1. Sprint 158 Review / Sprint 159 Planning May 18 th – June 1 st 2015

2. Sprint Resource Pages For this sprint, visit: https://connectopensource.atlassian.net/wiki/display/NHINProgress/S print+158+Progress+Summary https://connectopensource.atlassian.net/wiki/display/NHINProgress/S print+158+Progress+Summary For next sprint, visit: https://connectopensource.atlassian.net/wiki/display/NHINProgress/S print+159+Progress+Summary https://connectopensource.atlassian.net/wiki/display/NHINProgress/S print+159+Progress+Summary For complete information on the CONNECT 4.4.1 release visit: https://connectopensource.atlassian.net/wiki/display/CONNECT4/4.4.X +Patches https://connectopensource.atlassian.net/wiki/display/CONNECT4/4.4.X +Patches 2

3. Sprint 158 Summary - Cumulative Flow 3

4. Sprint 158 Summary – Sprint Statistics Points committed = 21 –Initial points committed were 20 –3 tickets added to Sprint 158 for 3 –1 ticket was removed from Sprint 158 for 2 Points remaining (unclosed) at end of sprint = 4 Points completed in sprint (velocity) = 17 4

5. Sprint 158 - Proposed Themes Development / Community Support X12 Auditing Development, Integration and Testing –Development cleanup and address any testing findings –Complete remaining testing both Batch & Real-time –Schedule demonstration to CMS & Complete Documentation Closeout the Remaining Tasks Incorporating Automated Direct Testing in Regression Suite and CI processes –Execute all Happy Path tests in an automated manner –Resolve issues with automating negative test cases Complete Gateway property elements/attributes clean-up –Final clean-up of adapter properties –Update documentation Technical Stories –Migrate old Universal Client Code to Plugin –Deploy CONNECT of WebLogic 12.1.3 –Address additional Fortify scan findings 5

6. Sprint 158 - What We are Reporting Today Partner and Community Support Partner and Community Support – CMS (4.2.1) CONN-1615 - Could not write attachment issue in CONNECT Gateway o Provided initial analysis and asked follow up questions, awaiting response from CMS CONN-1603 - Deferred Response issue – PolicyException (QA) o Not able to recreate issue, suggested reconfigure server, awaiting verification of issue closure with CMS CONN-1587 - XDRAcknowledgement issue - added error in description o Requested additional information, awaiting response from CMS – eHealth Exchange CONN-1611 - Validate compatibility after new participant sub- nodes exposed on the EHEX validation UDDI o Follow up with MedVA to get patient information for testing 6

7. Sprint 158 - What We are Reporting Today Partner and Community Support Partner and Community Support – DoD (4.3.1) CONN-1616 - Problems getting FIPS DB configured with CONNECT 4.3.1 on JBOSS EAP 6.3 o Performed analysis and determined issue with store type PKCS11, targeted fix for Sprint 159 CONN-1610 - Configuring CONNECT 4.4 datasource in JBoss o Provided configuration information and closed ticket CONN-1609 - receiving NULL pointer exception on PD response due to a mission ‘Conditions’ element o Determined that the ‘Conditions’ element wasn’t a required element and shouldn’t create an exception o Required a code fix, implemented in Sprint 158 7

8. Sprint 158 - What We are Reporting Today Partner and Community Support Partner and Community Support – VA (4.2.2.2) CONN-1613 - VA Adapter platform upgrade issue from WebLogic 10.3.5 to 12.1.3 o Working with VA implementation team on issue o Gateway is working with 12.1.3 without issues CONN-1607 - Problem writing SAAJ model to stream o Analyzed information sent and requested more logs o Awaiting response from VA CONN-1606 - Question about SAML header content requirements – concerning Resource ID and LivingSubjectID element o Provided guidance about how the gateway handles these and associated use cases currently in production o Awaiting confirmation from VA to close ticket CONN-1604 - Operational timeouts for PD and QD o Responded back with timeout information, awaiting confirmation to close ticket 8

9. Sprint 158 - What We are Reporting Today Partner and Community Support Partner and Community Support – CMS and HIH SAML Assertion Issue (NIST Testing) Verified CONNECT is sending a compliant message per the specification Working with CMS on workflow and how Assertion ids are being sent over to the gateway from the adapter – SSA (4.3.2) CONN-1602 - The “Purpose Of Use” HL7 Attributes Scoping Issue o Issue seems to occur when exchanging with.NET implementations which differs from current EHEX position o Performed additional research on whether supported versions of CONNECT are able to accept both qualified and unqualified SAML role and PurposeOfUse attributes o Monitoring issue with Healtheway and Spec Factory 9

