201805 GDPR

Track Name

GDPR

Submitting WG/Project/Implementer Group

Security WG

Track Orientation Presentation -- TBD

Justification

The justification for this track is to explore how the FHIR specification and Implementation Guides enable and support compliance with GDPR.

This is a collaborative effort, please sign up to help

Relevant background

Prior Connectathon track 201709 Consumer Centered Data Exchange and 201801 Consumer Centered Data Exchange

• HIMSS presentation on GDPR

Proposed Track Leads

• John Moehrke -Security WG co-chair - JohnMoehrke@gmail.com -- skype JohnMoehrke
• Alex Mense - Security WG co-chair
• Rene Spronk

Expected participants

• John Moehrke (HL7 Security co-chair) SME on FHIR Consent
• http://test.fhir.org/r3

Architectures

All three Architectures involve the following Actors:

Consumer - Gives ceremony instantiating authorization rules for an end-point (Consumer Controlled App in the case of the Consumer Access scenario); designated end-points in the Consumer Initiated Use Case) access to the resource service managed data [Patient who provides their privacy preferences - via the OAuth interaction in the Consumer Access scenario; via the Consent Service in the Consumer Initiated scenario]

Authorization Service (AuthZ) - makes authorization decisions on how an end-point access to specific data at specific Resource Service(s) according to rules (Privacy Preferences indicated by the Consumer)

Resource Service - holds data that is controlled by Consumer's Privacy Preferences (Such as an EMR, an HIE or a Payer)

End-point - the "Application" (including a Consumer App; a 3rd Party end-point indicated by the Consumer such as their PCP's EMR or their Payer's care management team; a Research Repository; etc.) that is given rights to access data on a Resource Service at the direction of the Patient.

The Consumer Initiated Scenario involves the Consent Service actor.

Consent Capture (CC) - a stand alone Service that captures the privacy preferences of the Consumer (which performs a similar function to the SMART OAuth interaction where the consumer indicates their privacy preferences interactively with the Authorization Service)

---

Architecture 1) Consumer Access via OAuth

- A consumer, such as a medicare beneficiary, wishes to authorize the sharing of their health information from a Data Provider, such as CMS, with a consumer controlled app of their choice. The Data Provider wishes to capture audit information to be able to report a complete accounting of disclosure for the consumer.

Action: Consumer Authorizes the sharing of their Health Information with an App of their choice using the SMART OAuth pattern to authenticate

Precondition: Consumer App is registered with the disclosing system (any FHIR based system that holds PHI about the consumer such as an EMR or Payer)

Success Criteria: Without any special effort of the part of the consumer the disclosing system retains all required information to satisfy regulatory and audit requirements

Bonus point: Being able to handle a consumer's rescinding of their authorization to disclose

Description of Transactions

0 – Ceremony where Patient gives rules they want enforced (OAuth Ceremony where Consumer interacts with OAuth flow to convey their sharing preferences)

0’ – Saving of rules into FHIR Consent resource (may be optional in Architecture a? Where is audit trail captured?)

1 – Request by App for authorization to access specific data (scope) at Resource Service (target) resulting in an authorization (token+scope)

2 – Request by App for access to data given the token+scope received in 1

Anchor Connectathon Participant: CMS Blue Button API Team

---

Architecture 2) Consumer Initiated Exchange - sharing 'on behalf of'

- A consumer, such as a patient being treated by a Provider that belongs to a Hospital, wishes to authorize the Hospital to share their health information with other providers attributed to them in the Hospital. Data is shared, on-behalf of the consumer, among the authorized providers at the network without the consumer necessarily receiving a copy of the record themselves. The Hospital wishes to capture audit information to be able to report a complete accounting of disclosure for the consumer.

Action: Via a user friendly interface a consumer captures their privacy preferences in a computable way

Precondition: Data holders are subscribed to the services that enable the capture of the consumer's privacy preferences and can electronically share with end-points indicated by the consumer.

Success Criteria: The designated recipient that the data holder is disclosing to on behalf of the consumer receive all data except that which the consumer's privacy preferences indicate should not be shared it.

Bonus point: Demonstrate how the solution set will allow the recreation of the consumer's privacy preferences at any point in time in the past following one or more changes in preference settings.

