Showing posts with label ABBI. Show all posts
Showing posts with label ABBI. Show all posts

Sunday, July 7, 2013

Is your Doctor good at their Job?

It started with a simple tweet, as some of my better posts topics do:

If you read through the whole thread, you'll understand the title of this post.

Here's the point.  Until patients judge healthcare providers by the non-medical things they do, most providers will just continue to give us the same kinds of service they always have.  Paper forms, crazy bills that we can't understand, lousy communications, et cetera.

We put up with those things because the providers are "good at their job."  But are they really?  Isn't customer service part of their job?  We all complain in one breath about how the system needs to change, but how many of us have ever changed doctors because we couldn't get our data easily?  There are providers that have the capability and use it, and there are many others that don't, and there are some, like my own, who are working on it, but still aren't there yet.

How do we make physicians understand that making our data available to us is a critical part of their job?  The easy answer is to pick physicians and hospitals that do.  But that is not so easy now is it.  Do you really want to give up the doctor that you have a 20-year relationship with?  I know I don't.  Do you even have those choices?  I do to some degree because of where I live, but not everyone else does.

One of the intentions behind Blue Button+ is to change that.  But making technology available is only the first step.  And while @CLOUDHealth and I might argue about the shape that technology takes, I don't think he'll argue that it takes more than the availability of appropriate technology to change society.  It has to be used.

In the The Forever Hero Series, L.E. Modessitt's main character Gerswin discovers that it isn't just the development of appropriate technology that is necessary, it has to be used by, and demanded by the common man before change can occur.  The BestMeat plant that his institute funds the development of fails to change society until Gerswin starts sharing the fruits of that plant with others.  This is where S&I Framework stands today.  We have developed some of the appropriate technology, but we need to get the word out, and create the demand for it.

That is one of the key messages from the Patient Access Summit II.  As I summarized it: More needs to be done to raise awareness among patients, providers and health IT vendors about patient rights and technology available to access data, and Blue Button Plus alignment with Meaningful Use incentive programs.

But of course, if we expect ONC to make that change happen, we'll still be waiting for it.  The government is not well known for their marketing prowess.  I'm a patient and a technologist, not a marketer. I don't know how to do this, or what it would cost to get the word out.  But I know that's the next step.  I think we need to spin up a simple yet viral marketing campaign to make patients aware that a) they have a right to their data, and b) they should ask for it.

I can teach that to an eight-year-old, why is it so hard with adults?

Thursday, March 28, 2013

Getting Close = Jinxed Myself

I think we are starting to reach closure on the ABBI PULL Initiative.  I finally got my editing done on the OAuth Workflows and API documentation.  There's a bit more work to be done in the next week.  One of the outstanding challenges is in figuring out how to bind an authorization to a specific patient in both the client application and at the data holder.

It is a pretty easy problem to solve in the if we make the Authorization end-point return a bearer token that is a JWT that contains the authenticated identity of the end-user, plus some other stuff.  Another way would be to communicate between the authorization end-point and the data-holder in some way that is unspecified [I don't like that idea].

More challenging is the case where the same identity can be used to access data about multiple patients, as in the case where I get data about my children and myself.  In this particular case, I think the right answer is to use the scope parameter of the authorization grant in order to communicate to the authorization endpoint who the authorization is for.  When it grants the request, the authorization endpoint can encode the scope in the bearer token, OR communicate it to the data holder in some way that is unspecified [again, I don't like that idea].

The scope token need not be complicated.  It, in combination with the authenticated user identity must uniquely identity the patient whose data is being accessed, but when appearing alone need not do so.  This operates under the assumption that the identity being used to authorize use is provided to the data holder in some way.

The truly critical challenge will be for application developers.  They should take steps to ensure that data from different data holders for different patients isn't mistakenly combined.  In other words, the app shouldn't combine data of my youngest daughter (from her pediatrician) with that of my wife from her ob/gyn, even though they have the same first and last name.

Hmm, that step is going to require both some critical thinking, and a risk assessment.  Oh well, close is never the same as done.


Wednesday, March 20, 2013

The Journey of 4000 Miles could have been 20

I don't know which is more amazing, that I may actually come back from Italy with a solution that may work to solve my million registration problem (which could just be a 10,000), that I had to travel 4000 miles to talk to a person who lives just 20 miles from my house (I've already walked that far this last week), or that the solution I may have coming out of an IHE meeting is clearly out of IHE's scope for its profile of OAuth 2.0 in IUA, even though it aligns quite well with other IHE profiles for security and privacy (I may write a post about that later).

Here's the solution in a nutshell:

  1. Application Developers obtain a certificate that enables them to sign other certificates.
  2. Application instances obtain (are provisioned with during or after installation) a certificate signed by the application developer.
  3. Application instances provide an attestation of their instance identity that is signed by the application instance's certificate in a normal authorization workflow that does not require a separate registration.

The authorization endpoint can verify the identity asserted by the application instance by verifying the signature of the identify assertion and the certificate chain. If an application instance misbehaves at some point, the authorization endpoint can be configured to reject the identity of that application instance, locking out only one installation. If a pattern of behavior appears where many instances of an application misbehave, the application developers certificate can be blacklisted, preventing any instance of that application from being authorized.

This is the level of security that has been deemed to be suitable for the ABBI PULL protocol. It allows a single bad actor to be rejected, and also allows all applications from a particular developer to also be rejected if deemed necessary.

The Direct protocol as specified by ONC already has a mechanism to white-list certificates through the Trust Bundle. The trust bundle is the collection of certificates that are considered to be trusted. A certificate chain is considered to be trusted if during the verification process, the certificate at the root of the trust chain (or earlier) appears in the trust bundle. This very same mechanism can be used by ABBI PULL to establish the chain of trust for certificates. It could be the same trust bundle as is used for the Direct trust bundle, but there are probably good reasons to keep these two bundles separate.

I was pretty close a while back, when I suggested that the application instance be provided with a signed identity assertion. What changes is that it is provided not with a signed identity assertion, but rather a signed certificate, which is nothing more than an signed identity assertion with the addition of a public and private key.

This is why I don't claim to be a security expert. I can understand this stuff when it is explained to me by experts, but couldn't have devised this on my own. Rob Horn (co-chair for IHE IT Infrastructure) was the person who did explain it to me, but he didn't invent the idea. It's the same mechanism used to sign Linux distributions from various suppliers.

The only difference in what I previously proposed (using a signed identity assertion), is in which certificate is used to sign the identity assertion. In this case, the certificate used is the certificate that the application instance is configured with. How this configuration is performed is completely under the control of the application developer, and becomes outside of the scope of the ABBI PULL specification.

The key to proving out this solution is whether I can make it work with existing OAuth 2.0 libraries, using signed identity assertions.

For what it's worth, the act of the authorization endpoint of verifying the signature on the asserted application identity is essentially the same as authenticating the installed application. So even when the implicit grant type is used, the application identity could still authenticated by the authorization endpoint.

