<div dir="ltr">Given that this use case has a lot of "lines and boxes" drawn in words instead of pictures, and I was about to pull out a pad of paper to make real lines and boxes :-), would it be fair game for the use case document itself to contain a real drawing? I'm not sure I will truly understand all of its implications until I either go through that exercise or stare at an already-completed drawing...</div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl<br>Join our <a href="http://forgerock.org/openuma/" target="_blank">ForgeRock.org OpenUMA</a> community!</p></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Jun 15, 2015 at 2:18 PM, Adrian Gropper <span dir="ltr"><<a href="mailto:agropper@healthurl.com" target="_blank">agropper@healthurl.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>This thread is already about 3 different things:<br><br></div>1 - How do we merge the desire to use the OpenID Connect standard as much as possible while also allowing any Resource Owner that is willing to register themselves in-person to benefit from "known to the practice" as a data minimization / privacy engineering feature.<br><br></div>2 - Mention of technical constraints in Use-Cases.<br><div><div><div><div><br>3 - I'm confused by the reference to two different Authorization Servers in 3f-g and 4. As I understand it, the AS is tied to the Resource Owner and has no mandatory relationship to the Resource Server. <br><br></div><div>Can we split this thread accordingly?<br><br></div><div>Adrian<br></div><div><br> <br></div></div></div></div></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Mon, Jun 15, 2015 at 5:11 PM, Justin Richer <span dir="ltr"><<a href="mailto:jricher@mit.edu" target="_blank">jricher@mit.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">That’s a correct characterization, and these are not formal requirements documents. Since these use case documents will not likely be published as formal documents at all, but instead are meant to guide the development of the standards and profiles, then it’s appropriate to talk about both constraints and requirements within them.<div><span><font color="#888888"><div><br></div><div> — Justin</div></font></span><div><div><div><br><div><blockquote type="cite"><div>On Jun 15, 2015, at 4:48 PM, Maxwell, Jeremy (OS/OCPO) <<a href="mailto:Jeremy.Maxwell@hhs.gov" target="_blank">Jeremy.Maxwell@hhs.gov</a>> wrote:</div><br><div>
<div link="blue" vlink="purple" lang="EN-US">
<div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The need to use FHIR is a technical constraint, not a requirement. Technical constraints should be captured in a separate section from requirements. The requirement
is that the data flow is “simple” and “seamless” which need to be measurably defined so we know when “simple” and “seamless” have been achieved.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Justin Richer [<a href="mailto:jricher@mit.edu" target="_blank">mailto:jricher@mit.edu</a>]
<br>
<b>Sent:</b> Monday, June 15, 2015 4:37 PM<br>
<b>To:</b> Maxwell, Jeremy (OS/OCPO)<br>
<b>Cc:</b> Sarah Squire; <a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-heart] HEART Use Case: Alice Enrolls with PCP<u></u><u></u></span></p>
</div>
</div><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I disagree that these use cases need to be technology agnostic. This group is going to be working on FHIR-based APIs, let’s just call it out as that instead of pretending that we’re building to some undefined API.<u></u><u></u></p>
<div><p class="MsoNormal"><u></u> <u></u></p>
</div>
<div><p class="MsoNormal"> — Justin<u></u><u></u></p>
</div>
<div><p class="MsoNormal"><u></u> <u></u></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div><p class="MsoNormal">On Jun 15, 2015, at 4:11 PM, Maxwell, Jeremy (OS/OCPO) <<a href="mailto:Jeremy.Maxwell@hhs.gov" target="_blank">Jeremy.Maxwell@hhs.gov</a>> wrote:<u></u><u></u></p>
</div><p class="MsoNormal"><u></u> <u></u></p>
<div>
<div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Couple of suggestions:</span><u></u><u></u></p><p><span>1.<span style="font:7.0pt "Times New Roman"">
</span></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">In step 3a, it’s not necessarily mandatory to store the driver’s license and insurance card images in the EHR. In particular, for the driver’s license,
if I was an EHR designer, I’d question why it needs to be stored. Data minimization is a great security technique—data cannot be breached if it’s not stored. The license is used to ID proof Alice. Once she’s been ID proofed and that’s been recorded (step
3b), the license is no longer needed. </span><u></u><u></u></p><p><span>2.<span style="font:7.0pt "Times New Roman"">
</span></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Remove reference to FHIR in step 4. Use cases are requirements and they should be technology-agnostic. If the real requirement is that the “bidirectional
information transfer is simple and seamless”, then say this and define what “simple and seamless” mean.</span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Thanks,</span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Openid-specs-heart [<a href="mailto:openid-specs-heart-bounces@lists.openid.net" target="_blank">mailto:openid-specs-heart-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Sarah Squire<br>
<b>Sent:</b> Monday, June 15, 2015 3:55 PM<br>
<b>To:</b> <a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-heart] HEART Use Case: Alice Enrolls with PCP</span><u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p>
<div><p class="MsoNormal">Hello all,<u></u><u></u></p>
<div><p class="MsoNormal"> <u></u><u></u></p>
</div>
<div><p class="MsoNormal">I've attached a write-up of the enrollment use case incorporating feedback from the last three calls. Thanks everyone for your valuable input. I think this is much more solid now. Please chime in if there's anything else we can improve
upon.<u></u><u></u></p>
</div>
<div><p class="MsoNormal"> <u></u><u></u></p>
</div>
<div><p class="MsoNormal">Sarah<u></u><u></u></p>
</div>
<div><p class="MsoNormal"> <u></u><u></u></p>
</div>
<div><p class="MsoNormal">Sarah Squire<u></u><u></u></p>
</div>
<div><p class="MsoNormal">Engage Identity<u></u><u></u></p>
</div>
<div><p class="MsoNormal"><a href="http://engageidentity.com/" target="_blank">http://engageidentity.com</a><u></u><u></u></p>
</div>
</div>
</div><p class="MsoNormal">_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><u></u><u></u></p>
</div>
</blockquote>
</div><p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div></blockquote></div><br></div></div></div></div></div><br>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br><br clear="all"><br></div></div><span class="HOEnZb"><font color="#888888">-- <br><div><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><font size="1"><br><font size="2">Ensure Health Information Privacy. Support Patient Privacy Rights.<br></font></font><span style="font-size:11pt"><font size="1"></font></span><font size="2"><a href="http://patientprivacyrights.org/donate-2/" target="_blank"><font color="blue"><u>http://patientprivacyrights.org/donate-2/</u></font></a><font color="blue"><u> </u></font></font><span style="font-size:11pt"></span><span style="font-size:11pt"></span><span style="font-size:11pt"><font size="1"> <br></font><div></div></span><br></div></div>
</font></span></div>
<br>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br></div>