1. Role Based Access Control Update
Presented by:
Mike Davis
Security TC Co-Chair
HL7 Working Group Meeting Phoenix - May 2008

2. ANSI Accepts HL7 Security Standard
In February 2008 ANSI formally accepted the HL7 RBAC Permission Catalog
With the publication of the RBAC Permission Catalog, HL7 introduced standardized healthcare permissions which allows for interoperable access control among healthcare business partners.
Permissions allow for interoperability across business partners – healthcare and non-healthcare
Healthcare organizations will need to assess potential impacts and begin to understand the processes needed to implement current and future systems using interoperable RBAC standards.
Permission catalog is compliant with the ANSI-INCITS
ANSI/HL7 V3 RBAC, R HL7 Version 3 Standard:  Role-based Access Control Healthcare Permission Catalog, Release 1

4. RSA XACML Interoperability Demo
Participating Organizations
XACML PDP: Axiomatics, BEA, Cisco, IBM, Oracle, Redhat, Sun, Symlabs
Healthcare Application: Department of Veterans Affairs (US Gov)
Also: SAMHSA, Fox Systems, GE Healthcare
Theme – Policy Language Power
Five Interacting Use Cases Demonstrating Healthcare Security and Privacy Policy Enforcement

5. XACML Interoperability Demo Healthcare Policy Use Cases
Patient Consent Directives
Clinical Roles and Permissions
Emergency Access
HIS Security Policy
Patient-Directed Data Filtering
All expressed as XACML Policies
OASIS RBAC Profile for XACML
HL7 Permissions ANSI INCITS compliant

9. Call for Action
OASIS using HL7 Vocabularies to create standard Healthcare Profiles of:
SAML-XACML-WA-Trust/WS-Federation
HL7 F&T SD Approved Project to advance vocabulary for Permissions, Patient Consents and Constraints
Full Interoperability Demonstration planned for HIMSS (Apr 2009)