Strengths:

  1. Reuse of existing "Trust Bundle" mechanism to support identification of "trusted" applications instead of trusted Direct addresses.
  2. Addition of client authentication even in implicit grant flows (by virtue of verifying signatures on the asserted identity).
  3. Simplifies Authorization endpoint responsibilities since they no longer have to be identity providers for applications, but can rather defer application identity management and provisioning to application developers, and use the signed identity assertions and a trust bundle to manage client authentication.

Weaknesses:

  1. Unproven with existing OAuth 2.0 libraries currently available.
  2. Doesn't follow the common used patterns for Twitter, Facebook or Google for OAuth 2.0.
  3. Use of an unproven and likely to be changed IETF Draft for JWT Bearer Tokens.

For a pilot, the IETF work seems to be close enough.  I'm not terrible worried about weakness #2, since that can be addressed by adequate developer documentation.  Also, when you are Google, Facebook or Twitter, conforming to what others do isn't necessarily part of your business model or concern.

That leaves weakness #1, which means I may have my work cut out for me. I just have to find a few OAuth 2.0 libraries to play with. Any thoughts on which ones I should look at (Java/JavaScript only please)?

As always, feel free to poke holes and deflate my currently inflated sense of accomplishment.

   -- Keith

P.S.  In trade for this solution, Rob got my entire text from the ABBI work on OAuth 2.0, in the hopes that he, as editor of IHE's IUA profile will find it useful.  In this, I hope that what IHE emerges with, and what ABBI starts with, eventually wind up in the same exact place, the IHE IUA  profile of OAuth 2.0.

Wednesday, March 13, 2013

Navigating Standards and Regulation

Compare four different use cases with me:

From an IHE IUA (Internet User Authentication a.k.a. OAuth) profile discussion: to authorize the patient's application to access health information.

From the ABBI Charter: Allowing a third party application of the consumer’s choosing to privately and securely access personal health data on demand.

From the Omnibus Final Rule:
if requested by an individual, a covered entity must transmit the copy of protected health information directly to another person designated by the individual. In contrast to other requests under § 164.524, when an individual directs the covered entity to send the copy of protected health information to another designated person, the request must be made in writing, signed by the individual, and clearly identify the designated person and where to send the copy of the protected health information.

From the HITECH Act (see subsection (e) at the top of page 7748):
the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific;

In each of the above: individual, patient, consumer also includes in some way their authorized representative, although that may be variously defined (e.g., parent, guardian, holder of a power of attorney, et cetera) and implemented, and may be stated or implied in the use case.

In each use case, we talk about authorizing an application, in others, an entity, and in others, designated person as the recipient of the electronic information.

In the IHE use case I described above (which is really just one example of many similar use cases), it mentions the "patient's application", as if we are discussing an application the patient owns (or licenses).  But in the IHE profile, that could also be an application developed by a third party that the consumer authorizes.  I can see uses where a patient could use this same capability to authorize an application devised by the SSA to access data on a to enable adjudication of disability for example.

In the Omnibus Final Rule, it clearly states: the request must be made in writing, signed by the individual, and clearly identify the designated person 
However, I would note, that writing does not mean "printed on paper", signed by the individual can be represented by some form of electronic signature, and clearly identifying a designated person need not mean "by name", but could also be by role (e.g., privacy officer, licensed healthcare provider, et cetera).

By paying attention, one can navigate all of these use cases to produce one common solution that meets the needs for all of them.  But it truly isn't easy.  Welcome to my world.


Friday, February 8, 2013

ABBI - The Pitch

When developing a standard, there are two audiences you have to pitch it to: The developers who will use it, and the organizations that are making decisions about whether or not they are going to implement it.  I've spent quite a bit of time talking to the former, but not enough to the latter.

Assumptions

First of all, I'm going to assume that you already know a little bit about Meaningful Use, and the Nationwide Health Information Network (NwHIN), and maybe the fact that there are two standards for exchange specified for the NwHIN: Direct and Exchange.  Direct is the simplified on-ramp using e-mail, and NwHIN Exchange is a bit heavier, but also widely deployed set of standards used to support communication of healthcare data between Federal agencies and mostly larger healthcare provider systems.

A Quick Overview

What is ABBI?
ABBI stands for Automate the Blue Button Initiative.  The project came out of a White House sponsored meeting which both I and my 14-year-old daughter (named Abby) attended.  The point of this project is to develop a technology (actually a set of standards that technology can be developed to implement) that will enable patients to set up a way to get their healthcare data once, and it will simply happen.

What kind of Healthcare data?
The same data that is required to be given to patients in the same electronic format as is specified under the View, Download and Transmit requirements of Meaningful Use Stage 2, using the exact same standards.  Plus, any additional documents a provider wants to make available through the API.

I've got enough to deal with for Meaningful Use Stage 2, why do I need ABBI?
One of the key goals of the ABBI project is that providers could use these specifications to meet the View/Download/Transmit requirements of Meaningful Use.  A patient who downloaded their documents using an application supporting the ABBI API, would qualify in the numerator of patients who have used the View/Download/Transmit capability of the Certified EHR.

How does it work?

The way that it works is pretty straightforward (although many of the details still need to be ironed out).  Here are the essentials:

  1. Patient obtain Application(s)
    Patient obtains or is provided access to an application that will facilitate communication of patient data to them.  This could be a portal, a PHR, a cloud-based repository of health information (e.g., Health Vault), or an application running on a laptop, tablet or smart phone, or an NwHIN Direct address.
  2. Agree on the patient identity
    The patient supplies an identity to their healthcare provider, that the provider can be used to securely identify them.  This could be an NwHIN Direct address, a username/password combination, or any number of commonly available identities on the Internet by which the patient will identify themselves.  The provider authorizes the patient identity to access the data within their system.
At this stage, the choices bifurcate, depending on whether the patient data is being pushed to or pulled by their application.

Push Model

The push model utilizes NwHIN Direct.  The provider's EHR communicates to the patient by sending NwHIN Direct messages whenever new information is available:
  1. Provider's EHR is configured to "push" patient data to the selected NwHIN Direct address.
  2. As new encounters occur, the encounter summary is pushed to the patient's NwHIN Direct address.

Pull Model

The pull model utilizes the ABBI Pull specifications, which are based on RESTful specifications developed using the HL7 FHIR protocol, and which can work with the NwHIN Exchange specifications.
  1. Patient authorizes "subscriptions" to that data by the application described above (using OAuth 2.0).
  2. As new encounters occur, the encounter summary is made available in the EHR (e.g., through the patient portal).
  3. Application requests (from the EHR/portal) either the current "Patient Summary", or a list of current documents available for the patient, and downloads those documents as needed via the authorized "subscription".

Security

All communications in either model are encrypted using web encryption standards, and the patient identity is assured through other web security standards (e.g., S/MIME or OAuth 2.0).  For push, ABBI uses NwHIN Direct, and thus uses S/MIME and TLS to secure and encrypt communications.

For PULL, the ABBI efforts are being coordinated with other efforts in the Internet Engineering Task Force (IETF), and with Integrating the Healthcare Enterprise's Internet User Authentication profile currently under development, in order to establish a secure way for patients to authorize applications to access their health data.

