<div dir="ltr">Aaron, your interpretation is correct.<div><br></div><div>We're working hard in the UMA legal subgroup to reduce friction even for those interested in <i>voluntarily</i> deploying ecosystems wider than one millimeter :-) -- but nonetheless, regulations often serve as a forcing function.<div><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl<br>Join our <a href="http://forgerock.org/openuma/" target="_blank">ForgeRock.org OpenUMA</a> community!</p></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Dec 16, 2015 at 9:46 AM, Aaron Seib <span dir="ltr"><<a href="mailto:aaron.seib@nate-trust.org" target="_blank">aaron.seib@nate-trust.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Very well said Mr. Horn. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">And I completely agree. I hate to say it but to date the opposite extreme that has been swaying over the appropriate sharing of PHI with consumers (i.e., that want to map the requirements we expect of providers to the consumer as well) is doing more harm at the expense of individual consumers than good. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">We’ve stood by the position that the risks associated with a Provider exchanging PHI with another Provider about N# of consumers is greater than when an exchange between the Consumer and a Provider is being considered and as a result the requirements associated with the consumer should be different in comparison to the requirements of a Provider who has a professionally defined role that under HIPAA gives him\her the authority to share data about consumers without their consent as a practical necessity in delivering care. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Today, as far as I am aware of applicable law, there is nothing that compels a Provider to reference a consumer’s HEART Profile before sending data to another Provider except if the Provider commits to do so in their NPP.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Eve sent out an email defining the continuum of adoption of AS using these terms: "full-choice" (wide-ecosystem); "partial-choice" (medium-ecosystem); "no-choice" (narrow-ecosystem) which I am not sure I understood the use of the word ‘choice’ but I got the overall gist of her message to be that as of today we are on the far right of the spectrum where very few Covered Entity’s enterprises would be able to support the consumer’s choice of an AS <b>not</b> owned by the enterprise. <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Perhaps the choice Eve is referring to is the consumers power to vote with their feet and only seek care from Covered Entities whose NPP indicates that they will employ the AS of the consumers choice. Lacking legislation requiring CEs to do this that is my understanding of how we will migrater from the right hand end of the spectrum to the left.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Am I missing anything that you guys have already addressed?<u></u><u></u></span></p><span class=""><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Aaron Seib, CEO<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">@CaptBlueButton <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> (o) <a href="tel:301-540-2311" value="+13015402311" target="_blank">301-540-2311</a><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">(m) <a href="tel:301-326-6843" value="+13013266843" target="_blank">301-326-6843</a><u></u><u></u></span></p><p class="MsoNormal"><a href="http://nate-trust.org" target="_blank"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125);text-decoration:none"><img border="0" width="205" height="48" src="cid:image004.jpg@01D137FF.C5C9F430"></span></a><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p></span><p class="MsoNormal"><b><span style="font-size:10pt;font-family:Tahoma,sans-serif">From:</span></b><span style="font-size:10pt;font-family:Tahoma,sans-serif"> Robert Horn [mailto:<a href="mailto:robert.horn@agfa.com" target="_blank">robert.horn@agfa.com</a>] <br><b>Sent:</b> Wednesday, December 16, 2015 11:30 AM<br><b>To:</b> <a href="mailto:aaron.seib@nate-trust.org" target="_blank">aaron.seib@nate-trust.org</a></span></p><div><div class="h5"><br><b>Cc:</b> <a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a><br><b>Subject:</b> Re: [Openid-specs-heart] The Number and Ownership of Authorization Servers.<u></u><u></u></div></div><p></p><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">This diverges significantly but to understand the risks you need to know harms and probabilities. Is that person wrong about that email danger? What are the potential harms to that person? What are the probabilities that this exposure will result in harm? What are the cumulative risks and correlated risks? We've got pitifully little data. That person who turned red might be entirely correct that for their situation and the PHI involved the integrated probability and degree of harm from disclosure is much less than the integrated probability and degree of harm from lack of disclosure. </span> <br><br><span style="font-size:10pt;font-family:Arial,sans-serif">For example, I think the probable harm from disclosing my dentist appointment (which is PHI) in unprotected email is less than the harm from missing the appointment. So I let them send email appointment reminders. I also do not let them use their web portal for me. It looks poorly implemented and would expose too much else.