10. Sprint 158 - What We are Reporting Today Partner and Community Support Partner and Community Support –Continued community support for other adopters installing CONNECT and beginning their testing and validation The two organizations implementing 4.4.1 passed eHealth Exchange certification testing without any gateway issues CONN-1614 – Direct Outbound Message Monitoring Issue when sending messages for SOAP edge protocol CONN-1612 - Worked with community member on JBoss installation CONN-1599 – Document Retrieve issues between MedVA and VA, working with MedVA on possible network cause Forums - Supporting community member with Direct configuration and setup Forums - Null Pointer Exception when PD response get the sender's home community id from the optional element 10

11. Sprint 158 - What We are Reporting Today Partner and Community Support Current Partner Supported Platforms 11 AgencyCONNECT VersionJVM Application Server Server Platform DoD4.3.11.7WebSphere 8.5.5 Red Hat Linux version 6.5 - 64 bit VA4.2.2.21.7WebLogic 12.1.1 Red Hat Linux version 6.1 - 64 bit CMS4.2.11.7WebSphere 8.5Solaris Sparc 10 and x86 SSA4.3.21.7WebSphere 8.5Sun Solaris Sparc 10

12. Sprint 158 - What We are Reporting Today Partner and Community Support CONNECT Critical Infrastructure Updates for post 4.5 Java 7/JDK 1.7 Upgrade (Remove support for Java 6/ JDK 1.6) Recommendation from the DoD SCQC team – multiple vulnerabilities are found in dependency scans Significant performance improvements in newer release Reduction in the cost of feature development not developing for two versions of Java to ensure functionality works and is supported by the less robust capabilities of Java 6/JDK 1.6 as well as Java 7/JDK 1.7 Java 6/ JDK 1.6 is out of date, released almost 8 years ago (Release date: 2007-05-07) support is becoming increasingly difficult This should be a straightforward matter as most the of the federal partners have upgraded their app servers to versions that support Java 7/JDK 1.7 – Through the app server support of Java EE 6 Only new development of features post 4.5 will be developed using Java 7/JDK 1.7 12

13. Sprint 158 - What We are Reporting Today Partner and Community Support CONNECT Critical Infrastructure Updates for post 4.5 Apache CXF 3.0.4 Upgrade Security vulnerabilities and bugs are found in the current CXF version 2.7.3 used by CONNECT, these are addressed in version 3.0.4 o The security and dependency scans have documented these issues Increased support for a wider variety of industry validation tools Support for additional use cases such as the latest Java Restful implementation (JAX-RS 2.0) Support for latest Java Bean Validation 1.1 This upgrade will be minimally invasive, CXF is packaged as part of CONNECT and won’t affect other applications in the partners environment The upgraded version will only be packaged with post 4.5 versions of CONNECT 13

14. Sprint 158 - What We are Reporting Today Post Release 4.4 Cleanup Technical User Stories –Direct Testing Automation Update 100% Positive Direct test cases automated and added to regression suite running nightly Includes inbound and outbound Direct configuration for Jenkins JBoss now polls the mail server Direct key-stores and database scripts to support test case automation have been created 40% of Negative Direct test cases automated and added to the regression suite running nightly –Completed generic and Trust Anchors –Still working to address some issues with automating test cases for key stores and trust bundles 14

15. Sprint 158 - What We are Reporting Today Technical Improvements Technical User Stories –Completed set up of a WebLogic 12.1.3 testing instance Installed CONNECT with the latest WebLogic version 12.1.3 in test environment Ran validation suite and ensure it all tests passed Ran Direct testing (one inbound and one outbound) and ensured test cases passed Ran AdminGUI smoke tests (ping utility, direct testing, add trust bundle, add anchor, browsing the pages) Documented environment information on wiki https://connectopensource.atlassian.net/wiki/x/mYHB https://connectopensource.atlassian.net/wiki/x/mYHB –Mitigated "XML External Entity Injection" Fortify Finding Fixed "Unreleased Resource: Streams" Fortify Finding, resolved and not showing up on subsequent scans Updated justification at: 4.5 Fortify Documentation4.5 Fortify Documentation 15

16. Sprint 158 - What We are Reporting Today Technical Improvements Technical User Stories –Designed and developed Timeout by Transaction feature Design approach information on wiki Design Approach Timeout by TransactionDesign Approach Timeout by Transaction Added assertion element to entity request and edited decorator to check configurable value Tested three different scenarios –If element has a positive value, timeouts at roughly that response time –Optional transactionTimeout element not included defaults to gateway.properties setting –If element has a value less than or equal to zero defaults to gateway.properties setting Continued with testing on other application servers Create a new test case wiki page Transaction Timeout TestingTransaction Timeout Testing 16

17. Sprint 158 - What We are Reporting Today X12 Auditing X12 CAQH CORE Auditing Support –Audit logging functionality for X12 Real-time transactions Added additional required elements to be logged Performed Pass-through X12 Audit Logging code cleanup Completed X12 Batch Audit Logging for both response and request messages –Draft version of the NwHIN CAQH CORE X12 Document Submission Specification Available Includes some of the updates during implementation of the specification for CMS/esMD Draft version – Updated SpecificationUpdated Specification –Links to Supporting Wiki Pages for X12 CAQH CORE transactions X12 CAQH CORE Design X12 CAQH CORE Requirements 17