Standards

The ABBI Protocol is being implemented in Open Source for the Pull Model described above, and is hosted in Google Code.  A test server has been created and is hosted in the cloud (it may be down from time to time).

The basics of the ABBI PULL Protocol make use of the HL7 FHIR xdsentry resource.  FHIR is a new RESTful standard being developed by HL7 that supports simple XML and JSON representations of healthcare data.  This same work is being considered as the basis for other Healthcare standards efforts, including IHE's Mobile Access to Health Documents profile.
The advantage of using this standard is that it is closely aligned with other standards (IHE's XDM and XDR used in NwHIN Direct, and XCA used in the NwHIN Exchange specification, and supported by the CONNECT Open Source project.

As FHIR evolves, it expects to produce clinical resource specifications that would support access to fine-grained patient data, including problems, medications, allergies, immunizations, lab results, vital signs, et cetera.  By starting with the FHIR infrastructure resources for documents, we enable access to existing health data in CDA documents, while paving the way for future, targeted access to patient data in later phases.  This data could be packaged together in document form (as is done today with the CDA standard), or used in other services.

Finally, FHIR provides a mechanism for patients and providers to store data as well.

A Last Word from Abby, on ABBI


Saturday, February 2, 2013

OAuth 2.0 Headaches for ABBI

Now I understand why Eran Hammer wrote OAuth 2.0 and the Road to Hell.  I've been playing around with how to address client registration issues.  Right now, I have the following open in my browser:

  1. JSON Web Signature (JWS) [IETF Draft 4]
  2. JSON Web Token (JWT) [IETF Draft 6]
  3. JSON Web Token (JWT) Bearer Token Profiles for OAuth 2.0 [IETF Draft 4]
  4. JSON Web Algorithms (JWA) [IETF Draft 8]
  5. Assertion Framework for OAuth 2.0 [IETF Draft 8]
  6. The OAuth 2.0 Authorization Framework [RFC 6749]

Does this sound vaguely familiar?  Recall these seven: MU Stage 1, HITSP C32, C80, C83, IHE XPHR, HL7 CCD, HL7 CDA

Here's the break down:
OAuth 2.0 is being used to support capturing the authorization of the patient [or authorized representative] to allow a client application instance to access PHI on the patient's behalf.   The Assertion Framework for OAuth 2.0 specifies the parameters that tell how the client assertion of its identity is being exchanged in the OAuth 2.0 protocol.  JWT Bearer token profiles describes how a JWT bearer token is constructed for OAuth 2.0 for client identity and other uses.  JWS explains how a signed JWT is exchanged.  JWA indicates the algorithms that are used in JWS. And two of these don't yet agree on whether the key for who the principal is "prn" or "sub", or perhaps I don't understand the distinctions being made.


You'll note that NOT listed above is the OAuth Dynamic Client Registration Protocol [IETF Draft 04].  That's because I traded one problem [Dynamic Registration], for five others [to support a signed assertion of client identity] .  I'm not sure it was a good trade, but I'm going to plug away at this anyway.


I think we need to develop the Joined JSON Profile for OAuth 2.0 Web Authorization, which I'm going to call J-JWA, as a pun on C-CDA.  The biggest challenge for me in all of this is that with the exception of the OAuth 2.0 Framework, the rest of these are in draft form.  However, maybe we can address it in J-JWA, and we'll never have to go down that path we've been through before.

-- Keith


Tuesday, January 22, 2013

Recovering from the HL7WGM, and back to ABBI

It may not be apparent, but I'm an introvert by nature.  I prefer to spend my time thinking, writing, and reading, rather than interacting with a lot of people directly at the same time.  Last week was one of the busiest HL7 Working Group meetings I've attended in the last few years.  Every quarter was filled with something that either I wanted to be present for, or for which my presence was requested (due to how I voted on a committee's ballot).  Add to that the all-day board meeting, a day full of teaching, and a day for the FHIR connectathon, and you have a completely exhausting week.  The meetings, connectathon, and teaching all went well, which made it even more exhausting.  I took the day off yesterday (Martin Luther King/Inauguration Day) and spent some time recovering with my family.

My brain is still burning with all the discussions from the last week.  I thought I'd spend this morning knocking one off my list, which is the ABBI PULL security model using OAuth 2.0.  I spent some time with John Moehrke over lunch and breaks talking about it, and we think we've worked out the key details.

Software Deployment Models

There are four different deployment models for software using the ABBI PULL API that I can imagine, each with their own security concerns:
  1. Running in a Web Server
  2. Embedded in a Device
  3. Installed Natively on a Computer or Device
  4. Running in a Web Browser
I'm going to look at each of these separately, and the same provisions of my last post apply:  Slap me if I get it wrong.

Running in a Web Server

The first two are probably the easiest to address.  With the first, you have a limited number of instances of the software, (typically) controlled by the software developer.  For these applications, the website running the software can be secured from inspection by the end-user, as can its secrets.  These applications can use dynamic registration pretty easily.  These applications can have their own identity associated with them, secured by the software manufacturer (or in some cases, by the organization deploying it) to ensure that the installed software instance can be identified.  Protecting that identity credentials is up to the developer/manufacturer/deployer of the software.

Embedded in a Device

In the second case, embedded in a device, I'm talking about software with no user accessible memory. So, things like activity meters, glucometers, blood pressure cuffs, et cetera, could be included (depending on how they are built, and I'm not talking about something you attach to your smart phone or tablet, but rather a wholly contained device).  There will likely be several magnitudes more of these devices and their installed software than there would be in the first case.  In these cases, we count on two things: The physical security of the device to ensure that someone cannot access the internals of the software.  FWIW: It is possible to crack open the device, and read out the software if standard components are used.  It's a risk, but there are some precautions that device manufacturers can take to protect the software here, or they can just choose to take that risk.  The risk is somewhat mitigated by the fact that only a few software installations would be thus inspected.  So if each device is provisioned with something like a device specific certificate signed by the manufacturer, what is at risk is the software identity associated with a single device (for each device thus inspected).  This assumes that that device manufacturer would deploy with something as secure as a signed certificate.  If they just use a device serial number, it would be relatively easy to impersonate multiple devices by just using made up serial numbers.

Running Natively

In the case where software is installed and running natively on a computer (e.g., laptop or desktop) or device (e.g., smartphone or tablet), there are several challenges, as I've previously mentioned. It is technically feasible to separately provision each downloaded instance of the software installed on a device with its own identity that can be stored in secure storage, but that may not be feasible for different software distribution models (on media, downloaded through an app-store controlled by outside organizations).  It is also technically feasible to require a separate software registration to provision the software (as is done with many software applications), through which the software can be identified.  

The approach that I've settled on here is to delegate the risks associated with the identity of the installed software instance to the software manufacturer.  The manufacturer would need to either provision the installed and running application with its own secure identity, or use a shared identity among all identical instances of the same package.  Since this is a choice the software manufacturer makes, they have some ability to control what happens should someone try to impersonate their software, and can determine what is an acceptable level of risk to them and their customers.  Applications which help a patient keep track of non-life-threatening health data (e.g., diet) might require less stringent security measures than those which ensure that patients are taking their medication appropriately, for example.

