Uploaded image for project: 'FHIR Specification Feedback'
  1. FHIR Specification Feedback
  2. FHIR-28032

Add use-case illustrating that Security labeling does not have to be implemented in the EHR system.

    XMLWordPrintableJSON

Details

    • Icon: Change Request Change Request
    • Resolution: Persuasive
    • Icon: Highest Highest
    • FHIR Data Segmentation for Privacy (FHIR)
    • 0.1 [deprecated]
    • Security
    • Background
    • Hide

      Will add a use case for the use security labeling as a utility service:

        

      #### EHR uses Security Labeling Service as a Utility
      ##### Assumption
      - The EHR has established a trust relation with a SLS provider that enables the EHR to access the SLS API.
      - The EHR has implemented the integration logic required to connect with the SLS API and to incorporate security labeling into the EHR workflows compliant with policies and requirements.
      - The SLS API recognizes and supports the security labeling policies applicable the data in custody of the EHR.
      - If the EHR operations in multiple jurisdictions the SLS API allows the EHR  to specify the applicable jurisdictions (that determine the security labeling policies) for a given resource of bundle.
        
      ##### Pre-Condition
      The EHR determines the jurisdiction/context applicable to the resource/bundle.
      
      ##### Post-Condition
      Resource/bundle, labeled by the SLS, is incorporated back in the EHR workflow.
      
      ##### Actors & Actions
      - Triggered by local workflow events, the EHR system makes an API call to the SLS specifying the resource/bundle that needs to be labeled, alongside, context attributes that could include a range of additional information including jurisdictional, policy, or workflow context.
      - Considering all the applicable policies and based on the context attributes, the SLS determine the labels and returns a labeled version of the resource/bundle.
      
      

       

      Show
      Will add a use case for the use security labeling as a utility service:    #### EHR uses Security Labeling Service as a Utility ##### Assumption - The EHR has established a trust relation with a SLS provider that enables the EHR to access the SLS API. - The EHR has implemented the integration logic required to connect with the SLS API and to incorporate security labeling into the EHR workflows compliant with policies and requirements. - The SLS API recognizes and supports the security labeling policies applicable the data in custody of the EHR. - If the EHR operations in multiple jurisdictions the SLS API allows the EHR to specify the applicable jurisdictions (that determine the security labeling policies) for a given resource of bundle. ##### Pre-Condition The EHR determines the jurisdiction/context applicable to the resource/bundle. ##### Post-Condition Resource/bundle, labeled by the SLS, is incorporated back in the EHR workflow. ##### Actors & Actions - Triggered by local workflow events, the EHR system makes an API call to the SLS specifying the resource/bundle that needs to be labeled, alongside, context attributes that could include a range of additional information including jurisdictional, policy, or workflow context. - Considering all the applicable policies and based on the context attributes, the SLS determine the labels and returns a labeled version of the resource/bundle.  
    • Mohammad Jafari/Greg White: 7-0-0
    • Enhancement
    • Non-substantive

    Description

      In your implementations ection, the IG states that "Security labeling does not have to be implemented in the EHR system" (http://hl7.org/fhir/uv/security-label-ds4p/2020MAY/background.html#implementation); yet, in the use-case section (http://hl7.org/fhir/uv/security-label-ds4p/2020MAY/background.html#pre-condition), there's only a single scenario and a pre-condition for the exchange of information is that the sender of that information assigns security labels. Could you please add additional use-cases in which the sender of the informaton needn't implement security labeling to illustrate and support the assertion in the implementation section?

      Existing Wording:

      Sender determines applicable SLs to convey applicable policy.

      Attachments

        Activity

          People

            Unassigned Unassigned
            Isaac.Vetter Isaac Vetter
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: