Sprint 158 Review / Sprint 159 Planning May 18th – June 1st 2015

Sprint Resource Pages

• For this sprint, visit: https://connectopensource.atlassian.net/wiki/display/NHINProgress/Sprint+158+Progress+Summary

• For next sprint, visit:https://connectopensource.atlassian.net/wiki/display/NHINProgress/Sprint+159+Progress+Summary

• For complete information on the CONNECT 4.4.1 release visit: https://connectopensource.atlassian.net/wiki/display/CONNECT4/4.4.X+Patches

2

Sprint 158 Summary - Cumulative Flow

3

Sprint 158 Summary – Sprint Statistics

• Points committed = 21– Initial points committed were 20– 3 tickets added to Sprint 158 for 3– 1 ticket was removed from Sprint 158 for 2

• Points remaining (unclosed) at end of sprint = 4• Points completed in sprint (velocity) = 17

4

Sprint 158 - Proposed ThemesDevelopment / Community Support

• X12 Auditing Development, Integration and Testing– Development cleanup and address any testing findings– Complete remaining testing both Batch & Real-time– Schedule demonstration to CMS & Complete Documentation

• Closeout the Remaining Tasks Incorporating Automated Direct Testing in Regression Suite and CI processes– Execute all Happy Path tests in an automated manner– Resolve issues with automating negative test cases

• Complete Gateway property elements/attributes clean-up– Final clean-up of adapter properties– Update documentation

• Technical Stories– Migrate old Universal Client Code to Plugin – Deploy CONNECT of WebLogic 12.1.3– Address additional Fortify scan findings

5

Sprint 158 - What We are Reporting Today

Partner and Community Support• Partner and Community Support

– CMS (4.2.1)• CONN-1615 - Could not write attachment issue in

CONNECT Gatewayo Provided initial analysis and asked follow up questions,

awaiting response from CMS

• CONN-1603 - Deferred Response issue – PolicyException (QA)o Not able to recreate issue, suggested reconfigure server,

awaiting verification of issue closure with CMS

• CONN-1587 - XDRAcknowledgement issue - added error in descriptiono Requested additional information, awaiting response from

CMS

– eHealth Exchange• CONN-1611 - Validate compatibility after new participant

sub-nodes exposed on the EHEX validation UDDIo Follow up with MedVA to get patient information for testing 6

Sprint 158 - What We are Reporting Today

Partner and Community Support• Partner and Community Support

– DoD (4.3.1)• CONN-1616 - Problems getting FIPS DB configured with

CONNECT 4.3.1 on JBOSS EAP 6.3o Performed analysis and determined issue with store type

PKCS11, targeted fix for Sprint 159

• CONN-1610 - Configuring CONNECT 4.4 datasource in JBoss o Provided configuration information and closed ticket

• CONN-1609 - receiving NULL pointer exception on PD response due to a mission ‘Conditions’ element o Determined that the ‘Conditions’ element wasn’t a

required element and shouldn’t create an exception o Required a code fix, implemented in Sprint 158

7

Sprint 158 - What We are Reporting Today

Partner and Community Support• Partner and Community Support

– VA (4.2.2.2)• CONN-1613 - VA Adapter platform upgrade issue from

WebLogic 10.3.5 to 12.1.3o Working with VA implementation team on issueo Gateway is working with 12.1.3 without issues

• CONN-1607 - Problem writing SAAJ model to streamo Analyzed information sent and requested more logso Awaiting response from VA

• CONN-1606 - Question about SAML header content requirements – concerning Resource ID and LivingSubjectID element o Provided guidance about how the gateway handles these and

associated use cases currently in production o Awaiting confirmation from VA to close ticket

• CONN-1604 - Operational timeouts for PD and QDo Responded back with timeout information, awaiting confirmation

to close ticket

8

Sprint 158 - What We are Reporting Today

Partner and Community Support• Partner and Community Support

– CMS and HIH SAML Assertion Issue (NIST Testing)• Verified CONNECT is sending a compliant message

per the specification• Working with CMS on workflow and how Assertion ids

are being sent over to the gateway from the adapter

– SSA (4.3.2) • CONN-1602 - The “Purpose Of Use” HL7 Attributes

Scoping Issueo Issue seems to occur when exchanging with .NET

implementations which differs from current EHEX position

o Performed additional research on whether supported versions of CONNECT are able to accept both qualified and unqualified SAML role and PurposeOfUse attributes

o Monitoring issue with Healtheway and Spec Factory9

Sprint 158 - What We are Reporting Today

Partner and Community Support• Partner and Community Support

– Continued community support for other adopters installing CONNECT and beginning their testing and validation

• The two organizations implementing 4.4.1 passed eHealth Exchange certification testing without any gateway issues