The choices made by the manufacturer can be described to the authorizer, so that data holders and authorizers can also make decisions about whether to allow the application access and how to alert users based on the type of application identity (shared or separately provisioned).

Web Browser Based

Finally, for web browser based applications, we would need to delegate some of the risk of using the application to the patient.  It's hard for me to imagine an application that is completely browser-based in the commercial world (i.e., doesn't have some web-server component associated with it) that could facilitate securing the application identity, but it is technically possible.  I think there are two cases here as well:  The software developer could choose to deliver a separate identity to each "download" of the browser-based application, or they could share an identity across all such implementations.  Given the ease in which a web-browser based application's identity can be obtained, it doesn't seem all that useful to deliver separate identities to each instance of the application running in a different web-browser.  There are some ideas I'm playing with here (e.g., tying the application identity to a user authentication), but this requires more thought.

  -- Keith

P.S.  That's one down (partially), and at least five more to go...
 


Wednesday, January 16, 2013

Slap me

While I've been at the HL7WGM, I've also been spending time thinking about ABBI and OAuth 2.0 and dynamic client registration.  I still don't have the details and capabilities of dynamic client registration fixed firmly in my head.  Part of the reason I'm working through this so hard is due to a threat to the ABBI Ecosystem that doesn't yet seem to be mitigated.  Let me start with some assumptions:

ABBI PULL will use OAuth 2.0 for authentication.  It will need dynamic client registration to support authentication of client applications.  The reason that authentication of clients is necessary is that we want to establish trust in the ABBI ecosystem.  That means that applications need to be trustable, or not trustable, and that trust once granted could subsequently be revoked.

To identify a client application installed on a user's system, it must be provisioned with credentials so that an authorizer can identify that installation, and grant trust (or not) based on both the user authorization, and the client application identity.  The client application identity could be specific to an installation, or cover all installations of the same client, or an instance's identity could be linked to  an "application class".  Revoking trust on an instance by instance basis is tedious, and means that having seen one threat, you address it, but that doesn't help you with the next one.  In the linked instance to class model, trust could be revoked from a specific instance, or from all instances of the same client, depending on what happened in the ecosystem.

The threat to an application is this:  If an instance of an application can be impersonated, then an attacker can deploy numerous instances of a rogue application that impersonates a real application (e.g., through a bot-net).  These rogue applications behave badly in a way that is detectable by the authorizer.  This results initially in a revocation of trust, first from each badly behaving instance, but eventually to any instance reporting to be that application.

The attacker in this case has successfully denied users of that application from the services it provides in the eco-system. The reputation of the organization supplying the application also suffers.

Denial of service might seem to be a pretty mimimal attack.  No PHI was lost, damaged or stolen.  Service will be restored eventually.  This isn't about not being able to access Twitter though. This is healthcare data.  People have died because they didn't have their medication list readily available when they needed care.  Am I over-responding?  I don't know.

The problem is that in the OAuth threat model, application code isn't secure.  If you've ever used a Java decompiler, you know what I mean.  I've seen C/C++ decompilers that work with x86 architectures that are also pretty good.  So the code isn't safe, nor is the data in your application, so it cannot be safely pre-configured with secrets. Even assuming that an attacker has limited resources, modern tools can reconstruct the application code readily enough to enable serious hacking (been there, done that, all for legal purposes).

Post-configuration of the application with a secret is possible (because the application can store the secret in protected storage), but there is a chicken and egg problem.  Because the application code isn't secure, the protocol by which the installed application obtains its post-configured secret is known, and an attacker can use then that protocol to obtain an installed instance of an application's post-configured secret.  Having that, they can now impersonate the installed instance.  So anyone could masquerade as an application for which they had the code for, and if they can do it once, they can do it a thousand times (or more).

The responsibilities of members of the ABBI ecosystem is not equally shared.  Applications (running on a device) need to protect a single (or perhaps a few) end-user's data and their own secrets in an installation.  Data holders must protect the data of thousands or even millions of patients.  Authorizers enable the trust in the ecosystem, and have one of the highest levels of responsibility, because if they break down, the ecosystem breaks down.

And what I cannot figure out is how to enable an authorizer to protect an application from being impersonated.

This is not my area of expertise.  I know enough about security (which is quite a bit actually) to know how not to get my face slapped, and when I need expert assistance.  This is one of those cases.  Yet, because I understand more of OAuth than many others (there are a few exceptions, including Josh M, whose been really helpful), I'm putting my face right out front.  Slap away.

Tuesday, December 18, 2012

The year in review


If I had to sum up this year quickly, I'd say for me it was about Quality Measurement, Patient Engagement, and Meaningful Use Stage 2.  Most of my posts have been related to these topics.  This was also the year I took serial writing seriously.

January started year 2 of Meaningful Use.  In January, I didn't go to the IHE Connectathon for the first time in nine years.  I'll be back again this year.  For fun, I wrote The Characters in a HealthIT Standards Meeting.  In January, I was deep into planning and designing transforms for HQMF and Query Health.

February started the month that Consolidated CDA 1.1 was finalized by HL7, after several months of work with IHE, HL7 and S&I Framework.  Early in the month was an IHE meeting in Paris.  My family came along for the ride, and we learned quite a bit about communicating with French speakers.  Of course there was HIMSS, and the almost anti-climactic announcement on the Meaningful Use regulation the day after most everybody has already gone home.  ONC and HHS, stuck in their process, couldn't say much until too late.  I coded, and subsequently demonstrated transforms for HQMF and Query Health at HIMSS.  I spent a good bit of time reviewing the rules.

In March, I started a four-part post which starts here and is completed here about having too many definitions of summary care record in the rules.  It got fixed in the final rule, but there is still yet room for improvement (maybe in the 2016 edition).  In case you weren't aware, the data required for "data portability", and for transfers of care is defined identically in the rule.  HL7 began forming its Mobile Health Workgroup. 

I began my series on Health IT Standards 101 in April (and still have to finish it, although I expect it to be a never ending story).  For fun I wrote Four Career Lessons from the Incredible Hulk.  I issued an Ad Hoc Harley to Jeff Klann for his ability to pick up where I left off on Query Health.

May is the month for one of three regularly scheduled HL7 Working Group Meetings.  We spent a lot of time talking about FHIR, CDA, Templates and the NwHIN RFI at that meeting.  The NwHIN RFI resulted in nothing significant* happening with respect to governance out of ONC in 2012, but there were some good discussions going on here and elsewhere.  It remains to be seen what will happen in the US.

June is another good month to read some more posts about HQMF and Query Health.  At the beginning of the month, I got to take my daughter to a not so secret White House meeting called the Patient Access Summit.  And my daughter joined The Walking Gallery.  She also wrote her first post for me for this blog.  June begins the summer of standards work that I typically engage in.

