<div dir="ltr">Sorry, let me walk through them one by one. Below...<div class="gmail_extra"><br clear="all"><div><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell <a href="tel:%2B1%20425.345.6756" value="+14253456756" target="_blank">+1 425.345.6756</a> | Skype: xmlgrrl | Twitter: @xmlgrrl<br><b>ForgeRock Summits and UnSummits</b> <a href="http://summits.forgerock.com/" target="_blank">are coming to</a> <b>Sydney, London, and Paris!</b></p></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Jul 14, 2016 at 5:19 AM, Danny van Leeuwen <span dir="ltr"><<a href="mailto:danny@health-hats.com" target="_blank">danny@health-hats.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Eve, I'm struggling to understand what you are saying in response to Society issues. <div><br><div>1. Definition: <i>Agile </i>user. Is that someone who is tech savvy and comfortable playing and troubleshooting on their own with the current clunky systems? If that's the case, any design needs to consider the non-agile user.</div></div></div></blockquote><div><br></div><div>"Agile" (capital A), short for <a href="https://en.wikipedia.org/wiki/Agile_software_development" target="_blank">Agile software development</a>, is actually a term of art. I'm sorry for having thrown it into the message without context. "<a href="https://en.wikipedia.org/wiki/User_story" target="_blank">User stories</a>" are a lightweight technique in Agile and similar methodologies for capturing requirements, and they go like this:</div><div><br></div><div>"As a (role), I want (some goal) so that (some benefit)."</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>2. <i>With an UMA architecture in mind, we can fairly precisely name what those services/apps/tools might be. </i>I don't know what this means. How does knowledge of UMA architecture allow you to precisely name services/apps/tools? Where can I find that putative list?</div></div></div></blockquote><div><br></div><div>I was observing that several of the SPM list items express requirements that map pretty nicely to the roles and services that UMA makes available. To wit:</div><div><br></div><div><ul style="font-size:12.8px"><li style="margin-left:15px">As the patient, I am the primary steward of my health information <b>wherever it is</b>.</li><li style="margin-left:15px">As the primary steward, I have full access to all of my health information. <font color="#0000ff">Primary steward maps roughly to the UMA resource owner role. ?</font></li><li style="margin-left:15px">As the primary steward, I can determine who has access to which segments of my health information. <font color="#0000ff">The UMA authorization server role in concert with the other roles enables the resource owner to control access.</font></li><li style="margin-left:15px">As the primary steward, I am notified about changes and access by others to my health information. <font color="#0000ff">The UMA protocol alone doesn't (yet?) solve this.</font></li><li style="margin-left:15px">Stewardship of my health information is done through a single tool (web page or application) <b>across my service providers</b>. <font color="#0000ff">The UMA authorization server role presents an opportunity for this centralization (though it doesn't force it). The service providers would be UMA resource servers.</font></li></ul></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>3. I really like the UMA WG exercise format, but I struggle with feeling like I need a dictionary with me for every line. It feels like Pokemon to me. As my grandson says, 'Opa, you just don't get it.' I feel the same way with much of the HEART work. I understand about 25%. I stick with it because I know it's critical and you all have way more expertise than I do. My energy to do the work to understand waxes and wanes.</div></div></div></blockquote><div><br></div><div>That exercise was for a particular purpose in the UMA WG context; didn't mean to derail you here. Treat it as meaning something only for a) Agile aficionados who b) want to see how the UMA protocol sausage was made...</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>4. My barometer is that I need to be able to explain this to my blog readers who include people at the center of care (individuals, care partners, clinicians, direct care and support staff), policy wonks and informatics professionals. I can't do that yet. My sense is that the WG may be missing something if it isn't understandable to an educated (<i>agile?)</i> lay person such as myself. The WG doesn't yet know what it doesn't know about the life flow of the end users / beneficiaries of its work. </div></div></div></blockquote><div><br></div><div>Agreed that implementation for people at the center of care ultimately shouldn't require them to know this level of detail. Protocol specifications and profiles do involve some technical work, but ultimately it should certainly be possible to design "user journeys" and user experiences/interfaces that meet the requirements of these users.