Addressing the Consumer Right of Access for the emerging world of Health APIs. POET works with OAuth2.0 to address this challenge in a scalable way. This presentation was given to the Security work group at the HL7 Workgroup meeting in San Diego, September 2017.

2. @ekivemark
Solving How Consumers
Access their Data
Mark Scrimshire
TransparentHealth.org

3. @ekivemark
<xmlUsed Value="False" />
{“json_used”:True}

4. @ekivemark
My data
should be usable

5. @ekivemark
Information Blocking is
going to get expensive

6. @ekivemark
It is not just your challenge!
Consumers
Data Holders Developers

7. @ekivemark
Everyone can benefit
Consumers
Data Holders Developers

8. @ekivemark
APIs bring solutions and
Challenges

9. @ekivemark
Simply Solving
the Trust Challenge
Policy Technology
Governance

10. @ekivemark
Simply Solving
the Trust Challenge
CARIN Alliance
Policy BluePrint
POET
and
Dynamic OAuth
Registration
Verification Registrar
and
Endorsing Entities

11. @ekivemark
Token
1.Apps get verified
2.Verifier issues app token
3.App presents token to dynamic registration endpoint
4.Data Holder validates token
5.App is given access to API or blocked
6.Consumer uses app and authenticates and authorizes data exchange
National Association for
Trusted Exchange
(Registry)
Verification
Body
Verification
Body
Verification
Body
App
Data
Holder

12. Win-Win-Win
• Developers get verified once (for each token)
• Data Holders have fewer checks to perform on
Consumer Apps
• The Eco System of Verifiers can build a directory of Apps
and Data Holders increasing confidence and
discoverability for consumers

13. Next Steps
• The technology is built (Working Code)
• CARIN Alliance is developing Trust Framework/
Governance blueprint
• Create the Registry and Verification entities
• Identify Launch Communities

14. @ekivemark
poet-ri sample
>verify_jws_with_jwk.py ./4NRB1-0XZABZI9E6-5SM3R.jws poet.jwk
{
"scope": "openid profile patient/*.read",
"initiate_login_uri": "https://apps-dstu2.smarthealthit.org/cardiac-risk/launch.html",
"exp": 1563657181,
"iss": "example.com",
"software_id": "4NRB1-0XZABZI9E6-5SM3R",
"token_endpoint_auth_method": "client_secret_basic",
"client_name": "Cardiac Risk App",
"logo_uri": "https://gallery.smarthealthit.org/img/apps/66.png",
"client_uri": "https://apps-dstu2.smarthealthit.org/cardiac-risk/",
"redirect_uris": [
"https://apps-dstu2.smarthealthit.org/cardiac-risk/"
],
"iat": 1500585181,
"grant_types": [
"authorization_code"
]
}

15. Useful Links
• TransparentHealth.org
• Pre-OAuth Entity Trust API (POET)
https://github.com/TransparentHealth/poet
• POET Reference Implementation (POET-RI)
https://github.com/TransparentHealth/python-poetri
• Contacts:
Mark Scrimshire - mark@ekivemark.com
Alan Viars - aviars@videntity.com