Applicable Doc. 07 - IAM Master Glossary.pdf

Department of Veterans Affairs

Identity and Access Management (IAM) Services

Master Glossary

March 2019

Version 1.7

March 2019 Identity and Access Management ii

Identity_and_Access_Services_Master_Glossary

Revision History

Date Version Description Entries Author

5/29/12 .01 Initial format for the IAM Master Glossary. Combined the IdS Master Glossary terms, AcS terms and new terms. Included def initions for all terms.

Removed terms that did not have def initions.

Revised the “Updating

Glossary” section.

Linda Lotier, Aimee

Rhodes, Brian Toval

6/22/12 .02 Re-located the References, Glossary Location, and Update Glossary sections to the appendices A, B, and C respectively.

N/A Brian Toval, Linda Lotier, Aimee Rhodes, Irene Levine

7/23/12 1.0 Technical edit and review. Irene Levine

7/31/12 1.0 As part of MVI CR 1337, read and edited document. Made all spacing single-spaced, made all body text Times New Roman 11, removed footer from cover page, removed “Is” where found at the start of each def inition entry, added punctuation to the end of entries, and re-ran TOC.

Donnie Canham

10/29/12 Added link to the VA acronym table.

http://vaww1.va.gov/Acronyms/fulllist.cfm#C

Irene Levine

1/10/13 1.1 Added new terms to the glossary, revised the TOC, added references to Appendix A, and added the new Appendix D.

Brian Toval

1/24/13 1.2 Revised the glossary entries f rom the IAM

Team anomaly logs and comments.

Brian Toval, Irene

Levine, Linda Lotier

7/22/13 1.3 Revised the glossary to ref lect changes and additions submitted by the IAM analysts.

Identity Orchestration, MVH Accounts

Brian Toval

Irene Levine

Linda Lotier

Karen Hoover

1/30/14 1.4 Revised the glossary to ref lect changes and additions and revisions submitted by IAM analysts and stakeholders.

Business Project

Management Of f ice, Object Identif ier, Enterprise Role, Business Role, Application Role, IAM VAAFI ID Data, Stakeholder Enterprise

Portal, File Number, Karen Hoover

Irene Levine

Linda Lotier

Brian Toval http://vaww1.va.gov/Acronyms/fulllist.cfm#C

March 2019 Identity and Access Management iii

Date Version Description Entries Author

Participant Identif ier, Application Processing

LOA-X,

Application Processing

LOA-X & Up, Deep Link, Forced Account

Takeover, Identity Provider, Knowledge-based process data, Portal, Portlets, Proof of Ownership, Service Provider, Unbound trait data, VA Authentication Federation Inf rastructure, Active/active node conf iguration, Active/passive node conf iguration.

3/18/14 1.4 As part of MVI CR 2862, read and edited document. Removed as many extra hard returns as possible and re-ran TOC. Word document updated in ClearCase and PDF updated in TSPR Identity Services Project

Notebook Web page.

N/A Donnie Canham

1/20/15 1.5 Bi annual glossary update. Chief Business Off ice Purchased Care (CBOPC), Civilian Health and Medical Program of the VA (CHAMPVA), Claim ID, Claim Number, Corporate Data Warehouse (CDW), Corporate Datastore/System of Records (CorpDB), Credential Service Provider ID (CSP ID), Customer Relationship Management Enterprise (CRM-e), Digital Certif icate, Digital Signature, Direct Secure messaging (DSM), Disability Benef its

Linda Lotier, Cathy Garlesky, Linda Reimonenq, Damien DeAntonio, Brian Ettinger, Anand Sastry, Elizabeth Mathew, Courtney Rive, Ken Bowers, Brian Toval

March 2019 Identity and Access Management iv

Date Version Description Entries Author

Questionnaire (DBQ), Dual-tone multi-f requency signaling (DTMF), eHealth Exchange (eHEX), Federated Credential, Fiduciary, Foreign Medical Program (FMP), Health Administration Center (HAC), Identity Credential (iv-cred), Identity Proof ing (IP), Interactive Voice Response (IVR), Nationwide Healthcare Information Network (NwHIN), Object Identif ier (OID), Person Relationship Management (PRM), Security Identif ier (SecID), Specialized Access Control (SAC), Tivoli Federated Identity Manager (TFIM), VA Central Of fices (VACO), Veterans Health Identif ication Card

(VHIC)

1/21/15 1.5 As part of MVI CR 5179, read and edited document. Removed as many extra hard returns as possible and re-ran TOC. Changed footer year f rom 2014 to 2015. Word document updated in ClearCase and PDF updated in TSPR Identity Services Project

Notebook Web page.

N/A Donnie Canham

2/16/16 1.6 January 2016 IAM Glossary update. Terms added to glossary (Secure Token Service (STS), Transport Layer Security (TLS), Authorization Management Service (AMS), Grantor, Delegator, Delegate, VA Healthcare Proxy, personal Representative, Delegation Administrator, Veteran Delegation Tool (VDT), Delegation Staf f User

Ken Bowers, Damien DeAntonio, Perry Vessels, Debra Vance, Brian Toval, Linda Reimonenq, Joseph Sink, Jon Puckett, Linda Lotier, Srividya

Chandramohan

March 2019 Identity and Access Management v

Date Version Description Entries Author

Interface, ) Terms deleted f rom glossary (IAM VAAFI ID Data, Authentication Service (AuthN), Authorization

Service (AuthR))

2/19/16 1.6 As part of RTC Task 251254, converted “Identity_and_Access_Services_Master_Glos sary.docx” to a Section 508 compliant PDF.