• CONN-1614 – Direct Outbound Message Monitoring Issue when sending messages for SOAP edge protocol

• CONN-1612 - Worked with community member on JBoss installation

• CONN-1599 – Document Retrieve issues between MedVA and VA, working with MedVA on possible network cause

• Forums - Supporting community member with Direct configuration and setup

• Forums - Null Pointer Exception when PD response get the sender's home community id from the optional <asAgent> element

10

Sprint 158 - What We are Reporting Today

Partner and Community Support• Current Partner Supported Platforms

11

Agency CONNECT Version JVMApplication

ServerServer Platform

DoD 4.3.1 1.7 WebSphere 8.5.5Red Hat Linux

version 6.5 - 64 bit

VA 4.2.2.2 1.7 WebLogic 12.1.1Red Hat Linux

version 6.1 - 64 bit

CMS 4.2.1 1.7 WebSphere 8.5 Solaris Sparc 10 and x86

SSA 4.3.2 1.7 WebSphere 8.5 Sun Solaris Sparc 10

Sprint 158 - What We are Reporting Today

Partner and Community Support• CONNECT Critical Infrastructure Updates for post 4.5

Java 7/JDK 1.7 Upgrade (Remove support for Java 6/ JDK 1.6)•Recommendation from the DoD SCQC team – multiple vulnerabilities are found in dependency scans•Significant performance improvements in newer release•Reduction in the cost of feature development not developing for two versions of Java to ensure functionality works and is supported by the less robust capabilities of Java 6/JDK 1.6 as well as Java 7/JDK 1.7•Java 6/ JDK 1.6 is out of date, released almost 8 years ago (Release date: 2007-05-07) support is becoming increasingly difficult•This should be a straightforward matter as most the of the federal partners have upgraded their app servers to versions that support Java 7/JDK 1.7 – Through the app server support of Java EE 6•Only new development of features post 4.5 will be developed using Java 7/JDK 1.7

12

Sprint 158 - What We are Reporting Today

Partner and Community Support• CONNECT Critical Infrastructure Updates for post 4.5

Apache CXF 3.0.4 Upgrade•Security vulnerabilities and bugs are found in the current CXF version 2.7.3 used by CONNECT, these are addressed in version 3.0.4

o The security and dependency scans have documented these issues

•Increased support for a wider variety of industry validation tools•Support for additional use cases such as the latest Java Restful implementation (JAX-RS 2.0)•Support for latest Java Bean Validation 1.1•This upgrade will be minimally invasive, CXF is packaged as part of CONNECT and won’t affect other applications in the partners environment •The upgraded version will only be packaged with post 4.5 versions of CONNECT

13

Sprint 158 - What We are Reporting Today

Post Release 4.4 Cleanup • Technical User Stories

– Direct Testing Automation Update• 100% Positive Direct test cases automated and

added to regression suite running nightly • Includes inbound and outbound• Direct configuration for Jenkins JBoss now polls the

mail server • Direct key-stores and database scripts to support

test case automation have been created• 40% of Negative Direct test cases automated and

added to the regression suite running nightly– Completed generic and Trust Anchors– Still working to address some issues with

automating test cases for key stores and trust bundles

14

Sprint 158 - What We are Reporting Today

Technical Improvements • Technical User Stories

– Completed set up of a WebLogic 12.1.3 testing instance

• Installed CONNECT with the latest WebLogic version 12.1.3 in test environment

• Ran validation suite and ensure it all tests passed• Ran Direct testing (one inbound and one outbound)

and ensured test cases passed• Ran AdminGUI smoke tests (ping utility, direct testing,

add trust bundle, add anchor, browsing the pages)• Documented environment information on wiki

https://connectopensource.atlassian.net/wiki/x/mYHB

– Mitigated "XML External Entity Injection" Fortify Finding

• Fixed "Unreleased Resource: Streams" Fortify Finding, resolved and not showing up on subsequent scans

• Updated justification at: 4.5 Fortify Documentation15

Sprint 158 - What We are Reporting Today

Technical Improvements • Technical User Stories

– Designed and developed Timeout by Transaction feature

• Design approach information on wiki Design Approach Timeout by Transaction

• Added assertion element to entity request and edited decorator to check configurable value

• Tested three different scenarios– If element has a positive value, timeouts at

roughly that response time– Optional transactionTimeout element not included

defaults to gateway.properties setting– If element has a value less than or equal to zero

defaults to gateway.properties setting• Continued with testing on other application servers• Create a new test case wiki page

Transaction Timeout Testing 16

Sprint 158 - What We are Reporting Today

X12 Auditing• X12 CAQH CORE Auditing Support

– Audit logging functionality for X12 Real-time transactions• Added additional required elements to be logged • Performed Pass-through X12 Audit Logging code cleanup• Completed X12 Batch Audit Logging for both response and

request messages

– Draft version of the NwHIN CAQH CORE X12 Document Submission Specification Available