18. Sprint 158 - What We are Reporting Today Gateway Configuration Services System Administration Module – Service to Manage Gateway Properties –Created Wiki page to include definitions and usage for all gateway.properties entries Usage of CONNECT Gateway Properties –Continue to refine Required Attributes and Categorize Parameters into proper functional areas to ease effort of gateway configuration –Added a tab for adapter properties –Completed edits to adapter.properties file for display Added additional information and comments for easier understanding and configuration –Finished documentation updates for System Admin Module for Adapter.Properties 18

19. Sprint 158 - What We are Reporting Today Release 4.4.1 Patch Release 4.4.1 is Available as of January 26th –Patch Release 4.4.1 Wiki Page: https://connectopensource.atlassian.net/wiki/display/CONNE CT4/4.4.X+Patches https://connectopensource.atlassian.net/wiki/display/CONNE CT4/4.4.X+Patches –eHealth Exchange Certification Updates for 4.4.1 Set "mustUnderstand" attribute on the WS-Addressing Action element in the SOAP response message Fixed issue - CONNECT is removing SemanticsText value for MatchCriterionList elements - MatchAlgorithm and MinimumDegreeMatch Fixed to make the scoping of the hl7 attributes configurable for the Role and PurposeOfUse SAML assertion elements –Hl7 attribute scoping for Code, CodeSystemName and DisplayName used in the PurposeOfUse and Role elements in the SAML assertion 19

20. Sprint 158 - What We are Reporting Today Release 4.4.1 Patch Release 4.4.1 is Available as of January 26th –eHealth Exchange Certification Updates for 4.4.1 (cont.) Reviewed all manual certification checklists (1500+ items): eHealth Exchange Manual Checklist Findings eHealth Exchange Manual Checklist Findings –System Administration Module - Connection Utility The Sys Admin Module has been configured with a new utility that will allow an organization to ping potential trading partners to verify connectivity before testing messages Additional information can be found at the following link: System Administration Module User Guide System Administration Module User Guide Design updates can be found here- System Administration Module Ping Utility Design System Administration Module Ping Utility Design Test scripts are updated here- System Administration Module Ping Utility Test Cases System Administration Module Ping Utility Test Cases 20

21. Sprint 158 - What We are Reporting Today Custodial Agent and Community Support Ongoing Product Backlog work, CCB and CONNECT Roadmap Updates –Finalized as of March 31 st Top focus to be on projects that facilitates implementation, exchange partner testing/onboarding and operational Beginning preliminary work and planning for post 4.5 –Distributed the updated Roadmap which included additional identified requirements The Roadmap can be found on the CONNECT wiki: CONNECT 2015 Roadmap CONNECT 2015 Roadmap Bug Fixes and Other Tasks –See Technical Stories Section Product Backlog –JIRA Product BacklogJIRA Product Backlog 21

22. Sprint 159 - Proposed Themes Development / Community Support X12 Auditing Development, Integration and Testing –Final cleanup tasks and Batch and Real-time testing –Schedule demonstration to CMS & Complete Documentation Complete Gateway property elements/attributes clean-up –Complete migration of old Universal Client Code to Plugin Release 4.5 Preparation Tasks –EHEX/NIST certification tests –Continue to addressing Fortify scan findings Technical Stories –Complete timeout by transaction testing –Continue to automate Direct negative test cases Support Tasks –DoD JBoss FIPS installation (PKCS11) –WebLogic 12.1.3 VA Adapter upgrade –eHealth Exchange sub-node patient matching testing 22

23. CONNECT 4 Community Announcements CONNECT Awareness –Open sprint review and planning updates Look for Sprint Summaries https://connectopensource.atlassian.net/wiki/display/NHINProgre ss/Progress+Summary+Page https://connectopensource.atlassian.net/wiki/display/NHINProgre ss/Progress+Summary+Page Ask questions and participate in discussions on the CONNECT forums –CONNECT 4 Blogs and Forum posts http://www.connectopensource.org/developer-resources/forums 23

24. Questions or Discussions? 24

25. FHA Overview Established by the Office of Management and Budget as an E-Government Line of Business (LoB) Initiative Supports federal activities related to the development and adoption of health IT standards and policies Ensures that federal agencies seamlessly and securely exchange health data with other agencies, government entities, and with other public and private organizations 25

26. Find out more about FHA on the ONC website: http://www.healthit.gov/FHA http://www.healthit.gov/FHA Schedule a meeting with me or send me your thoughts at: federal.health@hhs.govfederal.health@hhs.gov Subscribe, watch, and share: @ONC_FHA, @CONNECT_Project Federal Health Architecture http://www.flickr.com/photos/federalhealtharchitecture/ Stay Connected, Communicate and Collaborate 26