Description of Transactions

0 – Ceremony where Consumer interacts with the Consent Service to convey their sharing preferences

0’ – Saving of rules into FHIR Consent resource

1’ – Authorization service uses rules from FHIR Consent resource

1 – Request by App for authorization to access specific data (scope) at Resource Service (target) resulting in an authorization (token+scope)

2 – Request by App for access to data given token+scope

Anchor Connectathon Participant: Kathleen Connors

---

Architecture 3) Consumer Initiated Exchange with Distribution Service

- A consumer, such as a patient being treated by a Provider that belongs to an HIE, wishes to authorize the HIE to share their health information with other providers attributed to them in the HIE. Data is shared, on-behalf of the consumer, between the providers on the network without the consumer necessarily receiving a copy of the record themselves. The HIE wishes to capture audit information to be able to report a complete accounting of disclosure for the consumer.

Action: Via a user friendly interface a consumer captures their privacy preferences in a computable way

Precondition: Data holders are subscribed to the services that enable the capture of the consumer's privacy preferences and can electronically share with end-points indicated by the consumer.

Success Criteria: The designated recipient that the data holder is disclosing to on behalf of the consumer receive all data except that which the consumer's privacy preferences indicate should not be shared it.

Bonus point: Demonstrate how the solution set will allow the recreation of the consumer's privacy preferences at any point in time in the past following one or more changes in preference settings.

Description of Transactions

0 – Ceremony where Consumer interacts with the Consent Service to convey their sharing preferences

0’ – Saving of rules FHIR via Questionnaire\Questionnaire Response into Consent Resource and others (*)

1’ – Authorization service uses rules from FHIR Consent resource

1 – Request by App for authorization to access specific data (scope) at Resource Service (target) resulting in an authorization (token+scope)

2 – Request by App for access to data given token+scope

(*) The provider/organizations/actors that the consumer is authorizing sharing with captured in the consent resource. The Questionnaire and QuestionnaireResponse resources hold all the other data.

Bundle {

       Consent (Defines the Actors, Providers, Orgs, etc for whom the patient is giving consent to)
       Questionnaire (Defines the Questions)
       QuestionnaireResponse (Captures the Question Answers)
      }

Anchor Connectathon Participant: MiHIN

Considerations regarding Commonality of Scopes regardless of Architecture

Although both of the architectures were developed independently with the intent of enabling different objectives both rely on the implementation of clearly defined Scopes.

To date Scopes have been developed independently as driven by the specific project's needs.

From the perspective of a developer, it is important that the behavior of a Scope is known regardless of the architecture as it impacts the requirements of how the application must be developed.

If every data source developed Scopes unique to them an App Developer would have to modify their application to account for the differences among data sources.

It is an objective of this track to ascertain the degree to which a standard set of scopes may be defined and the impact on the underlying standards with regards to differences among Data Source Type (are different scopes required among Payer and Provider systems - are any scopes common among the two?) and to begin the process of expounding on what those scopes may entail based on those being used by participants.

Similarly - with regards to population of the Consent Resource we intend to explore differences if any in how this resource is populated depending on the Architecture being employed.

Prioritization regarding track focus on Consent Resource v. OAuth Scope

FHIR Consent resource exists, and FHIR has Profiling capability

*Profiling of existing FHIR Consent is possible

*Profiling of FHIR Consent helps with those that have needs for creating rules, and patterns of rules

*Profiling of FHIR Consent ties the CC and AuthZ actors in a way that assures that a Consent that is captured can be enforced. And prevents giving the patient a perception that they can have rules that can’t be enforced.

Oauth scope transactions (1, 2) are required regardless of architecture

*Current SMART scopes are only sufficient for PERMIT/DENY

*Any quilted consent requires more capable Oauth scopes

Many multiples more Endpoints and Resource Svrs exist than CC.

*Endpoints and Resource Svrs would be developed to interact in many architectures.

*CC and AuthZ would be paired and specific to policies (patterns) and expectations

Architecture (a) simply groups CC + AuthZ into one system, and thus is not constrained to the complexity or fidelity of the Consent Resource.

Testing Scenarios

Media:2018026_-_Interaction_with_eConsent_Management_Service.docx