<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
There is a misconception that 800-63 requires proofing and credential to be inline. Yes, if you do a risk assessment and determine LOA3 is required, then proofing is stringent. But nothing keeps you from saying you are LOA1, proof at LOA1 (none) but issue
a credential that exceeds LOA1 requirements. -63 can go further (and we are looking into that - but it is up to OPM) but you can always exceed the requirements of a given LOA.<br>
<div>
<div>On Aug 12, 2015, at 11:14 AM, Moehrke, John (GE Healthcare) <<a href="mailto:John.Moehrke@med.ge.com">John.Moehrke@med.ge.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div bgcolor="white" lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div class="WordSection1" style="page: WordSection1;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Aaron,<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">the change to NIST 800-63 that made medical identity is only 2 years old, and was led by Bill Brathwate… As part of the NSTIC healthcare workgroup… I don’t disagree with
the conclusion. There are many efforts to get LOA3 without in-person-proofing; they will require a change to NIST 800-63 to be recognized. But this is ALL pre-conditions to the UMA and OAuth workflows.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">As to the Emergency use-case where the patient is unconscious… This is a Red Herring… The medical community will focus on stabilizing the patient. They will waste no time
trying to find historic information, they will use it if it is available. Please lets not waste time on this one either. <o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">We have so much good to solve with less extreme use-cases. Chronic care is so important to these multi-facility, and no-facility, use-cases. Lets focus there!<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">jOHN<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div>
<div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext;"><span class="Apple-converted-space"> </span>Openid-specs-heart [<a href="mailto:openid-specs-heart-bounces@lists.openid.net" style="color: purple; text-decoration: underline;">mailto:openid-specs-heart-bounces@lists.openid.net</a>]<span class="Apple-converted-space"> </span><b>On
Behalf Of<span class="Apple-converted-space"> </span></b>Aaron Seib<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, August 12, 2015 10:07 AM<br>
<b>To:</b><span class="Apple-converted-space"> </span>'Glen Marshall [SRS]'<br>
<b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-heart] Id Proofing Rants... (new Subject)<o:p></o:p></span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I agree – this isn’t something that the HEART project should try to own but it is something that needs to be addressed in a better way than declaring that “the healthcare
use case is so sensitive for every transaction that the legacy regulations requiring F2F authentication regardless of how minimal the risk to patient safety is required before treatment can occur or PHI can be shared with the consumer being treated.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">If we just document that a precondition to accessing the AS is that the provider has done whatever is required to authenticate that Alice is who she says she is I am fine
with that. <o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Aaron Seib, CEO<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">@CaptBlueButton<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> (o) 301-540-2311<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">(m) 301-326-6843<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<a href="x-msg://21/nate-trust.org" style="color: purple; text-decoration: underline;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"><image001.jpg></span></a><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p></o:p></span></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div>
<div>
<div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext;"><span class="Apple-converted-space"> </span>Glen Marshall [SRS] [<a href="mailto:gfm@securityrs.com" style="color: purple; text-decoration: underline;">mailto:gfm@securityrs.com</a>]<span class="Apple-converted-space"> </span><br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, August 12, 2015 10:35 AM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Aaron Seib<br>
<b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-heart] Id Proofing Rants... (new Subject)<o:p></o:p></span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p> </o:p></div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Aaron,<br>
<br>
Your vision is not far-fetched at all. But I agree with John Moehrke regarding it probably being out-of-scope for HEART.<br>
<br>
I am aware of a high-security use case in which the patient is anonymous to the physician, and vice-versa. The underlying EHR is also anonymized for the actors. Identity proofing is out-of-band in the current implementation. But that is an extreme fringe
example. We need to exclude such cases from HEART, at least for now.<br>
<br>
More mainstream is the case of an unconscious John Doe arriving for urgent care. Known-name registration, identity proofing, and binding of PHR and EHR occur well after treatment. Default health data disclosure policies need to be applied to John Doe upon
an initial anonymous registration, subject to later revision by the patient or an authorized representative when the patient's identity is established. Ignoring identity proofing for now, a HEART use case needs to accommodate this scenario. It may be a break-glass
