<div dir="ltr">(rhymes with I, Dr. Spock)<br><div><br>The joy of iDSpoc is that FHIR is the only standard that matters and it already has what we need. Grahame pointed me to <a href="http://hl7.org/fhir/subscription.html">http://hl7.org/fhir/subscription.html</a> which specifies the notification mechanisms that can meet all aspects of the iDSpoc definition. OAuth authorization servers are also already in FHIR. Grahame also pointed out that FHIR recognizes the need for conformance statements and therefore a self-assertion of iDSpoc can be included as a physician and patient-friendly label in any FHIR conformance statement. Self-assertion has already been proposed in related domains by OpenID Foundation and IDESG. It has many benefits over formal certification in a fast-moving field like decision support.<br><br></div><div>Also, as discussed in today's HIT Joint Committee, please note the reference to information blocking attestation on pages 719 and 768 of <a href="https://www.gpo.gov/fdsys/pkg/FR-2016-05-09/pdf/2016-10032.pdf">https://www.gpo.gov/fdsys/pkg/FR-2016-05-09/pdf/2016-10032.pdf</a> iDSpoc could be designed to meet this regulatory definition.<br><br></div><div>Here it is again with a real name:<br><br><i>iDSpoc is a label that any FHIR endpoint can assert if it does not block independent decision support at the point-of-care.
<br>
<br>
Independent means that any decision support source is asserted by any
patient-specified authorization server, without forcing the patient to
sign-in to the resource server's patient portal once:<br>
- the authorization server has been specified, <br>
- a patient-specified notification endpoint has been subscribed for changes to the patient-level FHIR resource,
<br>
- a patient-specified notification endpoint has been subscribed for HIPAA-allowed warnings, and
<br>
- a patient-specified notification endpoint has been subscribed for a
contemporaneous accounting for disclosures by the FHIR resource server.
</i><div>
<p class="MsoNormal" style="margin-bottom:12pt"><i>At the point-of-care
means that changes to the patient-level FHIR resource are pushed to that
notification endpoint as soon as an order, observation, result, or note
is entered even if the encounter record is
not yet final.</i></p>
</div><i>
</i><div><i>
</i><p class="MsoNormal" style="margin-bottom:12pt"><i>Any FHIR endpoint can
self-assert the iDSpoc label as defined above as part of their Notice of
Privacy Practices and would be subject to OCR or FTC sanction
accordingly. The iDSpoc label definition is copyright Patient
Privacy Rights and changes to it could not be labeled iDSpoc.</i></p><p class="MsoNormal" style="margin-bottom:12pt">Adrian<br></p>
</div>
<br></div><div><br><br><div><br><br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, May 17, 2016 at 10:32 AM, Glen Marshall [SRS] <span dir="ltr"><<a href="mailto:gfm@securityrs.com" target="_blank">gfm@securityrs.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">Adrian,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">Should I assume that:<u></u><u></u></span></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u><span style="font-family:"Calibri",sans-serif">You will propose and sponsor new standards, as needed, outside of the scope of HEART?<u></u><u></u></span></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u><span style="font-family:"Calibri",sans-serif">You will propose and sponsor a FHIR proposal to HL7/SMART/Argonaut as US-domain extensions, especially regarding HIPAA policy requirements?<u></u><u></u></span></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u><span style="font-family:"Calibri",sans-serif">You will propose new/revised policy requirements to the appropriate US regulatory bodies, e.g., ONC and CMS OPR?<u></u><u></u></span></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u><span style="font-family:"Calibri",sans-serif">You will ensure that asserted copyrights are congruent with participants’ intellectual property rules of the affected SDO(s)?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">I would like to see some expansion on the subscription ideas. There may be existing standards for it that, in combination, can form a profile rather than new standards. Preferably, these
standards would be cross-domain, enabling novel data sources to participate even if they are not HIPAA-covered entities nor traditionally considered health care.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">There seems to be an implicit need for infrastructure in your proposal. While I expect that existing standard network protocols at level 5 and below are required, the proposals may include
services like directories and authentication credentials (certs, etc.) plus multi-factor authentication. Some standards exist for profiling these, some have been profiled already, and some new standards or profiles might be needed. At a business case level,
e.g., for pilots, we need to have articulate clear value/benefits to help identify potential business actors and funding sources.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">Glen<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Glen F. Marshall<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Consultant<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Security Risk Solutions, Inc.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">698 Fishermans Bend<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Mount Pleasant, SC 29464<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Tel: <a href="tel:%28610%29%20644-2452" value="+16106442452" target="_blank">(610) 644-2452</a>