</span> <br><br><span style="font-size:10pt;font-family:Arial,sans-serif">I think our goal in this is to establish mechanisms that will enable appropriate actions as we gain understanding of risks and as risks evolve. Don't assume you've got the right risk assessment at the moment. </span> <br><span style="font-size:10pt;font-family:Arial,sans-serif"><br>Kind Regards,<br></span><b><span style="font-size:10pt;font-family:Verdana,sans-serif"><br>Robert Horn | <span style="color:red">Agfa HealthCare</span></span></b><span style="font-size:7.5pt;font-family:Verdana,sans-serif"><br>Interoperability Architect | HE/Technology Office<br>T <a href="tel:%2B1%20978%20897%204860" value="+19788974860" target="_blank">+1 978 897 4860</a><br><br>Agfa HealthCare Corporation, Gotham Parkway 580, Carlstadt, NJ 07072-2405, USA<span style="color:rgb(143,143,143)"><br></span></span><a href="http://www.agfahealthcare.com/" target="_blank"><span style="font-size:7.5pt;font-family:Verdana,sans-serif;color:rgb(143,143,143)">http://www.agfahealthcare.com</span></a><span style="font-size:7.5pt;font-family:Verdana,sans-serif;color:rgb(143,143,143)"><br></span><a href="http://blog.agfahealthcare.com/" target="_blank"><span style="font-size:7.5pt;font-family:Verdana,sans-serif;color:rgb(143,143,143)">http://blog.agfahealthcare.com</span></a><u></u><u></u></p><div class="MsoNormal" align="center" style="text-align:center"><hr size="3" width="100%" align="center"></div><p class="MsoNormal"><span style="font-size:7.5pt;font-family:Verdana,sans-serif">Click on link to read important disclaimer: </span><a href="http://www.agfahealthcare.com/maildisclaimer" target="_blank"><span style="font-size:7.5pt;font-family:Verdana,sans-serif;color:rgb(143,143,143)">http://www.agfahealthcare.com/maildisclaimer</span></a> <br><br><br><br><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(95,95,95)">From: </span><span style="font-size:7.5pt;font-family:Arial,sans-serif">"Aaron Seib" <<a href="mailto:aaron.seib@nate-trust.org" target="_blank">aaron.seib@nate-trust.org</a>></span> <br><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(95,95,95)">To: </span><span style="font-size:7.5pt;font-family:Arial,sans-serif">"'Glen Marshall [SRS]'" <<a href="mailto:gfm@securityrs.com" target="_blank">gfm@securityrs.com</a>></span> <br><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(95,95,95)">Cc: </span><span style="font-size:7.5pt;font-family:Arial,sans-serif"><a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a></span> <br><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(95,95,95)">Date: </span><span style="font-size:7.5pt;font-family:Arial,sans-serif">12/16/2015 10:46 AM</span> <br><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(95,95,95)">Subject: </span><span style="font-size:7.5pt;font-family:Arial,sans-serif">Re: [Openid-specs-heart] The Number and Ownership of Authorization Servers.</span> <br><span style="font-size:7.5pt;font-family:Arial,sans-serif;color:rgb(95,95,95)">Sent by: </span><span style="font-size:7.5pt;font-family:Arial,sans-serif">"Openid-specs-heart" <<a href="mailto:openid-specs-heart-bounces@lists.openid.net" target="_blank">openid-specs-heart-bounces@lists.openid.net</a>></span> <u></u><u></u></p><div class="MsoNormal" align="center" style="text-align:center"><hr size="3" width="100%" noshade style="color:rgb(160,160,160)" align="center"></div><p class="MsoNormal"><br><br><br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)">Awesome. And on the other had – lest we all forget – we are the exception and there are people on the other side of the continuum who literally turn red when you try to explain to them that sending their PHI to an unsecure email address is fraught with dangers. </span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)"> </span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)">If you think about it – that might be a case that we have to address. </span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)"> </span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)">There are users who do not want to set up a AS at all – they just want their damn data. Can we introduce something in the profile that tells the technologist how to configure that and more interesting – can that act as the users acknowledgement that they understand the risks and have chosen to go commando with their sharing preferences?