example. <span class="Apple-converted-space"> </span><br>
<br>
Glen<o:p></o:p></p>
<div>
<p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b>Glen F. Marshall</b><br>
Consultant<br>
Security Risk Solutions, Inc.<br>
698 Fishermans Bend<br>
Mount Pleasant, SC 29464<br>
Tel: (610) 644-2452<br>
Mobile: (610) 613-3084<br>
<a href="mailto:gfm@securityrs.com" style="color: purple; text-decoration: underline;">gfm@securityrs.com</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.SecurityRiskSolutions.com&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=KICNNMX8xT7qQVO33vGcVNVlMXmcUu2XGYh0mfsGBP4&e=" style="color: purple; text-decoration: underline;">www.SecurityRiskSolutions.com</a><o:p></o:p></p>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
On 8/12/15 09:40, Aaron Seib wrote:<o:p></o:p></div>
</div>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Thank you Adrian. Your perspective is informing.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">You ask below this question that I pull up</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;">
‘What is the law or regulation or moral imperative that causes this nebulous "other provider" to doubt Alice's unverified assertion?<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I am probably the last person to argue that if the next “provider” is a F2F encounter that there a need for the provider to verify the consumers identity.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">For those people that think care is always going to happen face to face - I am sorry to inform you that the 19<sup>th</sup><span class="Apple-converted-space"> </span>Century
called and they want their care delivery model back. </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">As we see the displacement of brick and mortar care delivery we see the need for remotely ID proofing patients increasing. I doubt think we will ever get to the point
where all care is delivered remotely – in fact I doubt it very much. What I do see if the barrier to benefiting from the reuse and upcycle of the F2F encounter as a means to increase the level of assurance on the part of the relying party that they are working
with data related to the person that he or she claims to be.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I don’t think this is treating the patient as a criminal. It is for their protection and a fraud prevention necessity. I am not saying everyone has to subscribe to this
notion for it to work. You have your right to be unknown as much as I do. I will argue with you about your rights effecting mine. It isn’t a one size fits all universe and many of us would be concerned if a remote provider trusted just anyone claiming to
be me and delivering care (not only from the cost but also because of the data integrity issues that could be introduced).</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Aaron Seib, CEO</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">@CaptBlueButton</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> (o) 301-540-2311</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">(m) 301-326-6843</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<a href="x-msg://21/nate-trust.org" style="color: purple; text-decoration: underline;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"><image002.jpg></span></a><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span><a href="mailto:agropper@gmail.com" style="color: purple; text-decoration: underline;">agropper@gmail.com</a><span class="Apple-converted-space"> </span>[<a href="mailto:agropper@gmail.com" style="color: purple; text-decoration: underline;">mailto:agropper@gmail.com</a>]<span class="Apple-converted-space"> </span><b>On
Behalf Of<span class="Apple-converted-space"> </span></b>Adrian Gropper<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, August 11, 2015 9:31 PM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Aaron Seib<br>
<b>Cc:</b><span class="Apple-converted-space"> </span>Kinsley, William;<span class="Apple-converted-space"> </span><a href="mailto:openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-heart] Draft HEART Meeting Notes 2015-08-10</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
inline...<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
On Tue, Aug 11, 2015 at 2:30 PM, Aaron Seib <<a href="mailto:aaron.seib@nate-trust.org" target="_blank" style="color: purple; text-decoration: underline;">aaron.seib@nate-trust.org</a>> wrote:<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">IDESG has been working on this since the start of the Obama administration, right? Do we know if they have anything useful in this regard so far? </span><o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
IDESG is doing the best job of anyone I know here or in the EU in this respect. Useful is a loaded term. Until the cost of cybersecurity breaches becomes noticeable in the competitive marketplace or very strong data protection laws (like EU is trying to mandate)
are passed, the industry will continue to ignore this. We have a very hard time getting data holders (big hospital networks, insurers, and their vendors) to participate in IDESG. Why would we expect "anything useful" as long as they see human-centered identity
federation as not worthy of their attention.<o:p></o:p></div>
</div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">The use case that I am hearing – whether it belongs in HEART or has already been solved for by the funded work of the NSTIC pilots (I think they have graduated some vendors
