This wiki has undergone a migration to Confluence found Here
<meta name="googlebot" content="noindex">

201801 Consumer Centered Data Exchange

From HL7Wiki
Jump to navigation Jump to search


Track Name

Consumer Centered Data Exchange (CCDE)

Submitting WG/Project/Implementer Group

FHIR Project Director, in association with the National Association For Trusted Exchange (NATE)

Justification

The justification for this track is to continue to develop an understanding of what the main specification of the US core IG should say about enabling consumer-centric use case. This will be the second CCDE connectathon. The inaugural connectathon spurred significant interest and participation in San Diego followed by voluminous post-connectathon discussion.

At the first CCDE connectathon in San Diego, there were two architectures predominantly employed.

Those who participated in the consumer access use case utilized the SMART on FHIR Authorization Architecture relying on RESTful API's to transport released data to the consumer’s app -- while those who focused on the Consumer Initiated Exchange Use Case focused on capturing the consumer's privacy preferences in a computable fashion via a FHIR Consent Resource and in subsequent operations utilized “Scopes” to determine what to share based in part on meta-data about the endpoint to which data was being disclosed.

Scopes were a common component of the transactions performed at the connectathon regardless of the Architecture employed by the participant.

The architecture employed for the Consumer Access use case used the Authorization Server to capture the consumer’s preferences and immediately employ correlated scopes to generate the authorization token that is passed back to the consumer. In the Consumer Access use case the end-point is predetermined to be the application of the Consumer's choice.

The architecture employed for the Consumer Initiated Exchange use case uses a separate application to Capture the Consumer Consent. Then, for a given transaction where meta data about the end point of the transaction is fixed (which may be a consumer's app or a third party designated by the consumer), an interaction with the Authorization server generates an authorization token (or a bundle of resources for transport to the end-point) that is specific to the context of the transaction.

As a result – at a higher level of abstraction as it relates to Scopes - the Consumer Access use case may be seen as a subset of the more general case.

From the perspective of a Developer it would be beneficial if the same scopes were employed whenever possible regardless of the architecture that resulted in data being presented. Further, establishing standard "scopes" that could exist across data sources, regardless of use case, would be beneficial to the community.

The goal of this connectathon will be to explore the commonalities between the use cases and determine how the different architectures employed bare on the existing standards in order to begin the elucidation of opportunities to establish standards related to "Scopes" and considerations that may effect resulting standards - if any - such as differences in architecture or Data Source Type (Scopes specific to Payer focused transactions may be different than those related to Medical Record Transactions)

Finally, as the interactions at the first Connectathon illuminated some confusion among the community regarding the capture of an Audit Trail, such as required for example to support the requirements of an accounting of Disclosures and the Consent Resource - we will attempt to establish a consensus regarding what - if anything - the FHIR specifications may have to say about this need today.

Relevant background

Prior Connectathon track 201709 Consumer Centered Data Exchange

email discussion list

Proposed Track Leads

Aaron Seib and John Moerhke

Expected participants

  • NATE
  • John Moehrke (HL7 Security co-chair) SME on FHIR Consent
  • http://test.fhir.org/r3
  • HSS IDEA Lab Authors of the POET specification Mark Scrimshire & Alan Viars

(others: email aaron.seib@nate-trust.org if you are interested in getting involved)

Architectures

Both Architectures involve the following Actors:

Consumer - Gives ceremony instantiating authorization rules for an end-point (Consumer Controlled App in the case of the Consumer Access scenario); designated end-points in the Consumer Initiated Use Case) access to the resource service managed data [Patient who provides their privacy preferences - via the OAuth interaction in the Consumer Access scenario; via the Consent Service in the Consumer Initiated scenario]

Authorization Service (AuthZ) - makes authorization decisions on how an end-point access to specific data at specific Resource Service(s) according to rules (Privacy Preferences indicated by the Consumer)

Resource Service - holds data that is controlled by Consumer's Privacy Preferences (Such as an EMR, an HIE or a Payer)

End-point - the "Application" (including a Consumer App; a 3rd Party end-point indicated by the Consumer such as their PCP's EMR or their Payer's care management team; a Research Repository; etc.) that is given rights to access data on a Resource Service at the direction of the Patient.

The Consumer Initiated Scenario involves the Consent Service actor.