</div><div> </div><div><div>The reason, by the way, that user stories are so important is that they put those in the position of <i>designing</i> solutions into the shoes of those <i>requiring</i> those solutions. In the UMA design work, we actually did make changes to our protocol to ensure that certain user experience flows would be possible.</div></div><div><br></div><div>I hope this helps!</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><br></div><div>I'm willing to engage more, but I'll need some help translating.</div></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 13, 2016 at 12:49 PM, Eve Maler <span dir="ltr"><<a href="mailto:eve.maler@forgerock.com" target="_blank">eve.maler@forgerock.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">The SPM list is interesting, and, I think, complementary to and an extension of privacy principles. It's not talking strictly about data and its exposure; it sets up a strong new data stewardship role for a patient, and then defines a relationship between that steward and various putative services/apps/tools out in the world.<div><br></div><div>(With an UMA architecture in mind, we can fairly precisely name what those services/apps/tools might be.)<br><div><br></div><div>These are stated nearly in the form of agile user stories: As the patient, I want to do X, so that I can (benefit in terms of) Y. Once upon a time, the UMA WG partially went through an <a href="http://kantarainitiative.org/confluence/display/uma/User+Stories" target="_blank">exercise</a> like that to assist in our protocol design effort.</div></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">
<p><b>Eve Maler<br></b>ForgeRock Office of the CTO | VP Innovation & Emerging Technology<br>Cell <a href="tel:%2B1%20425.345.6756" value="+14253456756" target="_blank">+1 425.345.6756</a> | Skype: xmlgrrl | Twitter: @xmlgrrl<br><b>ForgeRock Summits and UnSummits</b> <a href="http://summits.forgerock.com/" target="_blank">are coming to</a> <b>Sydney, London, and Paris!</b></p></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Tue, Jul 12, 2016 at 2:51 PM, Adrian Gropper <span dir="ltr"><<a href="mailto:agropper@healthurl.com" target="_blank">agropper@healthurl.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>The Principles of Privacy will only take you so far in the design of a product, service, or HEART. At some point we need to apply Privacy Engineering (<a href="https://ethics.berkeley.edu/privacy/resources/privacy-risk-management-framework-nistir-8062" target="_blank">https://ethics.berkeley.edu/privacy/resources/privacy-risk-management-framework-nistir-8062</a> ) to achieve a particular set of goals. I submit that the SPM bullet points are a reasonable goal for HEART.<br><br></div>A less pedantic way to look at the bullets is simply to see them as the essence of patient-centered design and focus HEART (and UMA) on solving the multiple portals problem. From the patient's perspective, the only way to solve the multiple portals problem is to be able to specify the Authorization Server to every resource server. That means that regardless of whether a resource server happens to be FHIR or whatever RESTful standard my bank exposes for my health savings account or whatever standard some wearable uses to stream my location coordinates, I can register and manage all of these resources from my one chosen AS.<br><br></div><div>If HEART doesn't take this perspective as we design our deliverable, who does?<span><font color="#888888"><br></font></span></div><span><font color="#888888"><div><br></div>Adrian<br><div><div><br> <br></div></div></font></span></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jul 12, 2016 at 4:16 PM, John Moehrke <span dir="ltr"><<a href="mailto:johnmoehrke@gmail.com" target="_blank">johnmoehrke@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">This is fine, but is simply another way of stating the well established Principles of Privacy... right? I like how nicely compact your bullets are. I am just trying to determine if you think you have uncovered something missing....<div><br></div><div>I have a blog where I catalog the various standards on the definition of Privacy -- principles. and cross-reference them </div><div><a href="https://healthcaresecprivacy.blogspot.com/2015/04/privacy-principles.html" target="_blank">https://healthcaresecprivacy.blogspot.com/2015/04/privacy-principles.html</a><br></div><div><br></div><div>John</div></div><div class="gmail_extra"><br clear="all"><div><div data-smartmail="gmail_signature"><div dir="ltr">John Moehrke<br>Principal Engineering Architect: Standards - Interoperability, Privacy, and Security<br>CyberPrivacy – Enabling authorized communications while respecting Privacy<br>M <a href="tel:%2B1%20920-564-2067" value="+19205642067" target="_blank">+1 920-564-2067</a><br><a href="mailto:JohnMoehrke@gmail.com" target="_blank">JohnMoehrke@gmail.com</a><br><a href="https://www.linkedin.com/in/johnmoehrke" target="_blank">https://www.linkedin.com/in/johnmoehrke</a><br><a href="https://healthcaresecprivacy.blogspot.com" target="_blank">https://healthcaresecprivacy.blogspot.com</a><br>"Quis custodiet ipsos custodes?" ("Who watches the watchers?")</div></div></div>