July was a slow month for the blog, which usually means a heavy one for other activities.  July is when we meet to deal with the public comments and produce the trial implementation content for IHE Profiles.  I finally got around to starting my series on moving from C32 to C-CDA at the end of the month.  A good friend and colleague, Glen Marshall, retired this month.  He got the first lifetime achievement Ad Hoc Harley.

In August, ONC finally kicked off the ABBI Project, which has become one of my bigger "volunteer" efforts.  Of course, I love the acronym, and so does my daughter.  We often joke that ONC gave it that name to suck us in.  She and her younger sister even did a 180 second ad for it.  I continued my series on moving from C32 to C-CDA in this month.  And of course, we got the final rules this month, which led to another series of posts.  In August, I attended the HL7 board meeting where we approved making the IP free.  Only the rest of the world wasn't to know until nearly a month later.

September was kicked off by this huge announcement from HL7.  I've been working towards that since I was elected to the board, and will continue working on it in my second term.  I began playing quite a bit with OAuth in this month, even implementing an OAuth 1.0 Provider.  The test methods for Meaningful Use Stage 2 began to show up this month in waves.

October is the month that my ABBI prototype was moved to the cloud.  I spent a lot of time on ABBI in this month. Just for fun, I built a go-cart in a couple of days.

In November, continuing with one of this year's themes, I created a slide called Hashtag Soup: Relating QDM, HQMF, eMeasures, QueryHealth, QRDA, SIFramework and MeaningfulUse Stage2.  That slide got picked up an used by an ONC staffer for an educational slide deck.  Elsewhere, I spent half a day listening to, and responding to testimony to a House subcommittee on Meaningful Use and Meaningful Results.

December isn't over yet, but I've already been to an IHE Meeting, the mHealth Summit, and the ONC Stakeholder Meeting this month, including the ABBI Town Hall Meeting.  IHE USA announced it's new certification program, and well, there's just a lot going on.

* Just days before the year ended, ONC announced a grant on Governance.

Thursday, December 13, 2012

The ABBI Hour (or two)

I've spent the last couple of days at the ONC Annual Meeting.  Yesterday morning was filled with a joint session between the Beacons and S&I Framework folk.  The afternoon was an S&I Framework Round Table, followed by the ABBI Town Hall Meeting.  I covered the morning session in yesterday's post.  I'm not going to cover the S&I Framework Round Table since it was basically a report out from the various S&I Projects, and either you care and already know, or you aren't that interested.  What I will cover today (as promised) is what we talked about in the ABBI Town Hall meeting.

First of all, I'm not sure what the difference is between the "Round Table" and "Town Hall" meeting format.  I think they just pulled these names out of a hat.  The ABBI Meeting certainly had the flavor of "Town Meeting" though, especially if you'd had any experience with that form of government.

Farzad Mostashari kicked off the ABBI Town Hall meeting with a rather personal story.  [FYI: Everything I'm telling you here Farzad cleared with his parents, and was also stated in public in a room full of 1300 people this morning].

It starts with this tweet from Presidential Fellow Henry Wie MD (which Farzad retweeted) just before Thanksgiving:
And he did sign up his father and mother on Turkey day.  Then he looked at the nearly unreadable text, and decided that he needed to get them hooked in with an App that would make sense of that. So he downloaded the winning app from the Blue Button Mashup Challenge (from ABBI committed participant Humetrix).  He had to e-mail some folks at the company to resolve an issue, but got it worked out (all on T-day).

The next day, his father complains about serious eye pain.  Great, he thinks.  This is going to be a miserable Thanksgiving Holiday.  He and his parents are going to spend half the day or more at an ED in a hospital, that doesn't have an Opthamologist on call, and with no access to provider records from physicians in their home state (MA).  But, now Farzad can look at the diagnosis code that the physician provided for a previous procedure on his father's eye, or even better yet, look it up on the Internet.

As it turns out, he winds up finding an Opthamolagist who can see his father the same day using another App.  And his father, upon being asked for the history of this problem, can hand the Doctor his cell phone and say, here it is.

OK.  If you thought Farzad was over the top about the value of Blue Button before, you should see him prance about now.  There is nothing like a personal story that will make it hit home.  I've been through this hassle (One of the stories on my jacket is about the 3 extra days spent in the hospital, uselessly waiting on data that wasn't available until Monday morning).  Guess the date.  Yep, my step-father also went into the hospital the day after Thanksgiving when he was visiting me.

Farzad wondered why his parents medicines weren't also in the CMS download data, but then realized that they weren't enrolled in Part D.  So, he made sure to enroll them in that as well.

This kind of solution is what ABBI is about.  But better than a file of text that has to be parsed out, ABBI will use the same standards that are in Meaningful Use.

Next up was Ryan Panchadsaram (Presidential Fellow), to discuss some of what we've accomplished in the project thus far.

There are three aspects of ABBI: Liberation of data, fidelity of data (through structured content), and automation of access.  The last part has been described as the "set it and forget it" feature.

There are two different forms of ABBI that we've been working on: PUSH, enabling providers to transmit to patients using Direct (not hitting a meaningful use goal unless you count push to a patient as a download), and PULL, enabling patients to view or download the content (either counting towards patient engagement metrics in MU Stage 2).

Ryan started off with a shout out to me on some of the work I've been doing here.  Then he described some of the accomplishments of the four workgroups: Content, Push, Pull, and Payer (which I'll get into in a moment).  In describing how I've been working on the Document Bits, Ryan stumbled and it came out "Documents Bitch".  Which led to this tweet.  I embrace it.  Yes.  most of my standards work has been about documents for the last decade (and more).  And I embraced Ryan as the room burst into laughter.

Following Ryan (and that was difficult at this point), was Henry Wei, also a Presidential Fellow working on the project.  He was up to the task though, reminding all that we record the calls, and that it is a good idea to go on mute before using certain facilities.  That gained another brief bit of laughter, and we got back to the meeting.

Henry's been keeping up with the payer group, who have been working diligently to develop a standard to enable patients to get access to cost data, which could be a real game changer for cost transparency.  While they are pretty much all-in on developing the standard, there is a great deal of concern that they won't be so keen on sharing it (I'd make the point to them, that to win the pot, you have to show your cards).  Will they be brave enough?  That's a good question, but I think some of them get it, and will.

On the standards, at least one participant has been pushing the payer community to something like a JSON representation of the 835.  They are calling this 835ish.  I like the name, but will have to see how the results come out.  I could probably automate the representation based on the X12 standard content (oh joy, more PDF scraping), but I think I'll let the payer community work that out.

So now we get to the real fun part, which was where the meeting definitely felt like a town meeting.  

We were given three questions to address:

For Push, the question was stated something like: How do we figure out what Direct addresses to white list?

I was aghast.  I don't want to be forced to use any address other than the one I've already set up for this purpose.  I've got an e-mail address.  I have a secure certificate.  And when I give my provider my e-mail address, I can also send him a signed e-mail to ensure that he's got my certificate.  After all, this is the way that certs get passed around today.  There are certainly ways to automate this.