Changed footer year from 2015 to 2016. Word document was updated in RTC and PDF was added to TSPR Identity Services Project Notebook Web page under the heading entitled "Miscellaneous ---- Non Process

Documents."

N/A Donnie Canham

3/25/19 1.7 Completed a tech edit review. Updated Word doc in MVI RTC source control.

N/A Bruce Taylor

March 2019 Identity and Access Management vi

Table of Contents

INTRODUCTION

SCOPE

USING THE GLOSSARY

APPENDIX A: REFERENCES

APPENDIX B: GLOSSARY LOCATION

APPENDIX C: UPDATING THE GLOSSARY

APPENDIX D: LINKS TO VA RESOURCES

March 2019 Identity and Access Management 1

Introduction

The Identity and Access Management Master Glossary is a reference for the definition of terms, acronyms, abbreviations, mnemonics, and initials used in documentation. The purpose of the glossary is to assist in the understanding of terms, acronyms, abbreviations, mnemonics, and initials particular to the development and functionality of Identity and Access Management and associated enterprise operations and processes.

Scope

The Master Glossary is a living document. The ultimate scope of the document is to contain the definitions of all terms, abbreviations, acronyms, mnemonics and initialism used in the collective applications and processes that encompass Identity and Access Management.

Using the Glossary

Enter the glossary from the Table of Contents by clicking the page of the letter you want. At the top of each new letter heading are letters of the alphabet linking to terms or acronyms beginning with that letter .

To reference a term click the letter that represents the initial letter of the word you are looking for.

March 2019 Identity and Access Management 2

Identity and Access Management Master Glossary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

Term Definition

Acceptance An action by an authorized representative of the acquirer by which the acquirer assumes ownership of products as a partial or complete performance of contract.

Acceptance Criteria Decision rules used to determine when an activity is completed.

Acceptance Test Acceptance Test is an independent objective test performed prior to accepting the delivered system. Acceptance Test verif ies that all requirements have been addressed or that any limitation or outstanding test incident has an approved contingency process (workaround) in place. A system is ready for promotion into the production environment. Acceptance Test is comprised of three distinct test types; User Acceptance Test, Alpha Test, and Beta Test.

Access (1) The ability of a subject to view, change or communicate with an object in a computer system. Typically, access involves a f low of information between the subject and the object (for example, a user reads a f ile, a program creates a directory). [O’Reilly, 1992] (2) The provision of an opportunity to approach, inspect, review, make use of data or information. Refers to such actions by the individual receiving health care as well as providers of health care services and any other individual or entity that has appropriate authorization for such actions.

[CPRI, 1995b]

Access Control (1) The prevention of unauthorized use of a resource. [ISO 7498-2]

(2) Information-use policy to determine who can have access to what data/information (both within and external to the organization adopting the access control policy); policies and procedures preventing access by those who are not authorized to have it.

[Institute of Medicine, 1994].

Access Services (AcS) Services which will apply appropriate levels of security protecting the identities, information, and interests of the VA stakeholders.

Acknowledge (ACK) A packet message used in the Transmission Control Protocol (see

TCP) to acknowledge receipt of a packet.

Acquisition Generic term for hardware, sof tware, or services acquired.

Active/active node configuration Traf f ic intended for the failed node is either passed onto an existing node or load balanced across the remaining nodes.

Active/passive node conf iguration

Provides a fully redundant instance of each node, which is only brought online when its associated primary node fails.

March 2019 Identity and Access Management 3

Term Definition

Active Directory (AD) Active Directory is Microsof t’s trademarked directory service, an integral part of the Windows 2000 architecture. Active Directory is a centralized and standardized system that automates network management of user data, security, and distributed resources, and enables interoperation with other directories. Active Directory is designed especially for distributed networking environments.

Activity An element of work performed during the course of a project.

Normally, an activity has an expected duration, cost, and resource requirements and results in a deliverable or handof f to another activity. In this way, the activity is tied back to the Work Breakdown

Structure. Activities are of ten subdivided into tasks.

Actual Cost (AC) Total costs incurred to date that must relate to whatever cost was budgeted within the planned value and earned value (which can have direct labor hours alone, direct costs alone, or all costs including indirect costs) in accomplishing work within a given time period.

Actual Result The outcome achieved as a result of a testing process. The result may be manual or automated and is usually documented in a results section of the Test Case that triggered the test execution.

Adaptive Architecture A f ramework of design elements and specifications that results in an orderly plan than can evolve to f it new circumstances without destruction of the design or plan.

Add Person An MVI exposed operation, used to add a new person prof ile to the service.

Add Person (Explicit Add with

No Search)

The assumption in using this service functionality is that the consumer has already performed a FindCandidates search in an attended mode and user has determined that the returned results do not have the person, so the user explicitly adds the record.

