Presentation on theme: "Harmonized Privacy and Security Domain Analysis Model Draft for Peer Review"— Presentation transcript:
Harmonized Privacy and Security Domain Analysis Model Draft for Peer Review http://gforge.hl7.org/gf/project/security/frs/
Overview Draft DocumentPeer Review Form http://gforge.hl7.org/gf/project/security/frs/
Changes Harmonization – Security and Privacy view points identified and related to each other – Common classes resolved ProviderOrganization Organization – Removed overlaps – Consolidated Security Privacy Use Cases and class definitions – Alignment with ISO 22600 (Part 2 Formal Models) Health informatics — Privilege Mgmt and Access Control Reconciliation January 2010 Ballot To do: – Alignment with ISO/IEC 15816 (SECURITY INFORMATION OBJECTS FOR ACCESS CONTROL)
Use Case: Negotiate Policy Sam Jones has been provided with a form to register his privacy preferences. He indicates tha t he does not want Dr. Bob to access his records. Sunnybrook Hospital has a rule that provide s access to all patient records to treating physicians. Mr. Jones is alerted to this rule when he enters his preferences. Although Dr. Bob is not Mr. Jones’ primary physician, there may be oc casions when Dr. Bob would be granted access to Mr. Jones’ medical record. Mr. Jones does not agree to the policy and does not sign the consent form. Because the hospi tal cannot provide service to Mr. Jones without a signed consent form, a privacy officer at the hospital is alerted to this and contacts Mr. Jones. The privacy officer explains the situation to Mr. Jones and explains the different options that are available and their consequences. Mr. Jones either selects an option that he is comfortab le with or suggests an alternative option. The privacy officer then complies with Mr. Jones’ d ecision or evaluates the alternative option. This process continues until a mutually satisfactory option is reached. All jurisdictional policies are complied with and neither organizational policy nor consent dire ctive has been changed without the stakeholders’ knowledge. One possible resolution to the conflict could be that the hospital and patient have not come to an agreement and the patie nt has decided to seek healthcare services at another hospital.
Use Cases Business Technical Interactions elaborated