve Findlay, Consumers Union

May 26, 2010

2

Privacy and Security Workgroup Members

• Dixie Baker, SAIC• Anne Castro, BlueCross BlueShield of South Carolina• Aneesh Chopra, Federal Chief Technology Officer• Ed Larsen, HITSP• David McCallie, Cerner Corporation• John Moehrke, HITSP• Steve Findlay, Consumers Union• Gina Perez, Delaware Health Information Network• Wes Rishel, Gartner • Walter Suarez, Kaiser Permanente• Sharon Terry, Genetic Alliance

3

Consent Standards Educational Sessions

• Continued educational sessions on current standardization activities related to consent management

– HL7 Consent Directives – Ioana Singureanu• Component Privacy Consent Directive Domain Analysis Model

• Implementation Guide for Consent Directive

• Coming Up – June 17, 10:00am-12:00pm ET: Veterans Health Administration (VHA) pilot of HL7 Consent Directives and OASIS Cross-Enterprise Security and Privacy Authorization (XSPA) and eXtensible Access Control Markup Language (XACML) – John (Mike) Davis

4

Consent Directives Implementation Pilot

Runtime Rules Engines translate

policy into access-control rules

HL7 StandardeConsent<XML>instance

eConsent<XML>instance

eConsent<XML>instance

ePolicy<XML>instance

ePolicy<XML>instance

ePolicy<XML>instance

ePolicy<XML>instance

ePolicy<XML>instance

eConsent<XML>instance

eConsent<XML>instance

CDA R2ImplementationGuide

Access Control Rules (XACML)

Platform-independent,standard-based, interoperable,

harmonized

Common Terminology

HL7 V3

Domain Analysis Model

5

Policy Support

• Provided input to Health Information Technology Policy Committee (HITPC) regarding privacy and security policy needs

• Joy Pritts talked to Workgroup about ONC’s plan to create a Privacy and Security Task Force, under HITPC, to work intensively over the summer to define privacy and security policy to be applied consistently across ONC projects and programs– Workgroup encouraged involvement of technical experts in Task

Force and offered support– Privacy and Security Workgroup efforts to consider and

recommend standards, implementation specifications, and certification criteria will abate pending policy decisions from the new Task Force