<font size=2 face="sans-serif">This diverges significantly but to understand
the risks you need to know harms and probabilities. Is that person
wrong about that email danger? What are the potential harms to that
person? What are the probabilities that this exposure will result in harm?
What are the cumulative risks and correlated risks? We've got
pitifully little data. That person who turned red might be entirely
correct that for their situation and the PHI involved the integrated probability
and degree of harm from disclosure is much less than the integrated probability
and degree of harm from lack of disclosure. </font>
<br>
<br><font size=2 face="sans-serif">For example, I think the probable harm
from disclosing my dentist appointment (which is PHI) in unprotected email
is less than the harm from missing the appointment. So I let them
send email appointment reminders. I also do not let them use their
web portal for me. It looks poorly implemented and would expose too
much else.</font>
<br>
<br><font size=2 face="sans-serif">I think our goal in this is to establish
mechanisms that will enable appropriate actions as we gain understanding
of risks and as risks evolve. Don't assume you've got the right risk
assessment at the moment. </font>
<br><font size=2 face="sans-serif"><br>
Kind Regards,<br>
</font><font size=2 face="Verdana"><b><br>
Robert Horn | </b></font><font size=2 color=red face="Verdana"><b>Agfa
HealthCare</b></font><font size=1 face="Verdana"><br>
Interoperability Architect | HE/Technology Office<br>
T +1 978 897 4860<br>
<br>
Agfa HealthCare Corporation, Gotham Parkway 580, Carlstadt, NJ 07072-2405,
USA</font><font size=1 color=#8f8f8f face="Verdana"><br>
</font><a href=http://www.agfahealthcare.com/><font size=1 color=#8f8f8f face="Verdana">http://www.agfahealthcare.com</font></a><font size=1 color=#8f8f8f face="Verdana"><br>
</font><a href=http://blog.agfahealthcare.com/><font size=1 color=#8f8f8f face="Verdana">http://blog.agfahealthcare.com</font></a><font size=1 face="Verdana"><br>
</font>
<hr><font size=1 face="Verdana">Click on link to read important disclaimer:
</font><a href=http://www.agfahealthcare.com/maildisclaimer><font size=1 color=#8f8f8f face="Verdana">http://www.agfahealthcare.com/maildisclaimer</font></a><font size=3>
</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">"Aaron Seib"
<aaron.seib@nate-trust.org></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">"'Glen Marshall
[SRS]'" <gfm@securityrs.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">openid-specs-heart@lists.openid.net</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">12/16/2015 10:46 AM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [Openid-specs-heart]
The Number and Ownership of Authorization Servers.</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">"Openid-specs-heart"
<openid-specs-heart-bounces@lists.openid.net></font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 color=#004080 face="Calibri">Awesome. And on the
other had – lest we all forget – we are the exception and there are people
on the other side of the continuum who literally turn red when you try
to explain to them that sending their PHI to an unsecure email address
is fraught with dangers. </font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">If you think about it –
that might be a case that we have to address. </font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">There are users who do not
want to set up a AS at all – they just want their damn data. Can
we introduce something in the profile that tells the technologist how to
configure that and more interesting – can that act as the users acknowledgement
that they understand the risks and have chosen to go commando with their
sharing preferences?</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">Aaron Seib, CEO</font>
<br><font size=2 color=#004080 face="Calibri">@CaptBlueButton </font>
<br><font size=2 color=#004080 face="Calibri"> (o) 301-540-2311</font>
<br><font size=2 color=#004080 face="Calibri">(m) 301-326-6843</font>
<br><a href="nate-trust.org"><img src=cid:_2_0FAAE7340FAAE3D4005AA4B385257F1D style="border:0px solid;"></a>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 face="Tahoma"><b>From:</b> Openid-specs-heart [</font><a href="mailto:openid-specs-heart-bounces@lists.openid.net"><font size=2 face="Tahoma">mailto:openid-specs-heart-bounces@lists.openid.net</font></a><font size=2 face="Tahoma">]
<b>On Behalf Of </b>Glen Marshall [SRS]<b><br>
Sent:</b> Tuesday, December 15, 2015 5:16 PM<b><br>
Cc:</b> openid-specs-heart@lists.openid.net<b><br>
Subject:</b> Re: [Openid-specs-heart] The Number and Ownership of Authorization
Servers.</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">Many people have already set-up
things to establish privacy, in various ways and some more effective than
others. Multiple AS might be one of them.<br>
<br>
For example, if I were enrolled in an HIV-positive clinical study, I might
want the study's AS to contain my authorization just for access to the
relevant RSs and not be noted in my clinical record. The very fact
of being enrolled in the study is too much of a disclosure.<br>
<br>
Similarly, a person who has established a social networking account on
an adult-interest web site might want to keep that out of sight from others.
