<div dir="ltr">A few more comments: I believe the party-to-entity mappings need some tweaking (and more explicitness), which will have some impact on the flows and swimlanes. We have the following parties:<div><ul><li>Alice </li><li>Son</li><li>A variety of EHRs</li><li>PHR</li><li>An operator of an authorization service</li><li>CDRN</li><li>Clinical researcher</li><li>IRB</li><li>An operator of a reidentification engine</li></ul><div>Here's my best guess at mappings to UMA roles; note that these come out differently, and are incomplete:</div><div><ul><li>Alice: RO (same)</li><li>Son: RqP (new; will need new thought, as an RqP does not literally "act as" Alice in UMA, even if he is her "proxy", but is given delegated access)</li><li>A variety of EHRs: RS's as clinical data sources to Alice's PHR and to the CDRN, and client to Alice's PHR</li><li>PHR: possibly an RS as a consumer data source to Alice's EHR, and client to Alice's EHRs and to the CDRN</li><li>An operator of an authorization service: AS</li><li>CDRN: RqP? (is that what you meant by RP? could be RqP/client for our purposes, assuming a specialty client)</li><li>Clinical researcher: receipient of data from the CDRN out of band of UMA</li><li>IRB: out of band of UMA, I think</li><li>An operator of a reidentification engine: not sure if this wants to be in band of UMA -- it might be but we need to think about it</li></ul><div>And here are some tentative mappings to a "legal layer" that seems like the elephant in this room:</div></div><div><ul><li>Alice: data subject that's a party to a data sharing agreement</li><li>IRB: committee that's another key party</li><li>Clinical researcher: third party that has a separate agreement with the IRB (researcher and Alice don't know about each other)</li></ul></div><div><br></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl<br>New <a href="https://www.forgerock.com" target="_blank">ForgeRock Identity Platform</a> with <a href="https://www.forgerock.com/platform/user-managed-access/" target="_blank">UMA support</a> and an <a href="https://forgerock.org/openuma/" target="_blank">OpenUMA community</a>!</p></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Feb 1, 2016 at 1:06 PM, Eve Maler <span dir="ltr"><<a href="mailto:eve.maler@forgerock.com" target="_blank">eve.maler@forgerock.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Apologies for the delay in sending these! I'm commenting just on the problem statement for now, and really just sending these additional problems/issues for consideration just for posterity since today's meeting has begun already.<div><ul><li>Access to data controlled by a resource owner after she has died: We need to consider "digital death" scenarios. Should we consider whether it's in scope to reassign a resource's resource owner or something?</li><li>Capability of the health API in question to enable pseudonymity of release data. Does/should FHIR handle this?</li><li>Control over the purpose of use by the CDRN.</li><li>At "BL" if not "T" control over consent of the CDRN-to-research transfer of data. (Is this out of scope?)</li></ul><div>I'd love to see the first diagram moved to the Problem Statement section, since it's such a good summary, and a key supplied for the arrow colors.</div><div><br></div><div>Thanks!</div><span class="HOEnZb"><font color="#888888"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell <a href="tel:%2B1%20425.345.6756" value="+14253456756" target="_blank">+1 425.345.6756</a> | Skype: xmlgrrl | Twitter: @xmlgrrl<br>New <a href="https://www.forgerock.com" target="_blank">ForgeRock Identity Platform</a> with <a href="https://www.forgerock.com/platform/user-managed-access/" target="_blank">UMA support</a> and an <a href="https://forgerock.org/openuma/" target="_blank">OpenUMA community</a>!</p></div></div></div></div></div></div></div>
</font></span></div></div>
</blockquote></div><br></div>