<br><div class="gmail_quote"><div><div>On Sun, Jul 10, 2016 at 11:18 AM, Danny van Leeuwen <span dir="ltr"><<a href="mailto:danny@health-hats.com" target="_blank">danny@health-hats.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div><div>TX Adrian <div><div><span></span><br><br>On Sunday, July 10, 2016, Adrian Gropper <<a href="mailto:agropper@healthurl.com" target="_blank">agropper@healthurl.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Here's what the thread of patients and physicians came up with:<br><ul><li>As the patient, I am the primary steward of my health information <b>wherever it is</b>.</li><span><li>As the primary steward, I have full access to all of my health information.</li><li>As the primary steward, I can determine who has access to which segments of my health information.</li><li>As the primary steward, I am notified about changes and access by others to my health information.</li></span><li>Stewardship of my health information is done through a single tool (web page or application) <b>across my service providers</b>.</li></ul>Adrian<br clear="all"><div><div><br><br><br><br>-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><br><br><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"><br>HELP us fight for the right to control personal health data.</span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"></span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"><br>DONATE:
<a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:rgb(5,99,193)">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:rgb(31,73,125)"></span>
</div></div></div></div></div></div></div></div>
</div></div></div>
</blockquote><br><br></div></div><span><font color="#888888">-- <br><div dir="ltr"><div><div dir="ltr"><font color="#330099">Danny van Leeuwen<br><a href="tel:617-304-4681" value="+16173044681" target="_blank">617-304-4681</a><br></font><div><b><font color="#330099"><br></font></b><div><b><font color="#330099">Blog <a href="http://www.health-hats.com/" target="_blank">www.health-hats.com</a> <i><span style="font-size:8pt;font-family:"Arial Black",sans-serif">discovering the magic levers of best health</span></i></font></b></div></div><div><font face="arial narrow, sans-serif" color="#330099"><span style="font-size:8pt"><a href="https://twitter.com/HealthHats" target="_blank">Twitter</a></span></font></div><div><a href="https://www.linkedin.com/in/healthhatsdannyvl" target="_blank"><font face="arial narrow, sans-serif" size="1">LinkedIn</font></a><br></div></div></div></div><br>
</font></span><br></div></div>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><br>-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><br><br><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"><br>HELP us fight for the right to control personal health data.</span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"></span><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"><br>DONATE:
<a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:rgb(5,99,193)">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:rgb(31,73,125)"></span>
</div></div></div></div></div></div></div></div>
</div>
</div></div><br>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br></div>
<br>_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><font color="#330099">Danny van Leeuwen<br><a href="tel:617-304-4681" value="+16173044681" target="_blank">617-304-4681</a><br></font><div><b><font color="#330099"><br></font></b><div><b><font color="#330099">Blog <a href="http://www.health-hats.com/" target="_blank">www.health-hats.com</a> <i><span style="font-size:8pt;font-family:"Arial Black",sans-serif">discovering the magic levers of best health</span></i></font></b></div></div><div><font color="#330099" face="arial narrow, sans-serif"><span style="font-size:8pt"><a href="https://twitter.com/HealthHats" target="_blank">Twitter</a></span></font></div><div><a href="https://www.linkedin.com/in/healthhatsdannyvl" target="_blank"><font face="arial narrow, sans-serif" size="1">LinkedIn</font></a><br></div></div></div></div></div>
</div>
</div></div></blockquote></div><br></div></div>