Add Person (Explicit with no

Search)

The sender is requesting that the Patient Identifier profile supplied be associated under a new ICN that is generated by the MVI Service.

The operation assumes that this operation is being performed based on the end user reviewing a set of returned search results f rom an attended MVI Service search and has determined that no MVI record exists for their Person.

Adjusted Function Points The function point count obtained by applying 14 adjustment factors to a raw function point count.

Administrative Data Repository

(ADR)

The authoritative data store within VHA for cross-cutting person administrative information. The Administrative Data Repository contains identification and cross-cutting demographics data as well as other administrative information. May also include subset of EDB data. May also be referred to as ADR-N or ADR-L to designate a national or local instance.

Where the Standard Data Service physically stores its data. Is a

DBMS schema. Source = MVI Description

March 2019 Identity and Access Management 4

Term Definition

Administrative Data Repository-

Local (ADR-L)

See Administrative Data Repository (ADR)

Administrative Data Repository-

National (ADR-N) See Administrative Data Repository (ADR)

Administrative Entity (AE) Any specif ic part of the organizational structure that will be instantiated in the Replacement Schedule Application (RSA), and utilized by the Veterans Health Administration (VHA).

Administrative Entity Type Classif ication of an administrative entity within the system to facilitate

Administrative Entity def initions and usage.

Admit Discharge and Transfer

(ADT)

A group of messages def ined by the HL7 standards. Events are triggered by HL7 message events.

Agency for Health Care Policy and Research (AHCPR)

The health services research arm of the U.S. Department of Health and Human Services (HHS), complementing the biomedical research mission of its sister agency, the National Institutes of Health. Agency for Healthcare Research and Quality (AHRQ) is a home to research centers that specialize in major areas of health care research such as quality improvement and patient safety, outcomes and ef fectiveness of care, clinical practice and technology assessment, and health care organization and delivery systems. It is also a major source of funding and technical assistance for health services research and research training at leading U.S. universities and other institutions, as well as a science partner, working with the public and private sectors to build the knowledge base for what works—and does not work—in health and health care and to translate this knowledge into everyday practice and policymaking.

Agency for Healthcare

Research and Quality (AHRQ)

The Agency for Healthcare Research and Quality (AHRQ) is the health services research arm of the U.S. Department of Health and Human Services (HHS), complementing the biomedical research mission of its sister agency, the National Institutes of Health. AHRQ is a home to research centers that specialize in major areas of health care research such as quality improvement and patient safety, outcomes and effectiveness of care, clinical practice and technology assessment, and health care organization and delivery systems. It is also a major source of funding and technical assistance for health services research and research training at leading U.S. universities and other institutions, as well as a science partner, working with the public and private sectors to build the knowledge base for what works—and does not work—in health and health care and to translate this knowledge into everyday practice and policymaking.

American Health Information Management Association

(AHIMA)

A health information management (HIM) professional association over 64,000 members strong. Since its founding in 1928, AHIMA has remained committed to quality healthcare through quality information.

Anomaly (1) A deviation f rom expectations, norms, rules, standards, and conventions. (2) A deviation found during a work product review. (3)

An item that is inaccurate, missing, or contradictory.

March 2019 Identity and Access Management 5

Term Definition

Anonymous User On the f ront end, Veterans Online Access (VOA) line of business, the Anonymous Users and L1 Users are considered the same. (no business distinction). “We know you in DEERS, but you can’t do anything”. The user is not proofed.

On the back-end, the technical and procedural perspective, there are dif ferences. The DS Logon/L1 guarantees an EDIPI which will carry throughout the entire process to link with an ICN. A truly Anonymous User only has traits submitted. A L1 User is not an Anonymous User f rom a technical perspective.

Note: The terms f ront-end and back-end are terms def ine by the context in which they are used. The boundaries of a system’s business, procedural, and/or technical requirements ultimately def ine its f ront-end and back-end.

Application Any sof tware that executes logic or rules which allow people to interface with the computer and programs which collect, manipulate, summarize, and report data and information.

Application Platform The collection of hardware and software components that provide the services used by specif ic sof tware applications.

Application Processing LOA-X An application that operates at a “system high” level of assurance (LOA) and does not have the mandatory access controls for handling users at dif fering assurance levels.

Application Processing LOA-X

& Up

An application implements mandatory access controls to enforce data and user separation based on assurance levels.

Application Program Interface

(API)

(1) The interface, or set of functions, between the application sof tware and the application platform. (2) The means by which an application designer enters and retrieves information.

Application Role Privileges assigned internally for an application to a user af ter the user authenticates. An application role is the relationship between a user and an application or system and privileges/functions necessary to fulf ill job-related duties.

Application Server Sof tware/hardware for handling complex interactions between users, business logic, and databases in transaction-based, multi-tier applications. Application servers, also known as app servers, provide increased availability and higher performance.

Application Service Provider

(ASP)

A third-party company or organization providing hosting services for applications on their own infrastructure, generally offered as a fee-for-service capability. A business that provides computer-based services to customers over a network. Software offered using an ASP model is also sometimes called On-demand software or software as a service

(SaaS).

