<div dir="ltr">
<p class="MsoNormal"> </p>
<p class="MsoNormal">Roll call/stats:
There were 21 on the call, 11/19 were voting members 4 additional IPRs
this week</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Meeting notes approval by John Bradley</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">HEART Timeline (Deb
Bucci) The charter says 12-18 months for completion - that includes profiles implemented with
working reference and implementations in the wild. </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Tentative schedule:</p>
<p class="MsoNormal">Now until April</p>
<p class="MsoNormal">• Identify use
cases</p>
<p class="MsoNormal">• Technology
level set </p>
<p class="MsoNormal">• Divide Use
cases into obvious groupings – see if can be resolved with existing Profile
work</p>
<p class="MsoNormal">• Discuss
existing pilot/demonstration – reference implementations that may inform profile</p>
<p class="MsoNormal">• F2F @ HIMSS </p>
<p class="MsoNormal">May – Aug</p>
<p class="MsoNormal">• Release
first round of profiles</p>
<p class="MsoNormal">• Start
/encourage pilots</p>
<p class="MsoNormal">• Dig into the
more complex use cases</p>
<p class="MsoNormal">Sept – Dec</p>
<p class="MsoNormal">• Work through
the more complex us case – possibly identify gaps in standards </p>
<p class="MsoNormal">• Release
second round of profiles</p>
<p class="MsoNormal">Jan – ?</p>
<p class="MsoNormal">• Access and
regroup</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Common Terminology - (Eve Maler) Eve introduced various
terms that would be used within the different profiles and highlighted some the
commonalities and difference. </p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>IdP
= identity provider</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>RP
= relying party</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>user
= user trying to achieve single sign-on (SSO)</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>RO
= resource owner (user trying to achieve controlled sharing – could be same as
SSO user)</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>AS
= authorization server (could be the same as IdP)</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>RS
= resource server (could be the same as AS)</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>C
= client</p>
<p class="" style><span style="font-size:10pt;font-family:Symbol">·<span style="font-size:7pt;font-family:'Times New Roman'"> </span></span>RqP
= requesting party (user trying to achieve authorized access – could be same as
RO)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Comment from the discussion</p>
<p class="MsoNormal">• OAuth has no
IDP or PR – Client(API) – focus is to get to the service</p>
<p class="MsoNormal">• UMA
introduces controlled sharing with someone else – introduced Alice to Bob
sharing – requesting party</p>
<p class="MsoNormal">• There are
clear use case where multi-parties doing authn/authz job</p>
<p class="MsoNormal">• Software or
person may have multiple roles example – enable sharing</p>
<p class="MsoNormal">• Could apply
to a Person/patient caregiver or provider.
Think of Person as one class of user/resource. This enables reuse to support other use cases
such as moving information between provider to provider – or referrals without
having to create new profiles.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Use Case Format (Deb and Eve) - Deb provided and except from the ACE Use
case format for discussion as a possible format to gather use case <a href="http://datatracker.ietf.org/doc/draft-ietf-ace-usecases/?include_text=1">http://datatracker.ietf.org/doc/draft-ietf-ace-usecases/?include_text=1</a></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Feedback on doc:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">The format is useful until it gets in the way of the work
and should be viewed with the appropriate lens.
Its as good to get started to develop common terms etc but less useful
to tightly bind with the profile creation process.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Our approach going forward:</p>
<p class="MsoNormal">Deb will work with OIDF to understand how to access the wiki
space and we will define a template for those who wish to use it. Suggested elements</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Capture /classifying </p>
<p class="MsoNormal">• Who are the
actors</p>
<p class="MsoNormal">• What data</p>
<p class="MsoNormal">• What are the
sticking points</p>
<p class="MsoNormal">• Potential
problems</p>
<p class="MsoNormal">• Limitations</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Where possible try to neutrally state the problem. </p>
<p class="MsoNormal">Write use cases from multiple perspectives </p>
<p class="MsoNormal">Identify Use cases for multiple purposes</p>
<p class="MsoNormal">Use cases past mustard with subject matter experts. As we
collect them, we should vet them with authoritative sources.</p>
<p class="MsoNormal">Not necessary to be technology specific – write in plain
English and capture wants and goals</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Suggested Initial Use cases:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Kathleen Connor has been the lead on the Privacy on FHIR use
case/story board. That work has been
vetted with clinicians within the VA.
Perhaps we can put her on the spot for next week</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Further explore the use cases Justin Richer introduced that
are tied to the Secure RESTful Interface
Profile – <a href="http://secure-restful-interface-profile.github.io/pages/">http://secure-restful-interface-profile.github.io/pages/</a> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Explore the Restful Health Exchange (RHEX) use case
developed for the Federal Health Architecture (FHA) a couple of years ago </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Blue Button Restful API (is that the same as SMART?) Use case</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Virtual Clipboard is a potential candidate but that work is
just beginning. Catherine Shulten will
focus on her work with Virtual Patient Registration</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Eve suggested we should explore the National Cybersecurity Center of Exellence (NCCOE) mobile PHR use
case</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Adrian Gropper is working on a High Security Use case</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Deb Bucci will work with (? Did not capture who mentioned)
on a home healthcare use case.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">We will take 15 minutes over the next few weeks for
technology level set</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">• OAUTH – 2/2</p>
<p class="MsoNormal">• OpenID
Connect – 2/9</p>
<p class="MsoNormal">• UMA 2/16</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
</div>