1. Refrain Policy Vocabulary HL7 Security WG Kathleen Connor VA (ESC) January 2012

2. Refrain Policy Vocabulary Proposal Propose that HL7 develop a “Refrain Policy” Code System to be used as Security Metadata Used to encode types of Refrain Policies Would require adding a code to the Refrain Policy Class for Refrain Policy Type values

3. Relation between Obligation and Refrain Policies Ambiguity about functions of Obligation Policy and Refrain Policy HL7 DAM definition for Obligation Policy: – May be used to indicate that the receiver of an information object may not be allowed to re-disclose or persist that information object indefinitely ISO 22600-2 specifies that an Obligation Policy is “event- triggered and define actions to be performed by manager agent” HL7 DAM definition for Refrain Policy: – Indicates that a specific action is prohibited based on specific access control attributes e.g., purpose of use, information type, user role, etc. ISO 22600-2 species that a Refrain Policy “defines actions the subjects must refrain from performing”

4. Relation between Obligation and Refrain Policies Obligation Policy: A mandated action with a work flow Refrain Policy: A prohibited action. Period. Although a Refrain Policy can be stated affirmatively as an Obligation Policy, including both in the same code system (e.g., all as Obligation Policy Codes) could lead to semantic conflicts if more than one instance of an Obligation Policy is permitted in a Composite Policy For example, an Obligation Policy requiring that disclosed information be encrypted would be incompatible with a Refrain Policy mandating that the information not be disclosed

5. Relation between Obligation and Refrain Policies An Obligation may stem from a Permitted Operation An Obligation may stem from a Refrain Policy on a Permitted Operation

6. Refrain CodesRefrain Definition NOAUTHProhibition on disclosure without information subject's authorization. NOCOLLECTProhibition on collection or storage of the information. NOINTEGRATEProhibition on Integration into other records. NOLLISTProhibition on disclosure except to individuals on specific access list. NOMOU Prohibition on disclosure without an interagency service agreement or memorandum of understanding (MOU) NOORGPOLProhibition on disclosure without organizational authorization. NOPERSIST Prohibition on collection of the information beyond time necessary to accomplish authorized purpose of use is prohibited. NOPROMISE Prohibition on disclosure to an external organization unless agreement to a specific obligation has been obtained. NOREDISCLOSEProhibition on disclosure without authorization under jurisdictional law. NORELINK Prohibition on associating de-identified or pseudonymized information with other information in a manner that could or does result in disclosing information intended to be masked. NORESTRICTIONProhibition on disclosure without organizational approved patient restriction. NOREUSE Prohibition on use of the information beyond the purpose of use initially authorized. NOVIP Prohibition on disclosure except to principals with access permission to specific VIP information. ORCONProhibition on disclosure except as permitted by the information originator. Possible Refrain Policy Type Codes

7. Added Directed Association between Obligation and Refrain