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif">Mobile: <a href="tel:%28610%29%20613-3084" value="+16106133084" target="_blank">(610) 613-3084</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><a href="mailto:gfm@securityrs.com" target="_blank">gfm@securityrs.com</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif"><a href="http://www.securityrisksolutions.com/" target="_blank"><span style="color:rgb(5,99,193)">www.SecurityRiskSolutions.com</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Openid-specs-heart [mailto:<a href="mailto:openid-specs-heart-bounces@lists.openid.net" target="_blank">openid-specs-heart-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Adrian Gropper<br>
<b>Sent:</b> Tuesday, May 17, 2016 10:03<br>
<b>To:</b> John Moehrke <<a href="mailto:johnmoehrke@gmail.com" target="_blank">johnmoehrke@gmail.com</a>><br>
<b>Cc:</b> Grahame Grieve <<a href="mailto:grahame@healthintersections.com.au" target="_blank">grahame@healthintersections.com.au</a>>; <a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-heart] Recap of HEART meeting 5/16/16 on a non-data-blocking self-assertion label: Foo<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Here's the proposed What:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><br>
Foo is a label that any FHIR endpoint can assert if it does not block independent decision support at the point-of-care.
<br>
<br>
Independent means that any decision support source is asserted by any patient-specified authorization server, without forcing the patient to sign-in to the resource server's patient portal once:<br>
- the authorization server has been specified, <br>
- a patient-specified notification endpoint has been subscribed for changes to the patient-level FHIR resource,
<br>
- a patient-specified notification endpoint has been subscribed for HIPAA-allowed warnings, and
<br>
- a patient-specified notification endpoint has been subscribed for a contemporaneous accounting for disclosures by the FHIR resource server.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">At the point-of-care means that changes to the patient-level FHIR resource are pushed to that notification endpoint as soon as an order, observation, result, or note is entered even if the encounter record is
not yet final.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">Any FHIR endpoint can self-assert the Foo label as defined above as part of their Notice of Privacy Practices and would be subject to OCR or FTC sanction accordingly. The Foo label definition is copyright Patient
Privacy Rights and changes to it could not be labeled Foo.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Adrian<u></u><u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Tue, May 17, 2016 at 8:07 AM, John Moehrke <<a href="mailto:johnmoehrke@gmail.com" target="_blank">johnmoehrke@gmail.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:-moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Josh echos my take away as well. I would emphasize Josh's point about the need for you to focus on the 'what' in your solution, and less on the 'how'. The mechanisms that achieve the 'what' will change over time, and often are not the solution
one originally identifies. So what is the thing that is not working today, and what would it look like to an outside observer when we are done.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">John<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">John Moehrke<br>
Principal Engineering Architect: Standards - Interoperability, Privacy, and Security<br>
CyberPrivacy – Enabling authorized communications while respecting Privacy<br>
M <a href="tel:%2B1%20920-564-2067" target="_blank">+1 920-564-2067</a><br>
<a href="mailto:JohnMoehrke@gmail.com" target="_blank">JohnMoehrke@gmail.com</a><br>
<a href="https://www.linkedin.com/in/johnmoehrke" target="_blank">https://www.linkedin.com/in/johnmoehrke</a><br>
<a href="https://healthcaresecprivacy.blogspot.com" target="_blank">https://healthcaresecprivacy.blogspot.com</a><br>
"Quis custodiet ipsos custodes?" ("Who watches the watchers?")<u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">On Tue, May 17, 2016 at 6:49 AM, Josh Mandel <<a href="mailto:Joshua.Mandel@childrens.harvard.edu" target="_blank">Joshua.Mandel@childrens.harvard.edu</a>> wrote:<u></u><u></u></p>
</div>
</div>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:-moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal">(Replying from my registered e-mail address this time.)<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">Hi Adrian,</span><u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">While we haven't yet received minutes from yesterday's call, I feel compelled to point out that much of the discussion on yesterday's call felt (to me) more like the HEART workgroup members asking detailed
questions in an attempt to understand what you were actually proposing.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">To the extent that the group could follow, your proposal appeared to require the creation of new standards, rather than the profiling of existing standards — and to that extent, it appeared out of scope for
HEART. At least, that was my take-away from the conversation around the 4:45pm ET mark; I don't mean to speak for the group.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">I think the action item at the end of our call was for you to write up something more formally so the group could take another shot at trying to understand it and determine whether it falls within HEART's charter.