Application Structure and

Integration Services (ASIS)

Designs, integrates, and implements a variety of computer applications in a complex environment.

March 2019 Identity and Access Management 6

Term Definition

Appointment Generic term used to refer to the association of one or more patients and/or named groups to one or more time intervals that are associated with one or more resources in a specif ic schedulable Administrative Entity for the purpose of recording a scheduled or unscheduled healthcare encounter.

Architecture (1) Imposes order and makes interconnections possible. Generally def ined as an intermediate step between initial requirements and business functional specifications during which the entire complex of hardware, sof tware, and design considerations are viewed as a whole. Refers to a blueprint for evolving a technical inf rastructure.

(2) The style or method of design and construction that comprises the elements of an information system and def ines the purpose and interrelationships of those elements.

Artifact A piece of information that is produced, modif ied, or used by a process. Def ines an area of responsibility. Is subject to version control. An artifact can be a model, a model element, or a document.

Assessment A general term for the formal review of a process.

Assigning Authority A body with power to assign identif ication for institutions within VA e.g. USVHA.

Assigning Location A site that requested the historical ICN assigned.

Assistant Secretary for Operations, Security, and

Preparedness (AS/OSP)

Ensure requirements and processes as set forth in VA Directives 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program. Participates is the Identity, Credential and Access

Management (ICAM) Governance Board.

Assurance (1) A measure of confidence that a system’s security features have been implemented and work properly. [O’Reilly] (2) Justif ied conf idence in the security of a system. (3) Development, documentation, testing, procedural, and operational activities carried out to ensure that a system’s security services do in fact provide the claimed level of protection. [CORBA Security Services, 1997]See

Quality Assurance.

Asynchronous Without regular time relationship; unexpected or unpredictable with respect to the execution of a program’s instructions; a physical transfer of data to or f rom a device that occurs without a regular or predictable time relationship. Contrast with synchronous.

Asynchronous Transfer Mode

(ATM)

A high-speed connection-oriented data transmission method that provides bandwidth on demand through packet-switching techniques using f ixed-sized cells. ATM supports both time-sensitive and time-insensitive traffic and is defined in CCITT standards as the transport method for B-ISDN services. Cell-switching technology that operates at high data rates: up to 622 Mbps currently, but potential data rates could reach Gbps. ATM runs on an optical f iber network that uses Synchronous Optical Network (SONET) protocols for moving data between ATM switches.

March 2019 Identity and Access Management 7

Term Definition

Attribute These are Persons Traits or Meta-Data about the Primary View or the Correlation. Identity Hub™ Definition members have attributes, like Name, Gender, Address, Phone, Birth Date, and SSN. Attributes are stored in tables according to Segments. Segments are “attribute types”; the MEMPHONE segment can hold Home Phone, Cell Phone, and Fax Number information.

Attribute Service (AS) The AS retrieves user attributes from a Policy Information Point (PIP) or a variety of authoritative identity stores that can be in the form of directories or databases. It receives requests f rom the Policy Decision Point (PDP) for end-user attributes pertaining to an access control request. The AS then searches for and returns the applicable attributes to the PDP for evaluation. It can be used to perform the Extensible Access Control Markup Language (XACML) Context Handler function “as a service,” sometimes needed for efficiency and performance.

Audit (1) A formal and detailed review of the progress, costs, operations, results, or some other aspect of a project or system performed by an independent party. (2) To record independently and later examine system activity (e.g., logins and logouts, f ile accesses, security violations). See security audit. [O’Reilly, 1992]

Audit Event The data collected about a system event for inclusion in the system audit log.

Audit Trail (1) Data collected and potentially used to facilitate a security audit.

[ISO 7498-2] (2) The chronological set of records that provides evidence of system activity. These records can be used to reconstruct, review, and examine transactions f rom inception to output of final results. The records can also be used to track system usage and detect and identify intruders. [O’Reilly, 1992] (3) Documentary evidence of monitoring each operation of individuals on health information. [National Research Council, 1991] (4) Audit trails may be comprehensive or specific to the individual and information.

For example, an audit trail may be a record of all actions taken by anyone on a particularly sensitive f ile. [OTA, 1993]

Austin Information Technology

Center (AITC)

The Austin Automation Center is located in Austin, Texas and provides national technical and database support for the VHA.

Authentication Verifying the identity of the end-user.

Authentication and Access Control Inf rastructure Project

(AAIP)

A course-grained security service which controls what user can run which application.

Authentication and

Authorization (A&A)

The process of verifying the identity of an end user or process.

Authentication may be accomplished using various methods such as user ID and password, digital signature, or biometrics devices and the process of determining whether the end user’s use of resources is permitted and of granting appropriate systems, network, or resource access. Authorization prevents unauthorized access and deters attempts to gain access.

March 2019 Identity and Access Management 8

Term Definition

Authentication, Authorization &

Access (AAA)

The process of verifying the identity of an end user or process.

Authentication may be accomplished using various methods such as user ID and password, digital signature, or biometrics devices and the process of determining whether the end user’s use of resources is permitted and of granting appropriate systems, network, or resource access. Authorization prevents unauthorized access and deters attempts to gain access. Information-use policy to determine who can have access to what data/information (both within and external to the organization adopting the access control policy); policies and procedures preventing access by those who are not authorized to have it. [Institute of Medicine, 1994].

