FIRE Mins 2019-10-29

Minutes of regular weekly meeting of the FIRE WG

• Date 2019-10-29
• Attendees
  • Jim Kragh - Chair
  • Sal D'Agostino
  • Mary Hodder
  • Jeff Brennen
  • Tom Jones - recorded these mins
• Agenda - discuss doc Patient Choice

notes

• Discussion of where to take the doc when approved - Jim's proposal was to vet the doc with Dr. Tom Sullivan and the present to Debbie Buchie at ONC. From there it can be presented to the various groups, like the CARIN Alliance.
• Main point of doc was to ensure the following direction of the Trustworthy Healthcare Ecosystem and the Health Care Profile

1. There will be a trust registry of web sites that have been confirmed as entities that are covered by the HIPAA regulations with free access by patients.
2. There will be a way to evaluate healthcare apps that protect patient healthcare Information (PHI) that the patient or guardian accesses.
3. There will be a way to authenticate users to NIST SP 800-63-3 IAL2 and AAL2 that will inter-operate across the above listed entities.
4. The user will trust the resultant healthcare ecosystem.

• The following is a proposed plan for getting to trustworthy patient apps.

1. Code of Conduct of the app - starting with the proposal from the CARIN Alliance with possible input from ME2B work.
2. Code of Practice - a more technical presentation of how the app achieves the designation of meeting the code of conduct.
3. A set of question for the developers and auditors to assure compliance.
4. A regulatory support system from appropriate legal and audit agencies (some means for selecting the approved auditors, etc.)
5. Accepting and incorporating feedback from the field.

• When is a web site or user app considered trustworthy.

1. There is a code of practice and audit available to vet that the software meets the requirements.
2. This is necessary to assure that patient health information in HIPAA covered entities it kept secure and private.
3. This is already in process for web sites
4. If the user is to have real Patient Choice it is necessary that the same process apply to patient apps.

• Mary and Jeff listed the processes that allowed the IDEF to become operational

1. Took 1.5 years of weekly meetings to refine the NSTIC principles in the security, privacy and user experience committees.
2. At the end of that process the efforts were harmonized and the need for a interop section was uncovered.
3. A concierge was hired to help with the coordination, publishing and support for entities that wanted to achieve compliance.
4. Feedback from the result was taken and a second display (trust registry) was created to incorporate that feedback.

• The experience of creating the IDEF would be a good plan for how to move our plans into practice.
• Discussion of patient consent resulting in some ideas to feedback into the Kantara groups working on that part of the problem.

1. Tom will take Mark's diagram and change the labels to meet the Health Care Profile now in development.

• After the meeting the following diagram was distributed. This DOES NOT include the binding to establish AAL2 assurance.