<div dir="ltr">Hi Dale,<div><br></div><div>I also participate in HEART, as you can see... (I am responding to the whole group as the following might not be well understood).</div><div><br></div><div>Note that no organization likes using the word "Consent". It is truly a lighting-rod and never ends well. However reality is that we are indeed talking about the word Consent in the dictionary definition sense of the word, and try to avoid the emotional and abuse, all while trying to make the system better. More fun, in HL7 FHIR we are just now moving away from considering these a "Contract", which is also true, but also fraught with abuse and emotion.</div><div><br></div><div>I expect that using the UMA mechanism is equivalent to what the FHIR Consent is attempting to do regarding encoding the rules of data disclosure. Equivalence is a very loose term. -- VERY LOOSE.. (Adrian will surely rant here)</div><div><br></div><div>Where in the UMA case it is focused on the technical means of making a decision and enforcing that decision. In UMA it is the AS responsibility to deal with the UX and persistence of the rules that it is enforcing. Meaning in UMA there is no requirement to expose the rules. This is one architectural model, and one I agree with with "User" "Managed" "Access". </div><div><br></div><div>Where as in FHIR Consent the goal is to persist the rules in an open format. Where in FHIR Consent it puts the capturing of the rules out-of-scope, expecting that the way that the consent is captured will be the focus of application developers. This is similar as with UMA, but more explicitly putting the separation at the rule encoding. In FHIR Consent it also does not indicate how the rules will be processed (decision and enforcement). The focus in FHIR on capturing the rules, is that it is trying to address the needs of healthcare that has highly distributed systems. That is to say that it is very unusual for one healthcare organization to have all their data under one service API, thus controllable by one access control system. Each department within an organization likely has one server for their specific data, it is only conceptually understood as being all related to the 'one patient'.</div><div><br></div><div>There is no expectation that FHIR Consent is any less capable of being used in a Patient Centric way, but it must also be useable in all the other ways that healthcare needs.</div><div><br></div><div>It is very possible that one could use the FHIR Consent resource in a UMA environment; I just don't see this as a compelling architecture. It could certainly be a good educational project.</div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">John Moehrke<br>Principal Engineering Architect: Standards - Interoperability, Privacy, and Security<br>CyberPrivacy – Enabling authorized communications while respecting Privacy<br>M +1 920-564-2067<br><a href="mailto:JohnMoehrke@gmail.com" target="_blank">JohnMoehrke@gmail.com</a><br><a href="https://www.linkedin.com/in/johnmoehrke" target="_blank">https://www.linkedin.com/in/johnmoehrke</a><br><a href="https://healthcaresecprivacy.blogspot.com" target="_blank">https://healthcaresecprivacy.blogspot.com</a><br>"Quis custodiet ipsos custodes?" ("Who watches the watchers?")</div></div></div>
<br><div class="gmail_quote">On Wed, Jun 22, 2016 at 4:16 PM, Dale Moberg <span dir="ltr"><<a href="mailto:dale.moberg@orionhealth.com" target="_blank">dale.moberg@orionhealth.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Not yet. Just wanted the group to know of that work in progress. Uncertain whether UMA is interested in consent issues yet or not. </div>
<div>(There has been discussion, exasperation, and a temporary moratorium on usage of “consent”]</div>
<div>There is still considerable discussion of what the hoped for outcome of the HEART profiles is to be.</div>
<div>I noted that there was one expectation expressed in the draft about what the outcome should be.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>John Moehrke <<a href="mailto:johnmoehrke@gmail.com" target="_blank">johnmoehrke@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 22, 2016 at 5:11 PM<br>
<span style="font-weight:bold">To: </span>Dale Moberg <<a href="mailto:dale.moberg@orionhealth.com" target="_blank">dale.moberg@orionhealth.com</a>><br>
<span style="font-weight:bold">Cc: </span>Debbie Bucci <<a href="mailto:debbucci@gmail.com" target="_blank">debbucci@gmail.com</a>>, "<a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a>" <<a href="mailto:openid-specs-heart@lists.openid.net" target="_blank">openid-specs-heart@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-heart] FYI Draft of a FHIR resource called "Consent"<br>
</div><div><div class="h5">
<div><br>
</div>
<div>
<div>
<div dir="ltr">Dale,
<div><br>
</div>
<div>I am one of the leads on the FHIR Consent work. There is significant editing going on right now. The github site is a perspective into the editing process, it is the result of the continuous build. So what you see might be good stuff, or might be simply
one random thought. </div>
<div><br>
</div>
<div>Is there a question?</div>
<div><br>
</div>
<div>John</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div data-smartmail="gmail_signature">
<div dir="ltr">John Moehrke<br>
Principal Engineering Architect: Standards - Interoperability, Privacy, and Security<br>
CyberPrivacy – Enabling authorized communications while respecting Privacy<br>
M <a href="tel:%2B1%20920-564-2067" value="+19205642067" target="_blank">+1 920-564-2067</a><br>
<a href="mailto:JohnMoehrke@gmail.com" target="_blank">JohnMoehrke@gmail.com</a><br>
<a href="https://www.linkedin.com/in/johnmoehrke" target="_blank">https://www.linkedin.com/in/johnmoehrke</a><br>
<a href="https://healthcaresecprivacy.blogspot.com" target="_blank">https://healthcaresecprivacy.blogspot.com</a><br>
"Quis custodiet ipsos custodes?" ("Who watches the watchers?")</div>
</div>
</div>
<br>
<div class="gmail_quote">On Wed, Jun 22, 2016 at 3:24 PM, Dale Moberg <span dir="ltr">
<<a href="mailto:dale.moberg@orionhealth.com" target="_blank">dale.moberg@orionhealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<span>
<div dir="ltr">
<div style="margin-left:15px"><br>
<a href="http://hl7-fhir.github.io/consent.html" target="_blank">http://hl7-fhir.github.io/consent.html</a></div>
</div>
</span>
<div><br>
</div>
<div>From section 6.7.3</div>
<div>[…]</div>
<div>“ The enforcement of the Privacy Consent Directive is not included, but is expected that enforcement can be done using a mix of the various Access Control enforcement methodologies (e.g. OAuth, UMA, XACML). This enforcement includes the details of the
enforcement meaning of the elements of the Privacy Consent Directive, such as the rules in place when there is an opt-in consent would be specific about which organizational roles have access to what kinds of resources (e.g. RBAC, ABAC). The specification
of these details are not in scope for the Consent resource. "</div>
<span>
<div dir="ltr">
<div style="margin-left:15px"><br>
</div>
</div>
</span></div>
<br>
_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div></div></span>
</div>
</blockquote></div><br></div></div>