Authority to Operate (ATO) The approval process for operating an information system. The process assesses, tests, and formally accepts the risk associated with employing the compensating control in the information system.

This process applies to new and/or systems undergoing major revisions.

Authorization Granting or denying user access or permission to perform a function.

Authorization Management

Service (AMS)

The IAM Authorization Management Service (AMS) is an enterprise service to manage authorizations of all types that grant access to VA-controlled data related to a specif ic Veteran, Benef iciary or VA Patient. The initial business driver for AMS has been person-to-person delegation that gives the user (delegate) access to another person’s VA controlled data. Delegates can be caregivers, family members, legal guardians etc.

Auto Link Threshold The Auto Link Threshold is the level that a Comparison Score must meet or exceed in order for two or more Identity Prof iles to be considered the same unique Person Identity.

Automated Data Transfer (ADT) It is used to transfer electronic documents or business data from one computer system to another computer system, i.e. f rom one trading partner to another trading partner without human intervention.

Automated Eligibility Tool (AET) VISTA Fee AET - consuming App of MVI

Automated Management

Information System (AMIS)

A general system of computer programs used to process management reports.

Automated Medical Information

Exchange (AMIE)

Provides electronic distribution of admonitions, discharge and C & P examination information between regional of f ices and medical centers.

Automated Monument

Application System (AMAS)

AMAS was developed by National Cemetery Administration (NCA) at the Quantico Regional Processing Center (QRPC) to automate all business processes associated with monument ordering, delivering, and tracking. The intent was to automate all manual, paper-intensive record-keeping, and information and forms processing associated with monument applications. AMAS receives, processes, and tracks over 330,000 applications for government-furnished monuments, i.e., headstones, markers, and niche covers each year.

March 2019 Identity and Access Management 9

Term Definition

Auto-Resolved Exception cases automatically closed by the System without action by the HealthCare Identity Management (HC IdM) staf f .

March 2019 Identity and Access Management 10

B

Bad Address Indicator (BAI) The Bad Address Indicator f ield applies to the address at which the patient resides. This f ield should be set as follows (if applicable):

"UNDELIVERABLE" - Bad Address based on returned mail.

"HOMELESS" - Patient is known to be homeless. "OTHER" - Other Bad Address Reason Setting this field will prevent a Bad Address from being shared with HEC and other VAMC facilities. It will also be used to block Means Test Renewal Letters f rom being sent. Once the Bad Address Indicator is set, incoming “newer" addresses will automatically remove the Bad Address Indicator, and allow the "updated" address to be transmitted to HEC and other VAMC Facilities.

Baseline The original approved plan (for a project, work package, or activity), plus or minus approved scope changes. Usually used with a modif ier (e.g., cost baseline, schedule baseline, performance measurement baseline).

Also called Baseline Plan.

Bay Pines Test Lab The Bay Pines Test Lab houses hardware and sof tware for use by Project Teams. The test lab provides multiple platforms and test conf igurations in a controlled and managed environment. Project team personnel execute the tests. The test lab does not execute tests. For more information, visit http://vista.med.va.gov/ivv/.

BEA WebLogic Enterprise

Security (WLES)

An inf rastructure developed by BEA Systems (now a subsidiary of Oracle) to provide security for multiple applications across an enterprise.

Now known as Oracle WebLogic Server.

Benef iciary Identif ication Records Locator System

(BIRLS)

The BIRLS Death File is an extract of the Benef iciary Identif ication Records Locator Subsystem (BIRLS), a Veterans Benef its Administration (VBA) database containing records of all VA benef iciaries, including Veterans discharged from military service since March 1973, Medal of Honor recipients, Veterans who received education benefits from the VA, and Veterans whose survivors applied for burial benef its.

Source = VA website

Benef its Delivery Network

(BDN)

Contributes to meeting the following VA strategic goals; Restore the capability of disabled Veterans to the greatest extent possible and improve the quality of their lives and their families; Ensure a smooth transition for Veterans from active military services to civilian life; and Honor and serve Veterans in life and memorialize them in death for their sacrif ices on behalf of the Nation. Source = Internet Privacy Impact Assessment - 2009 (Form) / Benef its Delivery Network (BDN)

Maintenance and Operations-2009 (Item)

March 2019 Identity and Access Management 11

Term Definition

Best Practices Frequently repeated actions or customs that have been shown in actual application to be of value. Proven practices.

Bi-directional Healthcare

Information Exchange (BHIE)

A series of communications protocols developed by the Department of Veterans Affairs. It is used to exchange healthcare information between Department of Veterans Af fairs healthcare facilities nationwide and between VA healthcare facilities and Department of Defense healthcare facilities. Source = Wikipedia

Birthright Accounts and

Entitlements

A preapproved, specif ic set of entitlements given to a user at the occurrence of lifecycle events: new hire, transfer, etc.

Build An operational version of a system or part of a system that demonstrates a subset of the capabilities to be provided in the f inal product. Log folders and logs are organized by build in Test Manager.