from the program who address these issues already, right?) is the following:</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Symbol; color: rgb(31, 73, 125);">·</span><span style="font-size: 7pt; color: rgb(31, 73, 125);"> <span class="Apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Alice
is unknown to the PCP practice. She becomes known by providing the PCP with her AS URL and related identifier information. The PCP uses that AS to make disclosure decisions because he trust the binding of her identity to the AS.</span><o:p></o:p></p>
</blockquote>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Alice has an in-person relationship with the PCP practice. Except for the case of controlled substance prescriptions, there is absolutely no need for identity proofing. If controlled substances are to be prescribed, identity proofing needs to be an escalation
over the default practice. Why would we want our healthcare system to treat everyone as a criminal by default? <o:p></o:p></div>
</div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;">
<p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Symbol; color: rgb(31, 73, 125);">·</span><span style="font-size: 7pt; color: rgb(31, 73, 125);"> <span class="Apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Another
provider wants to communicate with Alice. She remotely sends him her AS URL and related identifier information. Is there more information in the universe that the new provider can use to increase his level of assurance that Alice is who she says she is without
a F2F meeting? </span><o:p></o:p></p>
</blockquote>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
What is the law or regulation or moral imperative that causes this nebulous "other provider" to doubt Alice's unverified assertion? Or is it just a barrier to patient and caregiver access like so much of HIPAA has been interpreted to be. We are all aware of
the Office of Civil Rights memos and the ONC data blocking reports. That is the reality.<o:p></o:p></div>
</div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;">
<p style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Symbol; color: rgb(31, 73, 125);">·</span><span style="font-size: 7pt; color: rgb(31, 73, 125);"> <span class="Apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I.e.,
is there any way to discover that the PCP trust the assertion that Alice is who she says she is and uses this AS and related identifier improving confidence in reliance on this information shared remotely by Alice?</span><o:p></o:p></p>
</blockquote>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Yes and this is what IDESG is trying to solve. As long as the large data holders compete on the basis of my silo is larger than their silo, progress will continue to be slow. From the perspective of the individual patient and physician, it could get worse than
it is today. <o:p></o:p></div>
</div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">If the NSTIC projects already considered this and determined that it was a dead end that would be informative. </span><o:p></o:p></div>
</blockquote>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
I assume that you mean the NSTIC pilots. For the most part, the NSTIC pilots are based on startups and companies outside of healthcare trying to get their spoon into the $3 T firehose. Under these circumstances, NSTIC is doing better than could be expected.
The EU seems to be headed toward a more heavy-handed governance mechanism that goes after the largest institutions first. Both approaches have their merits.<o:p></o:p></p>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Adrian<o:p></o:p></div>
</div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Aaron Seib, CEO</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">@CaptBlueButton</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> (o)<span class="Apple-converted-space"> </span><a href="tel:301-540-2311" target="_blank" style="color: purple; text-decoration: underline;">301-540-2311</a></span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">(m)<span class="Apple-converted-space"> </span><a href="tel:301-326-6843" target="_blank" style="color: purple; text-decoration: underline;">301-326-6843</a></span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__nate-2Dtrust.org&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=GsszYPqXY8kjgF2FhBwvkMG_Z7S_4cegPxAs1Z8UJCY&e=" target="_blank" style="color: purple; text-decoration: underline;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"><image002.jpg></span></a><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span><a href="mailto:agropper@gmail.com" target="_blank" style="color: purple; text-decoration: underline;">agropper@gmail.com</a><span class="Apple-converted-space"> </span>[mailto:<a href="mailto:agropper@gmail.com" target="_blank" style="color: purple; text-decoration: underline;">agropper@gmail.com</a>]<span class="Apple-converted-space"> </span><b>On
Behalf Of<span class="Apple-converted-space"> </span></b>Adrian Gropper<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, August 11, 2015 1:39 PM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Aaron Seib<br>
<b>Cc:</b><span class="Apple-converted-space"> </span>Kinsley, William;<span class="Apple-converted-space"> </span><a href="mailto:openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>[Openid-specs-heart] Draft HEART Meeting Notes 2015-08-10</span><o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Aaron,<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Digital identity is being worked on in IDESG. The verification of attributes is one aspect of identity proofing. Privacy is the major issue with identity proofing. In setting up IDESG, NIST tried to be careful to make privacy a "supercommittee" in the governance