The reality of this is that the question was badly stated.  What I suggested above certainly will work with Direct.  A direct address is an end-point.  It could be to an e-mail client, or it could be to something like HealthVault.  For end-points used by non-tech-weenies like me, what/how should we create a "trust-bundle" and manage that?  And still, I don't see the problem.  Provider A's trust-bundle could well be different from provider B's.  This only seems like a way to cut out possible end-points.  Rather than assume that all end-points are bad unless proven otherwise, why not consider the opposite, and let the eco-system police itself in some way.  We'll see where this goes.  I expect that whatever solution they come up with, if it shuts out innovation or patient access, will be corrected by hactivist patients, and the eco-system will adjust (just as the Internet did, first with HTTPS, and later with PayPal and the like to support secure payments).

What is this trust-bundle thing?  Well, imagine it this way:  Every browser is configured with a set of root certificates that it trusts.  There's a bundle.  This bundle of root certificates manages what X.509 certificates are acceptable to the brower to ensure trust in a secure site.  We want to understand what the "initial" configured rules are for the bundle for Direct endpoints.

On the idea of White List, Farzad asked:  Is bar too high? too low? Do we need a bar?
Doug's question was perhaps more pertinent: Or should we go to the bar?

I'm of the opinion (if you haven't figured it out), that a White list (or preconfigured trust bundle) for patient owned Direct addresses sets the access bar for providers implementing portals higher than we've already set it for via HIPAA/HITECH for providers enabling patient data access through a portal.

Next question on the table was for Content:  How can we set content expectations to be consistent with MU Stage 2/CEHRT 2014, but meet providers where they are today?

I think we agreed that

  1. ABBI should recommend best practices for content,
  2. But allow for use of any content available.

Farzad talked about even sending "Open Notes".  I'm not sure that everyone gets that the eight structured document types in Consolidated CDA can serve two purposes:

  1. To document an encounter for your "Clinical Notes"
  2. To act as a summary for that encounter for Meaningful Use.
And so, you could have your cake, and eat it too, OR, as I keep telling people, use the document you are already creating in your existing workflow, to act as the visit summary.

Finally, for PULL: What is needed besides working code; what will it take for organizations to implement pull? 

I restated the question to the room:  How many of you here are data holders that would want to share data using ABBI PULL.  Peter Levin failed to raise his hand, but I think he meant to.  Nobody else in the room in the afternoon was a data holder.  My conclusion is that we were in the wrong room, and needed to head over to HIE or Beacon Communities to ask the question again.  [FWIW:  I went fishing today among ONC grantees and programs, and got a few bites.  I may just have to change my business card to read "Standards Coordinator" rather than "Standards Geek"].  Maybe I can convince Microsoft to use their CCD APIs to implement something that works.  (Sounds like an IHE MHD Hackathon adventure).

The last major comment in the Town Hall that I remember was the person who said:  Consumers need to be the ones with ALL of the choices when it comes to ABBI.  I agree.

We closed with #ABBI Hour, at a nearby pub, just as Doug suggested.






Monday, November 26, 2012

What-duhl?

WADL stands for Web Application Description Language.  It is a member submission to the W3C by Sun Microsystems (now Oracle), written by Marc Hadley (now at MITRE).  WADL is to REST as WSDL is to SOAP, which interestingly enough, makes it both a useful documentation and code generation tool for RESTful web service development, and anathema to the RESTful in-crowd (of which, I'm apparently not a member).  I'd also note that you can use WSDL for the same purpose (which is apparently even worse).

WADL isn't a standard, but it was certainly meant to fill a gap in standards for RESTful web services.  I've been playing around with WADL a bit to define and document the ABBI protocol.  What I found useful about WADL is that it makes me think about (and document) all the necessary  aspects of services that an implementer needs.  The advantages of using WADL are pretty significant.  I can get a lot of documentation out of WADL that would be difficult to create in the same way using a word processor.

There are several tools available that will take a WADL description and turn it into documentation of a RESTful API, others that will turn it into code, and yet others that will generate WADL from code.  All-in-all, useful stuff when you have a small team (as I do).  Sure, I don't need any tools to do this by hand, but why not use them if they make my job easier.  One of the things I like about WADL is that it helps me to order my thinking, and to make it easier to understand the API.  I can still read the XML and understand what it is doing.

One of my experiments in playing with WADL was to restructure the OAuth 2.0 RFC in WADL form, since we are also talking about using OAuth 2.0 for ABBI.  OAuth 2.0 doesn't define the resource URLs, it just defines what they need to do, which makes them a <resource_type> in WADL instead of a <resource> proper.  The tool I was using to generate documentation didn't support <resource_type> so I fixed it to do so (and made some other tweaks to it).

I haven't finished documenting either the ABBI API or the OAuth 2.0 specification in WADL, but the results are promising enough that I've posted them both to my prototype implementation site.  You can find them at the links above.









Tuesday, November 6, 2012

Progress Update on ABBI PULL

The ABBI PULL Workgroup met today, after a brief weather inspired hiatus.  We addressed 4 questions which were presented by Pierce and Ryan (ONC Coordinator and Presidential Fellow for this project).
  1. Will the same REST Endpoints and Return Objects be used across the industry?
    The point of this question was to address whether there would be different endpoints and data objects for providers, payers or patient controlled health records.  We agreed that in general, the endpoints would be applicable to everyone, and that you could negotiate what kind of content you'd get back (e.g., C-CDA or EOB statement), and that the end-point would be able to send what it had available, or nothing if it didn't have what you were asking for.  This is similar to the Search API that I prototyped.  Another end-point would give you the most recent document containing what is known about the paitent.
  2. What industries does ABBI need to describe endpoints and objects for?
    The basic API would support providers, payers or PCHR systems.  If you wanted to go deeper, you might get into industry specific end-points (but see the next question).
  3. How specific and deep will the endpoints be?
    We could go into detail, but the basic level of the API should support the "Download" capability and requirements for Meaningful Use Stage 2.  We should keep it simple, but be able to extend to other kinds of end-points consistent with the overall approach.  Keeping it simple will increase adoption, because it will meet provider needs for Stage 2.
  4. How can we encourage consistency?
    A well-documented API, with open source and reference implementation
There were a lot of side-bars and more details in all of these questions, but Pierce and Ryan kept great notes.

Meanwhile, I'm still writing code, but have got the dull-drums.  The next batch of code needs to deal with user and client registrations, and I just don't want to deal with it.  Neither do my customers.  So I'm looking for a different way to address it.  Part of the solution may be related to the next bit we'll be looking at next week.

For that, we'll be examining what I've referred to as the million registrations problem in OAuth, and some possible solutions.

Following that, I hope we can address the XML vs. HTML issue for content.  I think the answer to that problem is content negotiation via end-point API parameters, rather than something like an embedded stylesheet.  That just didn't work when I tried it. After all, content negotiation is what the HTTP Accept header is for.