Burial Operations Support

System (BOSS)

BOSS automates all manual, paper-intensive record keeping information and forms processing associated with over 100,000 annual interments f rom National, State Veterans, Post/Military, Department of Army, and

Department of Interior cemeteries.

Business Case Structured proposal for business improvement that functions as a decision package for organizational decision-makers. It may contain the goals of the project and how those goals support the goals of the enterprise. Other sections may include a cost/benef it analysis, a requirement analysis, and a make or buy analysis. A business case usually includes a comprehensive f iscal analysis and estimate.

Business Intelligence (BI) Mainly refers to computer-based techniques used in identifying, extracting, and analyzing business data, such as sales revenue by products and/or departments, or by associated costs and incomes.

Business Object Model Describes the entities and how they interact to deliver the functionality necessary to realize the business use cases. An object model describing the business use cases.

Business Program

Management Office (BPMO)

The department or group that def ines and maintains the standards of process, generally related to project management, within the organization.

Business Requirements (1) Requirements state the customer needs the project output will satisfy. Requirements typically start with the phrase “The system shall …” Business requirements refers to how the project will satisfy the business mission of the customer. (2) Business requirements refer to business functions of the project, such as project management, financial management, or change management.

Business Requirements

Document (BRD)

This document captures and describes the business needs, providing insight into the AS IS and TO BE business areas, identifying stakeholders and prof iling primary and secondary user communities, identifying what capabilities the stakeholders and the target users need and why these needs exist, providing a focused overview of the request requirements, constraints and IT options considered.

March 2019 Identity and Access Management 12

Term Definition

Business Role The relationship of multiple applications and the application specif ic privileges assigned to specific business staff. The access to the specific systems is necessary to perform job-related duties. For example, a Provisioning business role must contain at least two applications and the application’s user associated privileges.

Business Rule (1) A policy imposed by the business, or an external entity, on the system used in the process of conducting that business. (2) A special category of a requirement. A business rule is directive, policy, or procedure within an organization that describes the relationship between two or more entities. Business rules may also come f rom outside sources such as government regulations and membership association guidelines.

Business Rule Artifact An artifact that contains a declaration of policies and business constraints that restrict the functionality of the system being developed.

It accurately represents the principles that govern the way business is done.

Business Rule Event Type This is a predef ined HC IdM event that happens in MVI processing.

These events are triggered by Business Rule conditions and are not System level errors. Example: The service has determined that a Person

Last Name begins with ZZ. A business rule states to log this condition.

Business Use Case Model A model of a business that describes the requirements of a business.

March 2019 Identity and Access Management 13

C

Cache Cache memory is a small area of very fast Random Access Memory (RAM) used to speed exchange of data. Also, a f ile or directory included on your computer’s hard drive which automatically stores the text and graphics from a web page you pull up, which, in turn, allows you to go back to that web page, without having to wait for the information to reload.

Caché An ‘M’ based product by InterSystems which has been selected as the next generation VISTA platform. Cache is an Object Database

Management System (ODBMS).

Capability Maturity Model

(CMM)

A development model that was created after study of data collected f rom organizations that contracted with the U.S. Department of Defense, who funded the research. This model became the foundation from which CMU created the Sof tware Engineering Institute (SEI). The term "maturity" relates to the degree of formality and optimization of processes, f rom ad hoc practices, to formally defined steps, to managed result metrics, to active optimization of the processes.

Capability Maturity Model

Integrated (CMMI)

A process improvement approach whose goal is to help organizations improve their performance. CMMI can be used to guide process improvement across a project, a division, or an entire organization.

Catastrophic Edit Changes that occur to two unique traits during an edit of a patient’s record.

Certif icate Authority (CA) A party trusted to vouch for the binding between names or identities and public keys. Also known as a “Certif icate Authority (CA)”. In some systems, certification authorities generate public keys. [CORBA Security Services, 1997]

A trusted issuer of certif ication. [National Research Council, 1991]

Certif ication and

Accreditation Process (C&A)

Guidance for information system certif ication and accreditation (C&A) process and approval to operate procedures for all systems used to process sensitive and classif ied national security information.

Change Control (1) The processes, procedures and responsibilities for identifying, evaluating and managing change. Integration is achieved by assessing a potential change’s impact to all relevant aspects of a project, primarily scope, cost, schedule, risk and quality. Change control involves implementing a process change requests and the systematic tracking of change assessment and implementation. (2) The ability to coordinate, track, and manage change to the baseline of a project’s conf igurable items. Change Control for a project within the VA OI should satisfy all Change Management criteria established by and for each project. These criteria should include the capability to satisfy all project plan objectives while maintaining the stability and integrity of the product baseline within

March 2019 Identity and Access Management 14

Term Definition the project.

Change Control Board (CCB) A committee that makes decisions regarding whether or not proposed changes to a sof tware project should be implemented. The change control board is constituted of project stakeholders or their representatives.

Change Management (CM) (1) The process of implementing change control. (2) The active involvement of project management in monitoring and controlling the change control process.

Change Order (CO) A component of the change management process whereby changes in the Scope of Work agreed to by the Owner, Contractor and Architect are implemented.