process.<o:p></o:p></p>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
If we wanted to get into this in HEART, we would probably need to start with a use case.<o:p></o:p></div>
</div>
<div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Adrian<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br>
On Tuesday, August 11, 2015, Aaron Seib <<a href="mailto:aaron.seib@nate-trust.org" target="_blank" style="color: purple; text-decoration: underline;">aaron.seib@nate-trust.org</a>> wrote:<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I am confused or might have a friendly amendment for what you are trying to communicate.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Are you positing to the group that item (3) is out of scope because it is an Identity Federation feature and by definition not part of the charter of the HEART project?</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">If that is what you are saying could you please tell me who is working on enabling the inclusion of the PCP’s Identity Proofing of Alice in determining the level of assurance
associated with her accounts (in any system – PHR, EMR or the portals thereof)?</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">This is what I am trying to discover. When the PCP has a patient-provider relationship established with Alice and he is provide with Alice’s URL to her AS I am very interested
in how we can reuse this ID proofing event to increase the level of assurance associated with Alice’s AS. There are many ways to remote Identity proof Alice that have cost associated with them. If we can capture the ID Proofing event (I assume that a URL
and some unique Identifier related to Alice is required in the HEART transactions when Alice has her privacy preferences configured in an AS that has multiple users) from when the PCP trust the URL/GUID associated with Alice for an AS it would create value
too.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">In other words – how do we make it possible for relying parties other than Alice’s PCP to discover that her PCP has come to trust the binding of Alice’s Identity to a
specific URL/ID for her AS?</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Is that being discussed anywhere other than the HEART project? </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Aaron Seib, CEO</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">@CaptBlueButton</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> (o)<span class="Apple-converted-space"> </span><a href="tel:301-540-2311" target="_blank" style="color: purple; text-decoration: underline;">301-540-2311</a></span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">(m)<span class="Apple-converted-space"> </span><a href="tel:301-326-6843" target="_blank" style="color: purple; text-decoration: underline;">301-326-6843</a></span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__nate-2Dtrust.org&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=GsszYPqXY8kjgF2FhBwvkMG_Z7S_4cegPxAs1Z8UJCY&e=" target="_blank" style="color: purple; text-decoration: underline;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); text-decoration: none;"><img border="0" width="205" height="48" id="_x0000_i1028" src="imap://gfm%40securityrs%2Ecom@outlook.office365.com:993/fetch%3EUID%3E/Drafts%3E1851?view=att&th=14f1d564d8a988e7&attid=0.1&disp=emb&realattid=cea212b74cdc1b4b_0.1&zw&atsh=1"></span></a><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span>Openid-specs-heart [<a href="mailto:openid-specs-heart-bounces@lists.openid.net" style="color: purple; text-decoration: underline;">mailto:openid-specs-heart-bounces@lists.openid.net</a>]<span class="Apple-converted-space"> </span><b>On
Behalf Of<span class="Apple-converted-space"> </span></b>Adrian Gropper<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Monday, August 10, 2015 7:33 PM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Kinsley, William<br>
<b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-heart] Draft HEART Meeting Notes 2015-08-10</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
(Proposed)<span class="Apple-converted-space"> </span><b>Problem Statement</b><span class="Apple-converted-space"> </span>(for HEART EHR-PHR Use Case:<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
This use-case is designed to (1) enable automated update of Alice's PHR when new findings or orders are entered by the physician or practice staff into the practice's EHR; (2) to enable messaging with attached documents from the practice's EHR via Alice's PHR;
and (3) to enable _________ by allowing the practice to identity proof Alice's persona as authenticated by Alice's PHR.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Discussion of proposed problem statement:<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
I think I understand the intent, but I'm having a difficult time coming up with a transaction that would be enabled or even enhanced by (3). The intent could be to enhance an un-tethered PHR like Microsoft HealthVault or a health information exchange that don't
have an in-person relationship with Alice in case Alice loses her password and forgets her secret questions. In that case, Alice could presumably go to her PCP's office or any other practice that is federated with the PHR or HIE and present a verified ID to