-- Keith

Monday, October 29, 2012

A Four-legged OAuth for ABBI

I've been thinking about how to address the million registration problem that I identified last week (actually, it was Josh Mandel who first pointed it out).  I think I have a solution to the problem, and it revolves around the way the the consumer key is exchanged. 

In Twitter, the same client application on different consumers’ systems uses the same key and secret, to connect to a singular data holder (twitter.com).  In ABBI, an application will want to use the same key, yet different secrets on for each different data holder it connects to.  The reason to use the same key is so that the client application can be consistently identified in the same way across multiple data holders.  It also provides a way to avoid collisions between client applications.  The reason to use a different secret with each data holder is to ensure that no data holder's secret can be used with another data holder.  This prevents someone from pretending to be a data holder in order to obtain all of an application's secrets.

The consumer key I propose to use is a URL identifying the application’s web page.  It’s not unreasonable to assume that a commercial application will have its own web site, and while a little bit more challenging for the typical hacker, not a huge hurdle.  In fact, I run a secure web site for free.  It’s also not too hard to believe that someone would willingly host pages for “garage-apps” (things a developer like me would use to manage their own data).

The reason to use a different secret is so that the secret shared between a client application and a data holder can only be used with that data holder.  This prevents a rogue from creating a system pretending to be a data holder in order to gain access to a client application’s secret.  Surely they could obtain access to a secret, but it would do them no good with any other data holder, because the client application would just use a different secret for the other data holder.

It is important that the secrets used by the client application with the same data holder always be the same regardless of which consumer system is accessing that data holder, because most (if not all) OAuth implementations expect each key to be associated with one secret.   Centralizing control of secrets isn’t something that you can expect the client application itself to manager.  In fact, a new secret would have to be generated for every new data holder that appears in the ecosystem.  This is another reason why the client application needs to be associated with a web site, because that becomes the single point of secret distribution for that client application.

Here is the workflow I’m presuming:
1)      Client Application MyABBI is installed on my personal device.
2)      During Device Configuration, the application is pointed to MyDataHolder.org as being one of the sources of data it needs to query.
3)      Client Application MyABBI connects to its home web-server (MyAbbiApps.com/MyABBI), and asks for the secret key to use with MyDataHolder.org, as it has never connected to that Data Holder before.  We don’t need to say much about how the client application communicates to the web site, nor do we need to say how the client application authenticates itself to that site, since both are under control of the client application developer.  However, we do need to say that the communication must occur over a secure channel, and that the Client Application must authenticate itself.  In fact, the client application could use the first step of the token request workflow to authenticate itself.
4)      The Client Application Web Site for MyABBI responds with a secret key to MyABBI on my personal device.  If the client application used the first step of the token request workflow, the response could be the same as how a server responds with a request token.  During this stage, one of two things happens:
a)      https://MyAbbiApps.com/ABBI has never encountered https://MyDataHolder.org before.  In this case, the site makes a determination whether to trust MyDataHolder.org or not.  If it chooses to trust MyDataHolder.org, The website behind MyABBIAps.com/ABBI creates and stores a new secret associated with that data holder.b)      https://MyAbbiApps.com/ABBI has encountered https://MyDataHolder.org.  If it is trusted, the web site returns the secret associated with that data holder, and it isn’t trusted it returns some sort error response.
5)      Having obtained a consumer_secret, the MyABBI can now begin the Authorization Workflow with https://MyDataHolder.org.  The first step is for the client application to obtain a request token from the Data Holder.
6)      About half way through the process of trying to verify the request just made in the previous step, the https://MyDataHolder.org will now need to obtain the client secret associated with client application.  If it already has that information, it could just reuse what it knows, since it usually will not have changed. But if it doesn’t it needs to follow these steps:
a)      Identify itself as https://MyDataHolder.org to https://MyAbbiApps.com/ABBI, and indicate that it is requesting the secret for the client application that identified itself to the Data Holder as being supported by that site.b)      Reject the OAuth Request Token request with an error code.
7)      The https://MyABBIAps.com/ABBI website will accept a request for a secret from a Data Holder.  If the data holder trusts the client application’s website certificate (at https://MyDataHolder.org), communication continues, otherwise it stops at this point, and the Authorization workflow fails.
8)      That request must contain the base URL for the Data Holder’s ABBI API (e.g., https://MyDataHolder.org/ABBI/api) and also contains a nonce associated with this request for the client application’s key.
9)      The Client Application’s website (https://MyAbbiApps.com/ABBI) will send a request the “Secret Exchange” end-point for the Data Holder (https://MyDataHolder.org).  That request will contain: The sending website URL (https://MyAbbiApps.com/ABBI), the nonce given in step 8, and the client applications secret needed to access resources.
10)   The Data Holder will store the client secret associated with the client key if it recognizes the nonce, and return 200 OK.  If it doesn’t recognize the nonce, it sends back an error message.
11)   If https://MyAbbiApps.com gets back an error message, indicating that MyDataHolder.org didn’t recognize the nonce associated with the client secret, it should invalidate that secret.
12)   The client application will restart the Authorization workflow with the data holder, and this time, it will succeed.

There are a couple of key points here that I’d like to explain further.  I’m assuming TLS without client authentication, because that is just about how every consumer facing web site works (even those with patient portals).  Making either the data holder or the client application’s web site use TLS with client authentication would simplify the steps here, and enable them to establish mutual trust.  However, it would also make MyDataHolder.org have to provide a public certificate, which the web-site developer may not have access to, or vice-versa.  I’d be very challenged to get access to the certificate securing https://abbi-motorcycleguy.rhcloud.com. It’s not mine.  It belongs to https://rhcloud.com and so I can’t use it to verify a TLS connection as a client endpoint, it can only be used to verify the identity of the web server.

Without mutual authentication, the challenge in step 7 is when MyAbbiApp.com gets a request purporting to be from MyDataHolder.org asking for the secret associated with MyAbbiApp.com.  It has no way to determine that the requester is indeed MyDataHolder.org without without client authentication. 
To resolve that problem, step 8 and 9 come into play.  Step 8 ensures that there is a way to synchronize the request with the response that comes asynchronously in step 9.

In Step 9, DataHolder.org finally gets the secret it asked for at step 7. 

Note that we haven’t delayed the authorization request in step 6, we simply rejected it, expecting the client to retry in step 12.  It is certainly feasible to delay the authorization step, but synchronizing these two separate threads of activity can be challenging, and isn’t necessary.  It’s just necessary to get the client application to try again.  With a sufficient time delay (e.g., one minute), the client application will be able to complete the authentication workflow just fine most of the time.

Step 10 and 11 ensures that data holders respond appropriately to requests to send them a secret, and the client web site revokes a secret it handed out that wasn’t accepted by a Data Holder.

The applications running behind MyAbbiApps.com and MyDataHolder.org need establish no mutual trust relationship initially.  It is only when they become aware of each other that each can separately make a trust determination about the other based upon policies.  MyDataHolder.org could refuse to trust a site whose certificate it didn’t like.  Similarly, MyAbbiApps.com could refuse to trust a Data Holder it didn’t like.  It’s completely up to them to configure the policy.  In fact, the trust relationships need not even be based on the certifications, but could be based on the site URL.  Blacklists could be used by either site as well to reject requests.