Change Request (CR) A formal/written request to modify/revise a system. A request to change the scope of a project.

Change Source Station Number and IEN pair for a logged on Person (DUZ) that performed a change.

Chief Business Office (CBO) Provides national leadership for advancing business practices that support patient care and delivery of health benef its.

Chief Business Off ice

Purchased Care (CBOPC)

Manages the purchase of Non - VA healthcare services.

Civilian Health and Medical Program of the VA

(CHAMPVA)

A comprehensive healthcare program in which the VA shares the cost of covered healthcare services and supplies with eligible benef iciaries.

Claim ID A unique, system-assigned numeric identification of a claim. The claim ID is an auto-generated number across all claims, not just claims associated with a given f ile number. A claim ID is associated with a claim – not a document. MVI refers to this identif ier as the Claim Number.

Claim Number See Claim ID.

Classpath {XE "Classpath"} The path searched by the Java Virtual Machine (JVM) for class def initions. The class path may be set by a command-line argument to the JVM or via an environment variable.

ClearCase ClearCase is def ined as an artifact management solution that: 1.)

Provides version control, build management, workspace management, and process configurability. 2.) Supports distributed development with automated replication of project -databases and transparent access to all sof tware elements. 3.) Scales easily to support projects regardless of size of team, location of members, or platform usage.

ClearQuest A Rational tool used to track and report anomalies, test incidents, defects, issues, change requests, risks, and internal quality audit results.

ClearQuest integrates with RequisitePro, ClearCase, Quality Manager, and Robot to provide traceability throughout the Sof tware Development Life Cycle (SDLC). Rational ClearQuest is a workflow automation tool (in particular bug tracking system) f rom the Rational Sof tware division of IBM. The tool can be linked to Microsoft Project to create ordered steps for resources assigned to specif ic goals. The product was originally

March 2019 Identity and Access Management 15

Term Definition designed for tracking defects (bugs) in sof tware development projects.

Client Can refer to both the client workstation and the client portion of the program running on the workstation.

Clinic A facility for diagnosis and treatment of outpatients .

Clinic in Hand (CIH) A handheld device used to access clinical information.

Clinical Context Object

Workgroup (CCOW)

An HL7 standard protocol designed to enable disparate applications to synchronize in real-time, and at the user-interface level. It is vendor independent and allows applications to present information at the desktop and/or portal level in a unif ied way. Clinical Content Object Workgroup (CCOW), more commonly known as Clinical Context Management, enables the clinical end-user to experience the simplicity of interacting with one system, when in reality he or she may be using multiple independent applications through varying interfaces.

Clinical Data Repository/Health Data

Repository (CDHR)

The Clinical Data Repository/Health Data Repository (CHDR) is a joint initiative between the Department of Veterans Af fairs (VA) and Department of Defense (DoD). CHDR consists of an interface between DoD’s Clinical Data Repository (CDR) of AHLTA, DoD’s electronic health record, and VA’s Health Data Repository (HDR). CHDR enables the bidirectional exchange of computable outpatient pharmacy and medication allergy data. CHDR also enhances decision support by permitting data from VA/DoD repositories to be cross-referenced for drug-drug and drug-allergy interactions.

Clinical Data Services (CDS) This is the exchange service for the Health Data Repository (HDR).

Clinical Information

Resources Network (CIRN)

Allows VHA physicians to view the primary care data for a patient anywhere within their own VISNs and to share those data with other

VISNs.

Code Change Request

(CCR)

A formal request to revise the sof tware code.

Comite Consultatif Internationale de Telegraphie et Telephonie (CCITT)

This is an international committee based in Geneva, Switzerland. The International Telegraph and Telephone Consultative Committee (translated) is a standards organization that has developed a series of communications protocols for the facsimile transmission of black-and-white images over telephone lines and data networks. [O’Reilly, 1996]

Commercial Of f The Shelf

(COTS)

Commercial Off The Shelf applications sold by vendors through public catalogue listings. COTS software is not intended to be customized or enhanced.

Common Access Card

(CAC)

A United States Department of Defense (DoD) smart card issued as standard identif ication for active-duty military personnel, reserve personnel, civilian employees, other non-DoD government employees, state employees of the National Guard, and eligible contractor personnel.

Common Object Request

Broker (CORBA)

CORBA defines architecture for distributed objects. The basic CORBA paradigm is that of a request for services of a distributed object.

Everything else defined by the OMG is in terms of this basic paradigm.

March 2019 Identity and Access Management 16

Term Definition

Common Security

Framework (CSF)

The Health Information Trust Alliance, or HITRUST, in collaboration with healthcare, technology and information security leaders, has established the Common Security Framework (CSF), a certifiable framework that can be used by any and all organizations that create, access, store or exchange personal health and f inancial information. The most widely adopted security control framework in the U.S. healthcare industry, the CSF includes a prescriptive set of controls and supporting requirements that clearly def ine how organizations meet the objectives of the f ramework. Provide an IAM common security f ramework module for application integration.