reclaim control of her PHR account. As Sarah points out in her comment, this is a federation use-case outside the scope of HEART.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Another possible intent could be to enhance the ability for another practice, for example the Quest Lab used by the PCP, to share results with Alice or Alice's PHR through the lab's portal or FHIR interface. This is another situation where the other practice,
the Lab, has no in-person relationship with Alice. It's another example of federation because the Lab would have to be federated with the PHR host in order to trust that indeed, the identity proofing was done. I'm not sure how this would work. There's obviously
trust between the PCP and the Lab because the PCP sent the order to the Lab directly under the HIPAA TPO exemption but the PHR is another matter.<br>
<br>
It would be nice if the PCP could send the order to the Lab via the PHR. This would be even more valuable in the case of e-prescribing because Alice would then have the opportunity to shop various pharmacies using, for example GoodRX. With today's EHRs, Alice
has lost this ability to shop around except if the EHR prints a paper prescription or lab order. The value of shopping around, in the case of orders for an expensive test such as an MRI can be over $1,000. To enable this benefit, the EHR would have to (a)
digitally sign the order and optionally (b) in the case of a controlled substance prescription, identity proof Alice so that the pharmacy can check her ID when she comes to pick up her prescription. Digitally signing the order or prescription (a) before sending
it to the PHR under case (1) or (2) above has nothing to do with HEART and may be considered a federation or trust framework issue anyway.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Although identity proofing could be valuable for giving Alice access to the portals of labs, pharmacies, and health information exchanges this is purely a matter of federation and doesn't have directly to do with FHIR, OAuth, or UMA.<span class="Apple-converted-space"> </span><b>I
suggest there is no Problem (3).</b><o:p></o:p></p>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
The relationship between FHIR and Problem (1) and Problem (2) is yet another matter. I suggest we take that up as part of the scopes discussion once we have finalized the Problem Statement.<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Adrian<o:p></o:p></div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></p>
</div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
On Mon, Aug 10, 2015 at 5:21 PM, Sarah Squire <<a href="mailto:sarah@engageidentity.com" style="color: purple; text-decoration: underline;">sarah@engageidentity.com</a>> wrote:<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Most of the discussion was captured in the use case document itself, but I noted the discussion topics here as well just for future reference.<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 11pt; font-family: Arial, sans-serif;">Attending:</span></b><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Debbie Bucci</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Sarah Squire</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Danny van Leeuwen</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Andy Oram</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Robert Horn</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Mark Russell</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">William Kinsley</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Eve Maler</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Adrian Gropper</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Glen Marshall</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Andrew Hughes</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Corey Spears</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Tom Sullivan</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Abbie Barbir</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Thomas Hardjono</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Justin Richer</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Edmund Jay</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Catherine Schulten</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Chad Evans</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 11pt; font-family: Arial, sans-serif;">Next steps:</span></b><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">We will continue to address this use case next week.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<b><span style="font-size: 11pt; font-family: Arial, sans-serif;">Notes:</span></b><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">We worked on closing out issues on the enrollment use case document:</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_document_d_1IvbdWerdvMuA1dQ-2DKQvVKqIBrAas7FoenNVUtgpqYrw_edit&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=rJcDovHb6MzJ-YsamL6otPaASHOHKg9-UVwpK6gEitw&e=" style="color: purple; text-decoration: underline;">https://docs.google.com/document/d/1IvbdWerdvMuA1dQ-KQvVKqIBrAas7FoenNVUtgpqYrw/edit</a></span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Are registration and enrollment interchangeable?</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Registration is being used for Alice to enroll with both her doctor’s practice and the practice’s patient portal. We could use registration to mean practice registration and enrollment to mean EHR
enrollment. When we use the term “known to the practice” it means that the practice has seen or heard from the patient and the practice has checked for insurance eligibility. A patient can be enrolled into an EHR by a staff member or they can enroll themselves.
