<div dir="ltr">Sanjay,<div><br></div><div>In the general case, the FHIR / OAuth API is under the control of an Authorization Server. The AS controls access to patient-level resources that would cover both 1. and 2. in your case.</div><div><br></div><div>Please consider joining the HEART workgroup <a href="http://openid.net/wg/heart/">http://openid.net/wg/heart/</a> where we're doing the profiling work for using FHIR / OAuth in this automated, yet patient-centered way even when, as you say, the patient is not interested in their own health records.</div><div><br></div><div>Adrian</div><div><br></div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Mar 26, 2017 at 3:04 PM, Michele Mottini <span dir="ltr"><<a href="mailto:mimo@careevolution.com" target="_blank">mimo@careevolution.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="gmail-"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><br></div><div>1. How do smart medical devices get authorization to upload vitals to the FHIR database i.e. how do they get the authority to upload vitals.<br></div></div></blockquote><div><br></div></span><div>I'd say using back-end authorization - <a href="http://docs.smarthealthit.org/authorization/backend-services/" target="_blank">http://docs.smarthealthit.<wbr>org/authorization/backend-<wbr>services/</a>, although this does not seem to be widely implemented</div><span class="gmail-"><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div></div><div>2. How do the clinicians get authority to a access the EHR for the patients.</div><div><br></div></div></blockquote><div><br></div></span><div>Once the data is in the EHR as port of the patient data clinicians that have login credentials for the EHR and the necessary permissions can access it - it is no longer a matter for FHIR / SMART</div><div><br></div><div> - Michele</div><div> CareEvolution Inc</div><div><br></div></div></div></div></blockquote><br class="gmail-Apple-interchange-newline"><table cellpadding="0" class="gmail-cf gmail-gJ" style="font-size:12.8px"><tbody><tr class="gmail-acZ"><td class="gmail-gF gmail-gK" style="width:541px"><table cellpadding="0" class="gmail-cf gmail-ix" style="width:541px"><tbody><tr><td><h3 class="gmail-iw"><span name="Safety Labs Inc" class="gmail-gD" style="font-size:12.8px">Safety Labs Inc</span> <span class="gmail-go"><span><</span><a href="mailto:sanjaychadha79@gmail.com">sanjaychadha79@gmail.com</a> wrote:</span></h3></td></tr></tbody></table></td></tr></tbody></table><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div></div></div></div></div><div class="gmail-HOEnZb"><div class="gmail-h5">
<p></p><div dir="ltr" style="color:rgb(34,34,34);font-size:12.8px">FHIR OAuth2 authorization seems to cover the scenario where the patient wants to access her EHR. In this case the user is prompted for her credentials and after credentials are confirmed the authorization is given to the application.<br><div><br></div><div>The above scenario is for healthy and savvy users. Our clients are critically ill, on their beds or are not able to or interested in their own health records. </div><div>Our smart medical devices measure their vitals and on their behalf would like to update in their EHR. It is to be assumed that one time permission is given at setup time to upload the vitals.</div><div><br></div><div>Once these vitals are uploaded, the clinicians are interested in the vital data (and not the patient). How do the clinicians get authorization to access to their patents EHR data. Clinicians are authorized at one time at setup to access the EHR of a patient.</div><div><br></div><div>Following two pieces of information seems to be missing:</div><div>1. How do smart medical devices get authorization to upload vitals to the FHIR database i.e. how do they get the authority to upload vitals.</div><div>2. How do the clinicians get authority to a access the EHR for the patients.</div><div><br></div><div>These two scenarios are different than when a patient would like to view her own EHR information.</div><div><br></div><div>Thank you in advance.</div></div><div class="gmail-yj6qo gmail-ajU" style="color:rgb(34,34,34);font-size:12.8px"><div id="gmail-:9dj" class="gmail-ajR" tabindex="0"><img class="gmail-ajT" src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif" style="opacity: 0.3;"></div></div></div></div></blockquote></div>
</div></div>