Eve shared some specific advice, which I hope you will follow: please try to dial back the technical recommendations in your write-up (things like "we need public key encryption of the Request Form" and "we need the FHIR Subscription API") and instead focus
on your motivation (i.e., your desired functional properties) so the technical team can try to propose approaches that might be a good fit.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt">Best,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt"> Josh<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Mon, May 16, 2016 at 11:01 PM, Adrian Gropper <<a href="mailto:agropper@healthurl.com" target="_blank">agropper@healthurl.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:-moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">Thanks to all for a very friendly and constructive discussion of a label ("Foo" for now) that any two FHIR endpoints can self-assert to indicate that "Independent Decision Support at the Point of Care for Physicians
and Patients" is supported. Done right, this could eliminate all sorts of regulatory mandates and certifications.<u></u><u></u></p>
</div>
<p class="MsoNormal">Much of the call was about what standards or profile groups would be appropriate to define Foo and how much of that would be in-scope for HEART. Foo would start by requiring support for the existing FHIR Subscription and History features
at the patient-level. We also discussed if UMA or other current Kantara projects could be adapted to the definition of Foo.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">During the call it was proposed that FHIR-based interoperability labels need to handle maybe 5 different health records architectures:<u></u><u></u></p>
<div>
<ol start="1" type="1">
<li class="MsoNormal">
Centralized EHR (inpatient and outpatient as in, maybe Israel) <u></u><u></u></li><li class="MsoNormal">
Decentralized EHR (central inpatient, distributed outpatient, as in UK)<u></u><u></u></li><li class="MsoNormal">
Patient Centered EHR Summary (centralized and patient-controlled, as in AU My Health Record)<u></u><u></u></li><li class="MsoNormal">
Patient Owned EHR (distributed to each patient, as in Apple HealthKit, ResearchKit, and CareKit)<u></u><u></u></li><li class="MsoNormal">
EHR Apps and Independent Decision Support (user-interactive)<u></u><u></u></li></ol>
<p class="MsoNormal">Given that FHIR EHR endpoints might be participating in any and all of the 5 patterns (the physician or the patient as requesting party could be on either side of the FHIR transaction) does Foo apply only to some or all of the 5 architectures?
I propose that a single Foo can cover all 5 and provide a clear objective goal for all of the various standards and data blocking measures.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">We concluded with a suggestion that Foo might be documented as a new HEART Use Case over the next few weeks.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:rgb(136,136,136)">Adrian<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:rgb(136,136,136)"><u></u> <u></u></span></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12pt">_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Adrian Gropper MD<br>
<br>
<span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)">PROTECT YOUR FUTURE - RESTORE Health Privacy!<br>
HELP us fight for the right to control personal health data.<br>
DONATE: <a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:rgb(5,99,193)">http://patientprivacyrights.org/donate-2/</span></a></span>
<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
<br>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><br><br><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)"><br>HELP us fight for the right to control personal health data.</span><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)"></span><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)"><br>DONATE:
<a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:rgb(5,99,193)">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:rgb(31,73,125)"></span>
</div></div></div></div></div></div></div></div>
</div></div></div></div>