<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.gmailmsg1, li.gmailmsg1, div.gmailmsg1
{mso-style-name:gmail_msg1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.gmailmsg
{mso-style-name:gmail_msg;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;
font-weight:normal;
font-style:normal;}
span.EmailStyle21
{mso-style-type:personal-reply;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:black">Here are some suggested answers (some partial), in
</span><span style="color:#00B050">green</span><span style="color:black">:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal">Q1 - do we need to profile standard friendly names for resources?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#00B050">No. This is a “may” pre-condition, i.e., that the UX may map friendly names to underlying data element names. The use of the underlying data element names, e.g., those within FHIR resources,
are mandated by standards outside the scope of HEART.<br>
<br>
We should, though, note that mappings must provide appropriate values for data that are not exposed via the UX, e.g., code-system references for medications and problems. This may include natural language processing to make good guesses, e.g., translating
patient friendly terms for conditions to SNOMED or ICD10, converting LOINC to user-friendly terms, interpreting lab results to low-normal-high ranges, indicating authoritative vs. anecdotal data.<o:p></o:p></span></p>
<p class="MsoNormal"><br>
Q2 - <b><i><span style="color:#1F497D">[NSL] </span></i></b><span style="color:#1F497D">Do we want to profile a notification protocol to notify Dr. Erica?<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#00B050">No. Provide a URI, which states the notification protocol, e.g.,
<a href="mailto:gfm@securityrs.com"><span style="color:#00B050">mailto:gfm@securityrs.com</span></a>. The detail for using the protocol is specified in standards outside of HEART’s scope.<o:p></o:p></span></p>
<p class="MsoNormal"><br>
Q3 - do we need to profile patient metadata obfuscation methods?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#00B050">No. There are existing guidelines for this. See
<a href="https://www.ihe.net/uploadedFiles/Documents/ITI/IHE_ITI_Handbook_De-Identification_Rev1.1_2014-06-06.pdf">
<span style="color:#00B050">https://www.ihe.net/uploadedFiles/Documents/ITI/IHE_ITI_Handbook_De-Identification_Rev1.1_2014-06-06.pdf</span></a>, also
<a href="http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=42807&commid=54960">
<span style="font-size:10.5pt;font-family:"Helvetica",sans-serif;color:#00B050;border:none windowtext 1.0pt;padding:0in;text-decoration:none">ISO/TS 25237:2008</span></a> standard. Do not re-invent this wheel.<o:p></o:p></span></p>
<p class="MsoNormal"><br>
Q4 - are there any ways to verify claims other than A, B, C? (A=AS verified, B=RS verified, C=federation verified)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#00B050">Yes. Reference standards-based work done by the HL7 Security Workgroup and others. Creating another coding system value-set is not helpful and does not cover the semantic spectrum.
I think the details are outside HEART’s scope.<o:p></o:p></span></p>
<p class="MsoNormal"><br>
Q5 - <b><i><span style="color:#1F497D">[NSL] </span></i></b><span style="color:#1F497D">Can we elevate permissions through claims?<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#00B050">Maybe, but there are preconditions that need to be specified. I think the details are outside HEART’s scope.<o:p></o:p></span></p>
<p class="MsoNormal"><br>
Q6 - do we need to profile the semantics for claims?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in">No. <span style="color:#00B050">Reference standards-based work done by the HL7 Security Workgroup and others. I think the details are outside HEART’s scope.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Glen F. Marshall<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Consultant<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Security Risk Solutions, Inc.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">698 Fishermans Bend<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Mount Pleasant, SC 29464<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Tel: (610) 644-2452
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Mobile: (610) 613-3084<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">gfm@securityrs.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black"><a href="http://www.securityrisksolutions.com/"><span style="color:#0563C1">www.SecurityRiskSolutions.com</span></a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-heart [mailto:openid-specs-heart-bounces@lists.openid.net]
<b>On Behalf Of </b>Nancy Lush<br>
<b>Sent:</b> Monday, November 28, 2016 18:32<br>
<b>To:</b> 'Adrian Gropper' <agropper@healthurl.com>; 'HEART List' <openid-specs-heart@lists.openid.net>; 'Sarah Squire' <sarah@engageidentity.com><br>
<b>Subject:</b> Re: [Openid-specs-heart] Draft HEART Meeting Notes 2016-11-28<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:#1F497D">Adrian, I added inline.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:#1F497D">-Nancy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-heart [<a href="mailto:openid-specs-heart-bounces@lists.openid.net">mailto:openid-specs-heart-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Adrian Gropper<br>
<b>Sent:</b> Monday, November 28, 2016 5:14 PM<br>
<b>To:</b> HEART List <<a href="mailto:openid-specs-heart@lists.openid.net">openid-specs-heart@lists.openid.net</a>>; Sarah Squire <<a href="mailto:sarah@engageidentity.com">sarah@engageidentity.com</a>><br>