We decided to use the term “register” in the title rather than enroll since we are referring to the practice.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">The PHR and EHR already have an established relationship in this use case so that we do not have to address dynamic registration or service discovery. We have made the decision not to address this
problem so that we can focus on other technical questions.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">Acknowledgement of receipt of privacy practices is peripheral.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">We have removed the waiting room step since it has been captured in previous steps.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">We confirmed that the doctor does record the results of the physical examination directly into the EHR without any sort of later transcription.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">We should not use the word “results” with regard to a physical exam. We should use the phrase “clinical findings.”</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">The lab results are peripheral but have been included so that we can come back to them later.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">The lab results should also include patient instructions such as fasting - this is also peripheral.</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="font-size: 11pt; font-family: Arial, sans-serif;">The problem statement is to autoupdate through the PHR and message through the PHR.</span><o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="color: rgb(136, 136, 136);"> </span><o:p></o:p></div>
</div>
<div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="color: rgb(136, 136, 136);">Sarah Squire</span><o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="color: rgb(136, 136, 136);">Engage Identity</span><o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<span style="color: rgb(136, 136, 136);"><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__engageidentity.com_&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=unCvomLBNtPlXmx5I88cw7Y28VPGCu5LCd31PPAPvvk&e=" target="_blank" style="color: purple; text-decoration: underline;"><span style="color: rgb(17, 85, 204);">http://engageidentity.com</span></a></span><o:p></o:p></div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br>
_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank" style="color: purple; text-decoration: underline;">Openid-specs-heart@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dheart&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=7x6uBI9FPfnAQSt9gKBJbr4lawcfciA1VkwXX8tWpKc&e=" target="_blank" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><o:p></o:p></p>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br>
<br clear="all">
<br>
--<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Adrian Gropper MD<br>
<br>
<span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);">RESTORE Health Privacy!<br>
HELP us fight for the right to control personal health data.<br>
DONATE:<span class="Apple-converted-space"> </span></span><span style="font-family: Arial, sans-serif; color: rgb(5, 99, 193);"><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__patientprivacyrights.org_donate-2D2_&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=g4JjMzFvRzGI_E-07TFkx3KazqNZhrwYntpo7ST-5TY&e=" style="color: purple; text-decoration: underline;">http://patientprivacyrights.org/donate-2/</a></span><o:p></o:p></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br>
<br clear="all">
<br>
--<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
Adrian Gropper MD<br>
<br>
<span style="font-family: Arial, sans-serif; color: rgb(31, 73, 125);">RESTORE Health Privacy!<br>
HELP us fight for the right to control personal health data.<br>
DONATE:<span class="Apple-converted-space"> </span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__patientprivacyrights.org_donate-2D2_&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=g4JjMzFvRzGI_E-07TFkx3KazqNZhrwYntpo7ST-5TY&e=" target="_blank" style="color: purple; text-decoration: underline;"><span style="color: rgb(5, 99, 193);">http://patientprivacyrights.org/donate-2/</span></a></span><o:p></o:p></div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<br>
<br>
<o:p></o:p></p>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';">_______________________________________________<o:p></o:p></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';">Openid-specs-heart mailing list<o:p></o:p></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><a href="mailto:Openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">Openid-specs-heart@lists.openid.net</a><o:p></o:p></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';"><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dheart&d=BQMFaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=B4hg7NQHul-cxfpT_e9Lh49ujUftqzJ6q17C2t3eI64&m=QEc_ouayxpK5LgsU5frc1XYC2-qyRNRhIWRUuxT3te0&s=7x6uBI9FPfnAQSt9gKBJbr4lawcfciA1VkwXX8tWpKc&e=" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><o:p></o:p></pre>
</blockquote>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
<o:p> </o:p></div>
</div>
_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" style="color: purple; text-decoration: underline;">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
</div>
</blockquote>
</div>
<br>
</body>
</html>