Communications

Management

The systematic planning, implementing, monitoring, and revision of all the channels of communication within an organization, and between organizations; it also includes the organization and dissemination of new communication directives connected with an organization, network, or communications technology. Aspects of communications management include developing corporate communication strategies, designing internal and external communications directives, and managing the f low of information, including online communication.

Communications

Management Plan

Describes how the various types of project information are distributed, reviewed, updated and f iled.

Community Based

Outpatient Clinic (CBOC)

A Community Based Outpatient Clinic (CBOC) is a VA-operated clinic or a VA-funded or reimbursed health care facility or site that is geographically distinct or separate f rom the parent medical facility.

Comparison Score These are the points assigned to an identity to indicate the level of conf idence of matching to a given set of traits.

Compensated Work Therapy

(CWT)

The CWT program mission is to provide realistic and meaningful vocational opportunities to Veterans; encouraging successful reintegration into the community at the Veterans' highest functional level.

To achieve this mission CWT staf f endeavors to match an individual Veteran's vocational strength and area of interest to work and employment opportunities with local businesses and industry.

Compensation and Pension

Record Interchange (CAPRI)

CAPRI provides VBA employees with a standardized, user-f riendly method to rapidly access Veterans' electronic medical records throughout the Veterans Administration (VA). CAPRI delivers leading edge "point and click" technology to the users' desktops.

Compensation and Pension

Service (C&P)

Administers the disability compensation program. C&P Service also administers the dependency and indemnity compensation, death compensation, disability pension, death pension, burial benef its, automobile allowance/adaptive equipment, clothing allowance, and specially adapted housing programs.

Compliance An af f irmative indication or judgment that the supplier of a product or service has met the requirements of the relevant specifications, contract, or regulation. The state of meeting the requirements.

March 2019 Identity and Access Management 17

Term Definition

Compliance Audit and

Reporting (CAR)

A comprehensive review of an organization's adherence to regulatory guidelines. Independent accounting, security or Information Technology (IT) consultants evaluate the strength and thoroughness of compliance preparations. Auditors review security polices, user access controls and risk management procedures over the course of a compliance audit.

Provide a consolidated Identity and Access Management (IAM) audit and reporting capability.

Compliance Testing A type of testing that verifies that a collection of sof tware and hardware fulf ills given specif ications. For example, these tests will minimally include, not excluding any others that may come up like, “core specifications for re-hosting – ver.1.5-draf t 3.doc”, Section 508 of the Rehabilitation Act Amendments of 1998, Race and Ethnicity Test, and VA

Directive 6102 Compliance.

Components Individual parts of an organized whole. A set of discrete parts that must be combined to produce a working and useful result. A component-based architecture will allow for signif icant f lexibility in application implementation and adaptation. Components will comprise the building -blocks f rom which sof tware systems are built.

Composite Views VHA Def inition

In VHA the Primary View is a ‘golden copy’ of identity attributes for an entity based on Business Rules applied in MVI.

The Primary View may be the same as a Correlation or a Composite View of all the correlations for a given entity.

Identity Hub™ Def inition

Composite Views have many f iltering options:

• EMCA – Entity Most Current Attribute o Displays one composite record of the most recent updates o Can drill down to Member record details (if not Restricted)

• MMCA – Member Most Current Attribute o Displays one record per member with current attributes

• Trusted Source o One source is trusted to have more accurate information than other sources o Only data f rom the one trusted source is displayed

• Controlled o Controls attribute selection by source (e.g., SSN comes from Source A, March 2019 Identity and Access Management 18

Phone f rom Source B, and Address f rom Source C)

• Restricted o User is shown an Entity level view but does not have access to drill down to Member level data.

Computer Assisted Sof tware

Engineering (CASE)

Set of methods and software tools used to develop sof tware products.

Computer-based Patient

Record System (CPRS)

The people, data, rules and procedures, processing and storage devices, and communication and support facilities that provide the capture, storage, processing, communication, security, and presentation of computer-based patient record information. [CPRI, 1995a]

Concept of Operations

(CONOPS)

A document describing the characteristics of a proposed system from the viewpoint of an individual who will use that system. It is used to communicate the quantitative and qualitative system characteristics to all stakeholders. CONOPS are widely used in the military, governmental services and other f ields.

Conf iguration The functional and/or physical characteristics of hardware/software as set forth in technical documentation and achieved in a product.

Conf iguration Control (CC) The systematic evaluation, co-ordination, approval or disapproval, and dissemination of proposed changes and implementation of all approved changes in the configuration of any item after formal establishment of its conf iguration baseline.

Conf iguration Control Board

(CCB)

A board composed of technical and administrative representatives who approve or disapprove proposed engineering changes to an approved baseline.

Conf iguration Management

(CM)

A discipline applying technical and administrative direction and surveillance to identify and document the functional and physical characteristics of a conf iguration item, control changes to those characteristics, record and report change processing and implementation status, and verify compliance with specif ied requirements. (IEEE Std.

610.12-1990) The f ive major activities of configuration management are:

1.) Conf iguration Identification 2.) Configuration Control 3.) Configuration

Status Accounting 4.) Conf iguration Audit 5.) Delivery

Conf iguration Management

Plan (CMP)

The CMP def ines the implementation (including policies and methods) of conf iguration Management on a…