Privacy and Identity Management subgroup
Work Plan
Date:  June 4, 2009
Approved by the Privacy and Identity Management subgroup of the NHIN Specifications Factory, June 4. 2009.

1.	Participate in the XSPA committee in OASIS to finalize the XSPA-SAML and XSPA-XACML profiles; and participate in the related activities in HL7.
a)	Bring the NHIN Consumer Preferences and Authorization Framework spec as contributions to XSPA.
b)	Identify a few members of the workgroup to formally join XSPA and help write the drafts.  Specifically:
1)	The Specification Factory members should propose changes to the XSPA-SAML profile to allow it to cover the same functional requirements as the current NHIN Authorization Framework specification.
2)	The Specification Factory members should propose changes to the XSPA-XACML profile to allow it to cover the same functional requirements as the Content Semantics of the current NHIN Consumer Preferences specification (section 3.3.3).   
c)	Entire PIM Subgroup to review drafts of the XSPA profiles.
d)	Identify a few members of the workgroup to join these HL7 workgroups:
1)	Community Based Collaborative Care (meets Tuesdays at 2:00 Eastern; seems to use the “security” mailing list)
2)	Security (meets Tuesdays at 1:00 Eastern – this currently appears to be a joint meeting with the CBCC committee to update the HL7 RBAC catalog; “security” mailing list)
3)	PASS project (Thursdays, 1:00-2:30 Eastern; “soa” mailing list)
2.	Specify mechanisms and triggers for exchange of Access Consent Policies on the NHIN.
a)	Identify relevant flows in HITSP TP30; work with HITSP to revise TP30 if necessary.
b)	Include guidance for how to reconcile potentially conflicting policies that are created natively (within an NHIE) vs. received from a foreign NHIE.
c)	How does an NHIE assert the author/owner of an Access Consent Policy?  How to assert that a delegate acting on behalf of the patient has permission to do so?
d)	Is there a necessity to wrap the XACML policy document in a CDA to cover wet signature, digital signature, patient assent to a policy document (as per BPPC)?
3.	Create a white paper to be presented to ONC as an input for further policy work, describing the following topics:
a)	A general description of the Access Consent Model for the NHIN, including definitions of terms related to Access Consent, including “Access Consent Policy”, “directive”, “opt-in” and “opt-out”.
b)	NHIE requirements for re-disclosure:  When an NHIE receives patient data from another NHIE, what restrictions and/or obligations is it under with regards to releasing that data to a third NHIE?
c)	NHIE requirements for re-combination:  When an NHIE receives patient data in a Clinical Document from another NHIE and incorporates it as discrete data elements into its electronic health record for the patient, what restrictions and/or obligations is it under with regards to identifying the source of that data and complying with disclosure restrictions that may have been placed on the original Clinical Document?
4.	Develop a scheme for representing a user's organization/facility in a structured fashion (below the level of the NHIE) on NHIN transactions.  Evaluate the need for developing a scheme for representing users in a structured fashion on NHIN transactions (beyond what the current Authorization Framework provides for), and develop such a scheme if it is determined to be necessary.  
5.	Contribute to the Document Meta-data discussion that will occur in the Information Services sub-team, and bring requirements related to Consumer Preferences/Access Consent Policies to that work.  
6.	Revise the Consumer Preferences specification, and any other NHIN specifications as required, to incorporate the results of 1-5.

It is the goal of the Privacy and Identity Management subgroup to have changes to the Consumer Preferences specification and other NHIN specifications approved by September 30, 2009.