<p dir="ltr">This is great! I propose we continue the discussion on the list and if need be follow on Monday. </p>
<p dir="ltr">Studying...</p>
<div class="gmail_quote">On May 7, 2015 8:02 PM, "Kinsley, William" <<a href="mailto:BKinsley@nextgen.com">BKinsley@nextgen.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">Debbie, (and group)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">In the attached word document, I hopefully clarified this use case and answered your questions. Again, the point is to create the discussion of these very issues you
bring up.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">Questions:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"> #1: “Trust between patient portal and cloud based PHR?” I am simplify this by removing the dynamic discovery process. See the attached documents.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"> #2: “The cloud PHR has established a base identity proofing/authentication level of trust?” Since the PHR is not a HIPAA covered entity (like most personal
HIT devices and services), the PHR is using common internet credentialing (e-mail or SMS codes). Two points here:<u></u><u></u></span></p>
<p style="margin-left:.75in">
<u></u><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><span>1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">There are no regulation requiring the PHR to use any credentialing standard such as NIST and there are different credentialing processes being used. (Do
not be mistaken, this is not what I am advocating, it “just is”)<u></u><u></u></span></p>
<p style="margin-left:.75in">
<u></u><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><span>2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">Each system is offering different level of authentication controls.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">Again, this is a simple real world use case; but it has a lot of moving parts.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a">Bill<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;font-family:"Cambria",serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-heart [mailto:<a href="mailto:openid-specs-heart-bounces@lists.openid.net" target="_blank">openid-specs-heart-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Debbie Bucci<br>
<b>Sent:</b> Saturday, May 02, 2015 1:46 PM<br>
<b>To:</b> <a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-heart] HEART Stepping stones - Consent Use case<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Picking this back up again but removed the background leading to this and starting a different thread. Bill says keep it simple but it's complex! He has 2 scenarios but I focused on the most difficult -
I have posted the original text to Bill's question on the wiki:<br>
<br>
<a href="http://hg.openid.net/heart/wiki/PCP_First_Appointment" target="_blank">http://hg.openid.net/heart/wiki/PCP_First_Appointment</a>
<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">Questions:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">Client one: If Alice has chosen a cloud based PHR that already has an established trust:
</span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#5f497a">Please clarify what you mean by established trust:</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#5f497a">1.</span></b><b><span style="font-size:7.0pt;color:#5f497a">
</span></b><b><span style="font-size:10.0pt;color:#5f497a">Trust between patient portal and cloud based PHR: the patient portal has establish an FHIR API server , is accepting client applications and the client PHR is has been registered with the Patient Portal?</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;font-family:"Times",serif;color:#5f497a">2.</span></b><b><span style="font-size:7.0pt;color:#5f497a">
</span></b><b><span style="font-size:10.0pt;color:#5f497a">The cloud PHR has established a base identity proofing/authentication level of trust?
</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;font-family:"Times",serif;color:#5f497a">3.</span></b><b><span style="font-size:7.0pt;color:#5f497a">
</span></b><b><span style="font-size:10.0pt;color:#5f497a">Both</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">What are the credentialing requirements to create Alice's account?
</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">1.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Patient Portal</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">2.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Cloud PHR </span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">3.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Both</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">Note that ONC"s Ten year interop roadmap refer's to NIST SP 800-63-2 and OMB M-040-04 and is implying level 2 or 3 levels of assurance
(LOA). (see pp 59)</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#44546a">LOA2 is a single factor –that’s out. The HITPC committee recommended more than username and password for patient portals – that
implies multifactor. Transaction will be more secure but what is the level of identity proofing needed – no real guidance issued for patients that I am aware of. There is the notion that the patient is know to the practice – but at this point - it’s
an initial visit – not the case.</span></b><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">Are there two or three consent profiles?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">One for Alice's PHR defining what to share with the Practice?
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">One for the Practice defining what is to be shared with Alice's PHR?
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">One for Alice at the Practice portal defining what the Portal (or Practice?) is to be shared?
</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">1.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Are there consent preferences stored /shared on the patient’s trusted UMA service?
</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">2.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Is there a Consent Directives Management Service trusted by the UMA service?</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">3.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Is there a CDMS maintained by the provider</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:30.0pt">
<b><span style="font-size:10.0pt;color:#44546a">4.</span></b><b><span style="font-size:7.0pt;color:#44546a">
</span></b><b><span style="font-size:10.0pt;color:#44546a">Does the PHR maintain it own CDMS?</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a">How is the initial implied consent for TPO electronically presented, stored and accessed?
</span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#44546a">Generate a consent receipt reminding the patient they agreed </span></b><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#44546a">I wonder if this is the ruckus I've heard re: check the box for consent ...
</span></b><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546a"> How is this consent profile used by the practice's internal HIT systems? (if at all)</span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#44546a">Which profile?</span></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote></div>