</span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)"> </span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)">Aaron Seib, CEO</span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)">@CaptBlueButton </span><br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)"> (o) <a href="tel:301-540-2311" value="+13015402311" target="_blank">301-540-2311</a></span> <br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)">(m) <a href="tel:301-326-6843" value="+13013266843" target="_blank">301-326-6843</a></span> <br><a href="http://nate-trust.org" target="_blank"><span style="text-decoration:none"><img border="0" width="205" height="48" src="cid:image003.jpg@01D137FD.72A080F0"></span></a><br><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(0,64,128)"> </span> <br><b><span style="font-size:10pt;font-family:Tahoma,sans-serif">From:</span></b><span style="font-size:10pt;font-family:Tahoma,sans-serif"> Openid-specs-heart [</span><a href="mailto:openid-specs-heart-bounces@lists.openid.net" target="_blank"><span style="font-size:10pt;font-family:Tahoma,sans-serif">mailto:openid-specs-heart-bounces@lists.openid.net</span></a><span style="font-size:10pt;font-family:Tahoma,sans-serif">] <b>On Behalf Of </b>Glen Marshall [SRS]<b><br>Sent:</b> Tuesday, December 15, 2015 5:16 PM<b><br>Cc:</b> <a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a><b><br>Subject:</b> Re: [Openid-specs-heart] The Number and Ownership of Authorization Servers.</span> <br> <br>Many people have already set-up things to establish privacy, in various ways and some more effective than others. Multiple AS might be one of them.<br><br>For example, if I were enrolled in an HIV-positive clinical study, I might want the study's AS to contain my authorization just for access to the relevant RSs and not be noted in my clinical record. The very fact of being enrolled in the study is too much of a disclosure.<br><br>Similarly, a person who has established a social networking account on an adult-interest web site might want to keep that out of sight from others. The mere existence of such privacy preferences in a common authorization resource might raise uncomfortable questions if they were revealed. One solution is to have a distinct AS for the adult-interest site. That can be generalized.<br><br>For privacy reasons, I give every one of my on-line vendor contacts a unique e-mail address to contact me, e.g., <a href="mailto:vendor.com@glenmarshall.com" target="_blank"><i>vendor.com</i>@glenmarshall.com</a> Even though all the e-mail comes to a common account for me to read, it makes it impossible for unrelated vendors to assemble and share a dossier keyed by e-mail. Each vendor has my privacy and contact preferences relative to just cou common business. With a large number of e-mail addresses I also avoid common identification services, e.g., OAuth, except where it suits my purposes. A side-effect is that I do not need complex trust relationships among vendors. This is not much of a schlep for me, once it was set-up. <br><br>... and so on. <br> <u></u><u></u></p><p><b>Glen F. Marshall</b><br>Consultant<br>Security Risk Solutions, Inc.<br>698 Fishermans Bend<br>Mount Pleasant, SC 29464<br>Tel: <a href="tel:%28610%29%20644-2452" value="+16106442452" target="_blank">(610) 644-2452</a><br>Mobile: <a href="tel:%28610%29%20613-3084" value="+16106133084" target="_blank">(610) 613-3084</a><u><span style="color:blue"><br></span></u><a href="mailto:gfm@securityrs.com" target="_blank">gfm@securityrs.com</a><u><span style="color:blue"><br></span></u><a href="http://www.securityrisksolutions.com/" target="_blank">www.SecurityRiskSolutions.com</a> <br>On 12/15/15 15:10, Debbie Bucci wrote: <br>Yes I believe ...<span style="font-family:Calibri,sans-serif;color:rgb(0,64,128)">some poor schlep is going to be on the hook for keeping his AS replicated with the one I designated because of “Policy”</span> <br> <br><span style="font-family:Calibri,sans-serif;color:rgb(0,64,128)">AND (ideally) </span><br> <br><span style="font-family:Calibri,sans-serif;color:rgb(0,64,128)">The trusted application that you are familiar designate (Bill's source of truth) would/should trigger/drive the updates. </span><br> <br><span style="font-family:Calibri,sans-serif;color:rgb(0,64,128)">Perhaps a schlep provide UI to verify update and changes (and trigger receipts of those update) - would be considered a safeguard.</span> <br> <br><span style="font-family:Calibri,sans-serif;color:rgb(0,64,128)">Given your experience with PHRs - you know best - there maybe one source of truth for Healthcare data today but with IOT and other yet to be determined innovations - I still believe (under the covers) it will be distributed in nature.</span> <br> <br><span style="font-family:Calibri,sans-serif;color:rgb(0,64,128)">Understanding that going in may impact some of our decisions. </span><br> <br> </p></div></div></div></div></blockquote></div></div></div></div></div>