• Includes some of the updates during implementation of the specification for CMS/esMD

• Draft version – Updated Specification

– Links to Supporting Wiki Pages for X12 CAQH CORE transactions

• X12 CAQH CORE Design• X12 CAQH CORE Requirements

17

Sprint 158 - What We are Reporting Today

Gateway Configuration Services• System Administration Module – Service to Manage

Gateway Properties– Created Wiki page to include definitions and usage

for all gateway.properties entries • Usage of CONNECT Gateway Properties

– Continue to refine Required Attributes and Categorize Parameters into proper functional areas to ease effort of gateway configuration

– Added a tab for adapter properties– Completed edits to adapter.properties file for

display • Added additional information and comments for

easier understanding and configuration

– Finished documentation updates for System Admin Module for Adapter.Properties 18

Sprint 158 - What We are Reporting Today

Release 4.4.1 • Patch Release 4.4.1 is Available as of January 26th

– Patch Release 4.4.1 Wiki Page: https://connectopensource.atlassian.net/wiki/display/CONNECT4/4.4.X+Patches

– eHealth Exchange Certification Updates for 4.4.1• Set "mustUnderstand" attribute on the WS-

Addressing Action element in the SOAP response message

• Fixed issue - CONNECT is removing SemanticsText value for MatchCriterionList elements - MatchAlgorithm and MinimumDegreeMatch

• Fixed to make the scoping of the hl7 attributes configurable for the Role and PurposeOfUse SAML assertion elements

– Hl7 attribute scoping for Code, CodeSystemName and DisplayName used in the PurposeOfUse and Role elements in the SAML assertion

19

Sprint 158 - What We are Reporting Today

Release 4.4.1 • Patch Release 4.4.1 is Available as of January 26th

– eHealth Exchange Certification Updates for 4.4.1 (cont.)

• Reviewed all manual certification checklists (1500+ items): eHealth Exchange Manual Checklist Findings

– System Administration Module - Connection Utility• The Sys Admin Module has been configured with a new

utility that will allow an organization to ping potential trading partners to verify connectivity before testing messages

• Additional information can be found at the following link: System Administration Module User Guide

• Design updates can be found here- System Administration Module Ping Utility Design

• Test scripts are updated here- System Administration Module Ping Utility Test Cases

20

Sprint 158 - What We are Reporting Today

Custodial Agent and Community Support• Ongoing Product Backlog work, CCB and CONNECT

Roadmap Updates– Finalized as of March 31st

• Top focus to be on projects that facilitates implementation, exchange partner testing/onboarding and operational

• Beginning preliminary work and planning for post 4.5

– Distributed the updated Roadmap which included additional identified requirements

• The Roadmap can be found on the CONNECT wiki: CONNECT 2015 Roadmap

• Bug Fixes and Other Tasks– See Technical Stories Section

• Product Backlog– JIRA Product Backlog

21

Sprint 159 - Proposed ThemesDevelopment / Community Support

• X12 Auditing Development, Integration and Testing– Final cleanup tasks and Batch and Real-time testing– Schedule demonstration to CMS & Complete Documentation

• Complete Gateway property elements/attributes clean-up– Complete migration of old Universal Client Code to Plugin

• Release 4.5 Preparation Tasks– EHEX/NIST certification tests

– Continue to addressing Fortify scan findings• Technical Stories

– Complete timeout by transaction testing

– Continue to automate Direct negative test cases• Support Tasks

– DoD JBoss FIPS installation (PKCS11)

– WebLogic 12.1.3 VA Adapter upgrade

– eHealth Exchange sub-node patient matching testing22

CONNECT 4Community Announcements

• CONNECT Awareness – Open sprint review and planning updates

• Look for Sprint Summaries https://connectopensource.atlassian.net/wiki/display/NHINProgress/Progress+Summary+Page

• Ask questions and participate in discussions on the CONNECT forums

– CONNECT 4 Blogs and Forum posts• http://www.connectopensource.org/developer-resources/forums

23

Questions or Discussions?

24

FHA Overview

• Established by the Office of Management and Budget as an E-Government Line of Business (LoB) Initiative

• Supports federal activities related to the development and adoption of health IT standards and policies

• Ensures that federal agencies seamlessly and securely exchange health data with other agencies, government entities, and with other public and private organizations

25

• Find out more about FHA on the ONC website:

http://www.healthit.gov/FHA

• Schedule a meeting with me or send me your thoughts at:

federal.health@hhs.gov

• Subscribe, watch, and share:

@ONC_FHA,

@CONNECT_Project

Federal Health Architecture

http://www.flickr.com/photos/federalhealtharchitecture/

Stay Connected, Communicate and Collaborate

26