Consent Capture (CC) - a stand alone Service that captures the privacy preferences of the Consumer (which performs a similar function to the SMART OAuth interaction where the consumer indicates their privacy preferences interactively with the Authorization Service)


Architecture 1) Consumer Access via OAuth

- A consumer, such as a medicare beneficiary, wishes to authorize the sharing of their health information from a Data Provider, such as CMS, with a consumer controlled app of their choice. The Data Provider wishes to capture audit information to be able to report a complete accounting of disclosure for the consumer.

Action: Consumer Authorizes the sharing of their Health Information with an App of their choice using the SMART OAuth pattern to authenticate
Precondition: Consumer App is registered with the disclosing system (any FHIR based system that holds PHI about the consumer such as an EMR or Payer)
Success Criteria: Without any special effort of the part of the consumer the disclosing system retains all required information to satisfy regulatory and audit requirements
Bonus point: Being able to handle a consumer's rescinding of their authorization to disclose

Description of Transactions

0 – Ceremony where Patient gives rules they want enforced (OAuth Ceremony where Consumer interacts with OAuth flow to convey their sharing preferences)
0’ – Saving of rules into FHIR Consent resource (may be optional in Architecture a? Where is audit trail captured?)
1 – Request by App for authorization to access specific data (scope) at Resource Service (target) resulting in an authorization (token+scope)
2 – Request by App for access to data given the token+scope in 1


Architecture 1.jpg


Architecture 2) Consumer Initiated Exchange - sharing 'on behalf of'

- A consumer, such as a patient being treated by a Provider that belongs to an HIE, wishes to authorize the HIE to share their health information with other providers attributed to them in the HIE. Data is shared, on-behalf of the consumer, between the providers on the network without the consumer necessarily receiving a copy of the record themselves. The HIE wishes to capture audit information to be able to report a complete accounting of disclosure for the consumer.


Action: Via a user friendly interface a consumer captures their privacy preferences in a computable way
Precondition: Data holders are subscribed to the services that enable the capture of the consumer's privacy preferences and can electronically share with end-points indicated by the consumer.
Success Criteria: The designated recipient that the data holder is disclosing to on behalf of the consumer receive all data except that which the consumer's privacy preferences indicate should not be shared it.
Bonus point: Demonstrate how the solution set will allow the recreation of the consumer's privacy preferences at any point in time in the past following one or more changes in preference settings.

Description of Transactions

0 – Ceremony where Consumer interacts with the Consent Service to convey their sharing preferences
0’ – Saving of rules into FHIR Consent resource
1’ – Authorization service uses rules from FHIR Consent resource
1 – Request by App for authorization to access specific data (scope) at Resource Service (target) resulting in an authorization (token+scope)
2 – Request by App for access to data given token+scope

Architecture 2.jpg

Considerations regarding Commonality of Scopes regardless of Architecture

Although both of the architectures were developed independently with the intent of enabling different objectives both rely on the implementation of clearly defined Scopes.

To date Scopes have been developed independently as driven by the specific project's needs.

From the perspective of a developer, it is important that the behavior of a Scope is known regardless of the architecture as it impacts the requirements of how the application must be developed.

If every data source developed Scopes unique to them an App Developer would have to modify their application to account for the differences among data sources.

It is an objective of this track to ascertain the degree to which a standard set of scopes may be defined and the impact on the underlying standards with regards to differences among Data Source Type (are different scopes required among Payer and Provider systems - are any scopes common among the two?) and to begin the process of expounding on what those scopes may entail based on those being used by participants.

Similarly - with regards to population of the Consent Resource we intend to explore differences if any in how this resource is populated depending on the Architecture being employed.

Prioritization regarding track focus on Consent Resource v. OAuth Scope

FHIR Consent resource exists, and FHIR has Profiling capability

*Profiling of existing FHIR Consent is possible
*Profiling of FHIR Consent helps with those that have needs for creating rules, and patterns of rules
*Profiling of FHIR Consent ties the CC and AuthZ actors in a way that assures that a Consent that is captured can be enforced. And prevents giving the patient a perception that they can have rules that can’t be enforced.

Oauth scope transactions (1, 2) are required regardless of architecture

*Current SMART scopes are only sufficient for PERMIT/DENY
*Any quilted consent requires more capable Oauth scopes

Many multiples more Endpoints and Resource Svrs exist than CC.

*Endpoints and Resource Svrs would be developed to interact in many architectures.
*CC and AuthZ would be paired and specific to policies (patterns) and expectations

Architecture (a) simply groups CC + AuthZ into one system, and thus is not constrained to the complexity or fidelity of the Consent Resource.

Retrieved from "https://wiki.hl7.org/w/index.php?title=201801_Consumer_Centered_Data_Exchange&oldid=149958"