1. Data Segmentation for Privacy VA/SAMHSA/Mitre/Jericho Pilot Sprint 5 Review Sprint #5 Technical Objectives – (2 week sprint ending July 27, 2012) Story: Stand up a live Jericho PDP – VA Team Acceptance Criteria: Jericho PDP is “set up” and generates XACML request/response for authorization decision and this can be demoedPotential Impediment: need Jericho PDP set up in the next two weeks (Mike Dufel at Jericho.) Story: Standup VA Context Handler that uses Jericho PDP – VA Team Acceptance Criteria: The Context Handler communicates with the Jericho PDP for authorization decision. Story: Create a client to connect to live context handler - VA Team Acceptance Criteria: The end point of the context handler points to the Edmond scientific deployment of the context handler webservice. Story: Complete design related to rules generation (organization policies rules) – FEI/VA Acceptance Criteria: The team understands the clinical policies that are expressed in the Kathleen’s spreadsheet (the policies that Kathleen has so far)The design has been updated to reflect Kathleen’s requirements Potential Impediment: The meeting with Kathleen, scheduled for Wednesday needs to happen and be successful (Duane & Joel are planning to meet Wednesday afternoon to do the design update). Story: Update XSLT for C32 tagging to reflect policy decision matrix Acceptance Criteria: The XSLT for c32 Tagging component has been update to reflect the design changes related to rule generationPotential Impediment: The design update must be completed first (previous story) Story: Update Push Orchestrator to integrate various components (Phase 2). – FEI Team Acceptance Criteria: Push Orchestrator stub to the context handler has been replaced by a live connection to the context handler.Push Orchestrator can connect to REM c32 pull service Story: Change interface to Clinical Adaptive Services (CAS) to send purpose of use and law-related obligations – VA Team Acceptance Criteria: CAS interface to Drools services can send purpose of use and law related obligations.Potential Impediment: Meeting with Kathleen and updating of design must occur.

2. Data Segmentation for Privacy VA/SAMHSA/Mitre/Jericho Pilot Sprint 5 Review Sprint #5 Technical Objectives (cont.) Story: MITRE to update Kairon web service to reflect sensitivity Acceptance Criteria: Karion webservice response to the ACS provides sensitivity codes Chore: RTM for DS4P Workgroup Acceptance Criteria: RTM has been reviewed by the team before the Monday meeting with the WG Chore: Set up patient IDs that exist across all systems (includes Karion) Chore: Create initial cut on XACML policies Initial cut of XACML policies include: Secondary evaluation of patient authorization and obligation related to sensitivity Primary US privacy law obligation that is specific that is specific to the servicing organization. (need to discuss how we will demonstrated supported obligations by the requesting organization)

3. Data Segmentation for Privacy VA/SAMHSA/Mitre/Jericho Pilot Sprint 5 Review July 2012 August 2012 September 2012 Patient Consent Services Reference Model Release/ Foundation Library Build Design Release Draft Final ONC Demonstration Virtual Demonstrations/Testing Development/Integrate/Test DS4P Rules Engine Design Release Development/Integrate/Test DS4P Policy Engine and Services Design Release Development/Integrate/Test Sprint #5 September 24 th Mitre/VA FEISystems/VA JerichoSystems/VA Team Integration Sprint #6 Test and Validation Sprint #7 Document & Demonstrate Sprint #8 & #9 Project Milestones Phase 1 – Push Scenarios

4. Data Segmentation for Privacy VA/SAMHSA/Mitre/Jericho Pilot Sprint 5 Review RTM – Review/Discussion Only Scenario #1, #4, Break Glass addressed in Phase 1 Partial Capabilities Discuss REM capabilities requiring RTM update Consent Directive – Kairon update to CDA Consent Directive XDS and XD* protocols demonstrated on receiving end of Push