<b>Subject:</b> Re: [Openid-specs-heart] Draft HEART Meeting Notes 2016-11-28<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I wasn't taking notes but I found the structiring of the work in terms of Q1-6 very helpful.<br>
<br>
Q1 - do we need to profile standard friendly names for resources?<br>
Q2 - <b><i><span style="color:#1F497D">[NSL] </span></i></b><span style="color:#1F497D">Do we want to profile a notification protocol to notify Dr. Erica?</span><br>
Q3 - do we need to profile patient metadata obfuscation methods?<br>
Q4 - are there any ways to verify claims other than A, B, C? (A=AS verified, B=RS verified, C=federation verified)<br>
Q5 - <b><i><span style="color:#1F497D">[NSL] </span></i></b><span style="color:#1F497D">Can we elevate permissions through claims?</span><br>
Q6 - do we need to profile the semantics for claims?<br>
<br>
Can anyone remember Q2 and Q5?<br>
<br>
Adrian<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Nov 28, 2016 at 5:00 PM Sarah Squire <<a href="mailto:sarah@engageidentity.com">sarah@engageidentity.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Light notes this week since we mostly walked through the use case that Eve and Nancy have been working
on which will be sent out to the list shortly.</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Attending:</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Debbie Bucci</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Adrian Gropper</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Celestin Bitjonck</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Edmund Jay</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Eve Maler</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Glen Marshall</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Jim Kragh</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Jin Wen</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Luis Maas</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Nancy Lush</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Sarah Squire</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Scott Shorter</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Thomas Sullivan</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Walter Kirk</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Eve:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">We’ve been winnowing down the resources we think people should focus on. We want to help people think
with the lens of UMA. We might want to profile what normal people would say in natural English. So “medicines I take” might be friendlier than “current medications”</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Adrian:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">So we’re saying that our goal is that two RSs would describe the same words to describe a resource?</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Eve:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">We should decide whether or not to standardize that.</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Glen:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Well, this might not be as straightforward as you might think to map these to FHIR resources.</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Adrian:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Is it allowed for a server to list the FHIR resource itself? Rather than the friendly name?</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Eve:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">So we need to decide whether we want friendly names at all, and then whether we want to suggest or
require them. We have a use case for proactive Alice sharing including notifications.</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Nancy:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Is it okay to notify the client what Alice’s patient ID is? If the FHIR interface knows it and sends
it over the wire, then the client should be able to know it and send it over the wire.</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Adrian:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Why do we need a patient ID?</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Eve:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">All we really need is the resource endpoint, we don’t need Alice’s patient ID. You can notify Dr.
Erica with knowledge of that endpoint. We probably want the client to pass all the trust elevation tests before it can see the URL with a patient ID in it. We don’t want a patient id in the clear.</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Nancy:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">We really tried to make this as simple as possible.</span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Eve:</span></span><o:p></o:p></p>
<p class="gmailmsg1" style="margin:0in;margin-bottom:.0001pt"><span class="gmailmsg"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">We’re trying to replicate what Google has already done with document sharing in a loosely coupled
protocol. </span></span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="color:#888888">Sarah Squire<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888">Engage Identity<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#888888"><a href="http://engageidentity.com/" target="_blank"><span style="color:#1155CC">http://engageidentity.com</span></a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-heart mailing list<br>
<a href="mailto:Openid-specs-heart@lists.openid.net" target="_blank">Openid-specs-heart@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-heart" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-heart</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>