Is TPO Treatment, payment, operations?<span></span><br><br>On Tuesday, August 2, 2016, Adrian Gropper <<a href="mailto:agropper@healthurl.com">agropper@healthurl.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Jeremy, <br><br>Sorry, I should have said HIPAA TPO "consent".<br><br></div>If access to the FHIR resources does not require Alice's authorization and the RS wants to keep Alice in the dark because HIPAA's accounting of disclosures is seldom implemented as well, then HEART is not involved. I would not call the TPO loophole consent except sarcastically.<br><br></div>Adrian<br><div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 2, 2016 at 2:22 PM, Maxwell, Jeremy (OS/OCPO) <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','Jeremy.Maxwell@hhs.gov');" target="_blank">Jeremy.Maxwell@hhs.gov</a>></span> wrote:<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">
<div lang="EN-US">
<div>
<p><span style="font-size:11pt;font-family:"calibri","sans-serif";color:rgb(31,73,125)">Also, want to clarify what “typical of HIPAA TPO consent” means? TPO is a permitted use under HIPAA that does not require consent.<u></u><u></u></span></p>
<p><span style="font-size:11pt;font-family:"calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p><span style="font-size:11pt;font-family:"calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p><span style="font-size:11pt;font-family:"calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p><b><span style="font-size:10pt;font-family:"tahoma","sans-serif"">From:</span></b><span style="font-size:10pt;font-family:"tahoma","sans-serif""> Openid-specs-heart [mailto:<a href="javascript:_e(%7B%7D,'cvml','openid-specs-heart-bounces@lists.openid.net');" target="_blank">openid-specs-heart-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Debbie Bucci<br>
<b>Sent:</b> Tuesday, August 02, 2016 2:17 PM<br>
<b>To:</b> Adrian Gropper<span><br>
<b>Cc:</b> <a href="javascript:_e(%7B%7D,'cvml','openid-specs-heart@lists.openid.net');" target="_blank">openid-specs-heart@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-heart] Alice's health resource set<u></u><u></u></span></span></p>
<p><u></u> <u></u></p>
<div>
<div>
<p>Lost me again Adrian - <u></u><u></u></p>
</div><div><div>
<div>
<div>
<p> <u></u><u></u></p>
</div>
</div>
<blockquote style="margin-top:5pt;margin-right:0in;margin-bottom:5pt">
<div>
<p>We should also not ignore the Client-to-AS first flow. This is the preferred flow from a privacy engineering perspective. (see other thread with Justin). In the majority of cases of HIE, the Client has a relationship with Alice already
(<span style="background:yellow none repeat scroll 0% 0%">this is typical of HIPAA TPO consent</span>) or the Client has found Alice via a "Relationship Locator Service" which is a directory operated by the state or some private entity like CommonWell. When the
Client matches with Alice in the RLS, does the RLS return a list of RSs or a pointer to Alice's AS?<u></u><u></u></p>
</div>
<div>
<div>
<p> <u></u><u></u></p>
</div>
</div>
<div>
<p>The most privacy-preserving thing would be for RLSs to return pointers to Alice's AS and in the future this is what Alice might insist on if she is still given a choice to opt-in or opt-out of HIE. Alice does have that choice today in the
US. In other countries, not-so-much.<u></u><u></u></p>
</div>
</blockquote>
<div>
<p> <u></u><u></u></p>
</div>
<div>
<p> Are you suggesting the AS is some sort of proxy for all data - I don't think you were saying that. At some point the Client would need a relationship with the RS as well - correct? Is the Client to AS flow a separate spec? Would you
please provide the link? Looking at UMA 1.01 - client needs a permission ticket first - that is generated from AS - to RS to client (?)<u></u><u></u></p>
</div>
<div>
<p><u></u> <u></u></p>
</div>
<div>
<div>
<p> <u></u><u></u></p>
</div>
</div>
<div>
<p><u></u> <u></u></p>
</div>
<div>
<div>
<p> <u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
</div>
</blockquote></div><br><br clear="all"><br>-- <br><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr">Adrian Gropper MD<span style="font-size:11pt"></span><br><br><span style="font-family:"arial",sans-serif;color:rgb(31,73,125)">PROTECT YOUR FUTURE - RESTORE Health Privacy!</span><span style="font-family:"arial",sans-serif;color:rgb(31,73,125)"><br>HELP us fight for the right to control personal health data.</span><span style="font-family:"arial",sans-serif;color:rgb(31,73,125)"></span><span style="font-family:"arial",sans-serif;color:rgb(31,73,125)"><br>DONATE:
<a href="http://patientprivacyrights.org/donate-2/" target="_blank"><span style="color:rgb(5,99,193)">http://patientprivacyrights.org/donate-2/</span></a></span><span style="color:rgb(31,73,125)"></span>
</div></div></div></div></div></div></div></div>
</div></div></div></div></div>
</blockquote><br><br>-- <br>Danny van Leeuwen <br>617-304-4681<br>Blog: <a href="http://www.health-hats.com">www.health-hats.com</a> Twitter: @healthhats<br>