Security WG Health Metrics

1. Security WG Health Metrics Kathleen Connor VA (ESC) HL7 September 2012 WGM

2. Purpose • Discuss Security WG 3-Year Plan (3YP) status • At SSOA PSS Review: • TSC indicated that WG doesn’t have 3YP • “Red Mark” on WG Health • Since that is not a serious infraction, it won’t impact the new SSOA project. • Findings: • 3YP Explanation and Use unclear • >35% WGs do not have 3YP

3. Next Steps At Security WGM approve a 3YP PPS and submit to PMO • Set up wiki page to manage 3YP • Decide on which current and potential project to include in 3YP • Add current Project # as dependencies • List current Project Milestones for project timeline • Set up 3YP Project in Project Insight

4. 3YP Project Examples • WG 3YP could include: • SSOA PSS Deliverables • Security and Privacy Ontology • Balloting of Healthcare Privacy and Security Classification System

5. Security WG Project List • Next 2 slides list the Security WG projects in Project Insights Database

8. Other Security WG Health Indicators Security WGM agenda item: WG should review and update these metrics and address deficiencies with action plan

9. 3YP Background

10. Work Group Three-Year Plans From HL7 TSC • Work Group Three-Year Plans (Strategic Forecasting) • Work Groups' Three Year Planning projects are visible here in the Project Insight Searchable Database, having a Project Status of 'Three-Year Plan Item' • Activities identifiable as Projects that can be scheduled in three-year plans should be sent to the PMO for inclusion in the Project Insight Searchable Database. • For a project intended to communicate future planning you can include as little as a title, description, and anticipated date when work will begin. • As planning dates come near, a full project scope statement should be developed and approved through the Work Group, Steering Division, and TSC. • Three-year plans should be reviewed (and updated if necessary) at least annually. • Why create three-year plans? See November 2008 Technical Newsletter (Headline bottom of page 7, content begins on page 8), here • See Guidelines on three-year plans, versus what might be more appropriate for inclusion in a Mission and Charter statement.

11. Why create three-year plans? Three-year plans are used in the preparation and evaluation of organizational strategies, as well as to assess the alignment of proposed workgroup projects with the published strategies of the working group. Thus, proposed projects that do not fit into any of the currently accepted strategies would be deemed out of scope for the organization, but could be considered for inclusion in future strategic initiatives when the roadmap is updated. SWOTs and three-year plans provide both the input and focus of the needs of HL7s primary constituencies, i.e. the membership doing the actual work of standards development and the consumers of the HL7 work products. By integrating these documents along with the high-level business strategies of the organization, HL7 is able to focus its limited resources in the most productive manner, while still providing a high level of value to stakeholders in the health community.

12. TSC Three-Year Plan Guidelines Three-Year Planning items will appear on the Project Insight Searchable database so they can be retrieved by Work group, keyword, project type, and so on. They need be nothing more than a description and a target date (i.e. bullet items with dates as initially requested), although as much detail as is available is welcome. • More ‘strategic’ items might be added to a Work Group’s Mission and Charter to be retrieved by the general web site search mechanism. • This is intended to provide a more streamlined method to provide summary reporting on the activities of the Work Group. Draft a 2-3 year plan (bullet items with dates would be sufficient), to communicate to others what the work group is undertaking • Existing Three-Year plans may have included a mix of strategic and tactical elements. All Three-Year plan items will be moved into Project Insight, without need for a Project Scope Statement Review current Three-Year Plan, including open projects in Project Insight, and potential revisions to the Work Group Mission and Charter • Identify those elements that are part of the Work Group’s day to day, WGM to WGM, and year to year business that do not have specific targets, milestones, or activities, to be revised for inclusion in the Work Group Overview (Mission and Charter) on the web site. Document the Work Group’s Maintenance processes and open projects in Project Insight • Consider identifying some of the periodic or maintenance–type tasks to be represented by an annual entry on the Three-Year Plan in Project Insight (as a three-year planning item not requiring a Project Scope Statement)

13. How should a Work Group document annual work/maintenance within Project Insight? Answer: • A project entry should be opened in Project Insight indicating the annual work and the respective years.  • This project should have a Project Status of ‘3 Year Plan Item’ • Note that a Project Scope Statement isn’t needed for this entry because it’s a 3 Year Plan item and only high level information is necessary.    • This project can then remain ‘as-is’, or modified so it indicates accurate future years. • When the Work Group actually begins the annual work, they should complete a PSS indicating the scope of work involved and gather the necessary approvals for the PSS • A new project in Project Insight will be created (and will have a Project Status of ‘Active Project’) • Once the scope of work has been completed for this project, it will be closed/archived. • Hence, the 3-Year Plan project always remains open • The ‘Active Project’ PSS will be the project reflecting the specific annual maintenance being done.

14. How should a Work Group document annual work/maintenance within Project Insight? (cont.) • Example: Project Service2’s annual updates to the PSS Template • Project 531 is the 3YP entry indicating the need for the work in 2010, 2011, 2012, 2013 and beyond. • Project 581 was created to identify the specific work that would be done for the 2010 updated template.  • In January, 2010, project 581 was closed because the new PSS template was released to membership • However project 531 was modified to remove references to ‘2010’ and remains open to indicate the need for the work each year

15. Security WG Sept 2009 Minutes on 3YP Items on Security WG 3-yearplan. • Digital Rights Management (DRM) • Break Glass/Emergency Access • HL7 Pseudonymization and Anonymization Rules • Digital Signatures • Use ISO/TS 22600 (PMAC) for EHR privacy protections • HL7 security architectural model • Genomic Security

16. Security WG Dashboard Ballot Reports Report Notes and Terms General Reports All Active Ballots for Security • (2 items) Active Comment Only Ballots for Security • (2 items) Report Notes and Terms Review for Potential Issues • No available reports for Security. Report Notes and Terms

17. PBS Metrics Link • Unpublished CMETs • Unpublished Ballots • Recirculation Needed • Projects > 120 days Behind • Projects with a ‘Blank’ Status • Work Groups with no 3-Year Plan Item

18. Guidance for Steering Division Co-ChairsUsing PBS Metrics to evaluate WG capacity to undertake new effort Project Insight Tip Sheet(781 KB) This document illustrates how to update project status information in Project Insight, how Project Insight data changes throughout the lifecycle of a project (i.e. as it moves from a 3-Year Plan to an active project and through balloting to closure), and how a Project is closed (archived) in Project Insight. The document includes screen shots, Project Insight field definitions and a State Transition Diagram

19. CBCC 2011 3-Year Plan Has not been updated for several WGMs

20. 35% of WGs do not have 3YPs. This % has been fairly consistent over period tracked.