The mere existence of such privacy preferences in a common authorization
resource might raise uncomfortable questions if they were revealed. One
solution is to have a distinct AS for the adult-interest site. That
can be generalized.<br>
<br>
For privacy reasons, I give every one of my on-line vendor contacts a unique
e-mail address to contact me, e.g., </font><a href=mailto:vendor.com@glenmarshall.com><font size=3 color=blue face="Times New Roman"><i><u>vendor.com</u></i><u>@glenmarshall.com</u></font></a><font size=3 face="Times New Roman">
Even though all the e-mail comes to a common account for me to read,
it makes it impossible for unrelated vendors to assemble and share a dossier
keyed by e-mail. Each vendor has my privacy and contact preferences
relative to just cou common business. With a large number of e-mail
addresses I also avoid common identification services, e.g., OAuth, except
where it suits my purposes. A side-effect is that I do not need complex
trust relationships among vendors. This is not much of a schlep for
me, once it was set-up. <br>
<br>
... and so on. <br>
</font>
<p><font size=3 face="Times New Roman"><b>Glen F. Marshall</b><br>
Consultant<br>
Security Risk Solutions, Inc.<br>
698 Fishermans Bend<br>
Mount Pleasant, SC 29464<br>
Tel: (610) 644-2452<br>
Mobile: (610) 613-3084</font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href=mailto:gfm@securityrs.com><font size=3 color=blue face="Times New Roman"><u>gfm@securityrs.com</u></font></a><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href=http://www.securityrisksolutions.com/><font size=3 color=blue face="Times New Roman"><u>www.SecurityRiskSolutions.com</u></font></a>
<br><font size=3 face="Times New Roman">On 12/15/15 15:10, Debbie Bucci
wrote:</font>
<br><font size=3 face="Times New Roman">Yes I believe ...</font><font size=3 color=#004080 face="Calibri">some
poor schlep is going to be on the hook for keeping his AS replicated with
the one I designated because of “Policy”</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 color=#004080 face="Calibri">AND (ideally) </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 color=#004080 face="Calibri">The trusted application
that you are familiar designate (Bill's source of truth) would/should trigger/drive
the updates. </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 color=#004080 face="Calibri">Perhaps a schlep provide
UI to verify update and changes (and trigger receipts of those update)
- would be considered a safeguard.</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 color=#004080 face="Calibri">Given your experience with
PHRs - you know best - there maybe one source of truth for Healthcare data
today but with IOT and other yet to be determined innovations - I
still believe (under the covers) it will be distributed in nature.</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 color=#004080 face="Calibri">Understanding that going
in may impact some of our decisions. </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"><br>
<br>
</font>
<br><font size=2 face="Courier New">_______________________________________________</font>
<br><font size=2 face="Courier New">Openid-specs-heart mailing list</font>
<br><a href="mailto:Openid-specs-heart@lists.openid.net"><font size=2 color=blue face="Courier New"><u>Openid-specs-heart@lists.openid.net</u></font></a>
<br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart"><font size=2 color=blue face="Courier New"><u>http://lists.openid.net/mailman/listinfo/openid-specs-heart</u></font></a>
<br><font size=3 face="Times New Roman"> </font>
<div align=center>
<hr noshade></div>
<br><font size=3 face="Times New Roman">No virus found in this message.<br>
Checked by AVG - </font><a href=http://www.avg.com/><font size=3 color=blue face="Times New Roman"><u>www.avg.com</u></font></a><font size=3 face="Times New Roman"><br>
Version: 2016.0.7294 / Virus Database: 4483/11177 - Release Date: 12/14/15</font><tt><font size=2>_______________________________________________<br>
Openid-specs-heart mailing list<br>
Openid-specs-heart@lists.openid.net<br>
</font></tt><a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart"><tt><font size=2>http://lists.openid.net/mailman/listinfo/openid-specs-heart</font></tt></a><tt><font size=2><br>
</font></tt>
<br>