<div dir="ltr">The SPM list is interesting, and, I think, complementary to and an extension of privacy principles. It's not talking strictly about data and its exposure; it sets up a strong new data stewardship role for a patient, and then defines a relationship between that steward and various putative services/apps/tools out in the world.<div><br></div><div>(With an UMA architecture in mind, we can fairly precisely name what those services/apps/tools might be.)<br><div><br></div><div>These are stated nearly in the form of agile user stories: As the patient, I want to do X, so that I can (benefit in terms of) Y. Once upon a time, the UMA WG partially went through an <a href="http://kantarainitiative.org/confluence/display/uma/User+Stories">exercise</a> like that to assist in our protocol design effort.</div></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl<br><b>ForgeRock Summits and UnSummits</b> <a href="http://summits.forgerock.com/" target="_blank">are coming to</a> <b>Sydney, London, and Paris!</b></p></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Tue, Jul 12, 2016 at 2:51 PM, Adrian Gropper <span dir="ltr"><<a href="mailto:agropper@healthurl.com" target="_blank">agropper@healthurl.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>The Principles of Privacy will only take you so far in the design of a product, service, or HEART. At some point we need to apply Privacy Engineering (<a href="https://ethics.berkeley.edu/privacy/resources/privacy-risk-management-framework-nistir-8062" target="_blank">https://ethics.berkeley.edu/privacy/resources/privacy-risk-management-framework-nistir-8062</a> ) to achieve a particular set of goals. I submit that the SPM bullet points are a reasonable goal for HEART.<br><br></div>A less pedantic way to look at the bullets is simply to see them as the essence of patient-centered design and focus HEART (and UMA) on solving the multiple portals problem. From the patient's perspective, the only way to solve the multiple portals problem is to be able to specify the Authorization Server to every resource server. That means that regardless of whether a resource server happens to be FHIR or whatever RESTful standard my bank exposes for my health savings account or whatever standard some wearable uses to stream my location coordinates, I can register and manage all of these resources from my one chosen AS.<br><br></div><div>If HEART doesn't take this perspective as we design our deliverable, who does?<span class="HOEnZb"><font color="#888888"><br></font></span></div><span class="HOEnZb"><font color="#888888"><div><br></div>Adrian<br><div><div><br> <br></div></div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jul 12, 2016 at 4:16 PM, John Moehrke <span dir="ltr"><<a href="mailto:johnmoehrke@gmail.com" target="_blank">johnmoehrke@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">This is fine, but is simply another way of stating the well established Principles of Privacy... right? I like how nicely compact your bullets are. I am just trying to determine if you think you have uncovered something missing....<div><br></div><div>I have a blog where I catalog the various standards on the definition of Privacy -- principles. and cross-reference them </div><div><a href="https://healthcaresecprivacy.blogspot.com/2015/04/privacy-principles.html" target="_blank">https://healthcaresecprivacy.blogspot.com/2015/04/privacy-principles.html</a><br></div><div><br></div><div>John</div></div><div class="gmail_extra"><br clear="all"><div><div data-smartmail="gmail_signature"><div dir="ltr">John Moehrke<br>Principal Engineering Architect: Standards - Interoperability, Privacy, and Security<br>CyberPrivacy – Enabling authorized communications while respecting Privacy<br>M <a href="tel:%2B1%20920-564-2067" value="+19205642067" target="_blank">+1 920-564-2067</a><br><a href="mailto:JohnMoehrke@gmail.com" target="_blank">JohnMoehrke@gmail.com</a><br><a href="https://www.linkedin.com/in/johnmoehrke" target="_blank">https://www.linkedin.com/in/johnmoehrke</a><br><a href="https://healthcaresecprivacy.blogspot.com" target="_blank">https://healthcaresecprivacy.blogspot.com</a><br>"Quis custodiet ipsos custodes?" ("Who watches the watchers?")</div></div></div>
<br><div class="gmail_quote"><div><div>On Sun, Jul 10, 2016 at 11:18 AM, Danny van Leeuwen <span dir="ltr"><<a href="mailto:danny@health-hats.com" target="_blank">danny@health-hats.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>TX Adrian <div><div><span></span><br><br>On Sunday, July 10, 2016, Adrian Gropper <<a href="mailto:agropper@healthurl.com" target="_blank">agropper@healthurl.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Here's what the thread of patients and physicians came up with:<br><ul><li>As the patient, I am the primary steward of my health information <b>wherever it is</b>.</li><span><li>As the primary steward, I have full access to all of my health information.</li><li>As the primary steward, I can determine who has access to which segments of my health information.</li><li>As the primary steward, I am notified about changes and access by others to my health information.</li></span><li>Stewardship of my health information is done through a single tool (web page or application) <b>across my service providers</b>.</li></ul>Adrian<br clear="all"><div><div><br><br><br><br>-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><br><br><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)"><br>HELP us fight for the right to control personal health data.</span><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)"></span><span style="font-family:"Arial",sans-serif;color:rgb(31,73,125)"><br>DONATE:
<a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:rgb(5,99,193)">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:rgb(31,73,125)"></span>
</div></div></div></div></div></div></div></div>
</div></div></div>
</blockquote><br><br></div></div><span><font color="#888888">-- <br><div dir="ltr"><div><div dir="ltr"><font color="#330099">Danny van Leeuwen<br><a href="tel:617-304-4681" value="+16173044681" target="_blank">617-304-4681</a><br></font><div><b><font color="#330099"><br></font></b><div><b><font color="#330099">Blog <a href="http://www.health-hats.com/" target="_blank">www.health-hats.com</a> <i><span style="font-size:8pt;font-family:'Arial Black',sans-serif">discovering the magic levers of best health</span></i></font></b></div></div><div><font face="arial narrow, sans-serif" color="#330099"><span style="font-size:8pt"><a href="https://twitter.com/HealthHats" target="_blank">Twitter</a></span></font></div><div><a href="https://www.linkedin.com/in/healthhatsdannyvl" target="_blank"><font face="arial narrow, sans-serif" size="1">LinkedIn</font></a><br></div></div></div></div><br>
</font></span><br></div></div>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><br>-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><br><br><span style="font-family:"Arial",sans-serif;color:#1f497d">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:"Arial",sans-serif;color:#1f497d"><br>HELP us fight for the right to control personal health data.</span><span style="font-family:"Arial",sans-serif;color:#1f497d"></span><span style="font-family:"Arial",sans-serif;color:#1f497d"><br>DONATE:
<a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:#0563c1">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:#1f497d"></span>
</div></div></div></div></div></div></div></div>
</div>
</div></div><br>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br></div>