Now that I’ve worked out the Authorization Workflow, what about the normal API Authorization case?  It shouldn’t be necessary for the data holder to get the consumer secret again for MyAbbiApps.com/ABBI, but if it were, it could simply start at step 6 with the request to obtain the secret.  In this way, applications don’t even need to maintain any sort of persistent record of the client secret, because they have a way to obtain it again later.

What I’ve just described is what I call 4-legged OAuth.  The three actors in 3-legged OAuth are
1.       Consumer (End User)
2.       Client Application
3.       Server (Data Holder)

We’ve just added the Client Registrar.


Friday, October 26, 2012

Thousand of Providers and Apps for ABBI

The vision for ABBI is to enable thousands of providers to allow patients to automatically download data, possibly using thousands of various health applications.  The challenge this creates is that for the eco-system to work, we need to ensure that 1000 apps X 1000 providers doesn't equal 1,000,000 application registrations for every app to work with every provider.  I was reminded of this by a comment made by Josh Mandel yesterday on another of my ABBI posts.

I've been prototyping my efforts using OAuth 1.0, and have been following Twitter's pattern.  With Twitter, you have to register your app, and get a client key and secret that your app will use later in the Authorization Workflow.  But providers don't want to be in the credentialing business at all, and many would love to off-load that responsibility even for patients to others, so why would they now want to credential applications as well.

In the case of Twitter, it is the singular provider of the Twitter API, yet what we want for ABBI is to have numerous providers of the ABBI API.   We don't want to have each of those applications to have to register with all of the possible data holders, because then the applications would have to have foreknowledge of all data holders.  In fact, based on the consent model, there should not need to be any sort of business relationship between the application developers and the data holders.  But we do want to make sure (from the patient's perspective) that these applications aren't just some rogue actor trying to obtain access to patient information.

I looked to see what the Rhex Project had done, considering they were implementing OAuth 2.0, but no luck.  Page 11 of the Rhex OAuth 2.0 Profile (.doc) states:
Confidential Clients register a JSON Web Key (JWK) with a trusted Authorization Server prior to conducting health exchange transactions.  
So even they require a registration step.

There are a couple of ways to avoid registration.

Don't Use oauth_consumer_key

OAuth 1.0 doesn't require the oauth_consumer_key to be present in the Authorization workflow or in API calls, nor is it required to have a value.  The whole idea that the client application has to register could be ignored.  But, one advantage that oauth_consumer_key and oauth_consumer_secret support is the idea that activities performed by applications on behalf of a user can be traced back to a specific application.  This is rather beneficial.  If my data was downloaded, I'd really like to know which app did it when I check the logs.

I'd like to avoid dropping the oauth_consumer_key if possible.  There's simply no way to convey the client application identity if you do that.

Negotiate oauth_consumer_key without a Registration

OAuth 1.0 leaves completely unspecified the means by which the consumer_key and consumer_secret values are exchanged with the client application. This is by design.  With Twitter, there's a developer's API page you use, and you request keys via the web.  But there could be any number of other mechanisms by which client keys and secrets are exchanged, some of which could be done without a registration step.

Key features of the client key and secret that need to be preserved:

  1. The key needs to uniquely identify the client application, and be distinct from any other client application.
  2. The secret needs to be something that that only the server (data holder) and the client application could have knowledge of.
I have a solution in mind that involves consumer key and secret exchanges with the client application's web-site.  There are several challenges that have to be surmounted in order for this to work, but I'm going to spend some time thinking on this.



Wednesday, October 24, 2012

ABBI

I've written more than a score of posts on ABBI, and it's beginning to get difficult to remember the right keywords to find each one when I want to reference it. So it's well past time to write the TOC page for the ABBI Project.  As I write more about ABBI, I'll update this page (which you can find in My Favorites).

You can find further material on ABBI by looking at my prototype, the source, or my kids' info-mercial.
  1. Not So Secret White House Meeting with Patients
    This is where it all started.
  2. Automate the Blue Button
    Mostly a reprint of the ONC Announcement, but also where my first cut at a proposal for PULL started from (IHE MHD + OAuth).
  3. "Ask for It" The Director's Cut
    My daughters' three minute info-mercial for ABBI.
  4. Automate the Blue Button PULL Proposal
    My first cut at a proposal for the PULL API.
  5. The Magical Little Blue Button
    In which I explain how the new Blue Button supports the requirements for View, Download and Transmit of Meaningful Use.
  6. What ABBI can for for Healthcare Cost Transparency
    If there was ever a post that I could say really had an impact on healthcare cost, this might be it someday.  And some folks on the payer side seem to be taking this one pretty seriously.  The idea is to allow patients to download their EOB data electronically in a machine readable format.
  7. Crowd Sourcing a Keynote
    Half summary of the session Adrian Gropper and I did at Health Camp, and half input to Dave deBronkart's keynote at Medicine 2.0 (where Abby again wows the crowd).
  8. Fall is Coding Season
    Trials and tribulations of maintaining a development environment, which is actually pretty revealing about my Architecture for the ABBI prototype.
  9. ABBI's First Data Holder Connection to IHE XDS via OHT
    My first bit of working code for the prototype.
  10. Provisioning an Application to automatically find ABBI's BlueButton
    Finding a web-sites Blue Button interface should be as easy as finding your belly-button.  This proposes a way to do that.
  11. A Bake Off
    I'm comparing IHE MHD, FHIR's XdsEntry, and what I composed for ABBI.  You can too at the link in the explanation for the next post.
  12. I iz in UR Cloud. It iz mai Sandbox
    In which I launch the code I've been playing with into the cloud.  Play with my prototype here.

CDA

Some of my posts on ABBI are related to CDA. 
  1. Illegitimi Non Carborundum
    A rant and recant in which I complain about attacks which I take rather personally.
  2. Forwards on ABBI
    Mostly more ranting, but also explaining why I like this project so much.
  3. Why Not Both? The Genius of the AND, 2012 Edition
    In which I move towards a content negotiation strategy for ABBI.
  4. Usability, CCDA Documents and ABBI
    Give me my damn data.  Make it pretty later.  Because the key word in usability is use, not view.
  5. Styling CDA Based on Entry Content
    In which I describe a technique that allows you to style narrative based on the data that reference it.

OAuth

A number of my posts deal with using OAuth.  I've gathered these together here in this section.
  1. ABBI Security
    Starting to delve into OAuth, and container managed security.  This becomes important later.
  2. An OAuth Provider for ABBI
    Just a little bit of architecture on my FIRST OAuth Provider that I developed for ABBI.  It certainly works, but there's something better in the works...
  3. An OAuth Provider for Java based on Scribe
    Having found and invested myself in Scribe, and then discovering it implemented only the client-side of OAuth, I now had to go pick something else.  Or did I?  This post explains how I enhanced Scribe to deal with the Provider side of OAuth.  But wait...
  4. OAuth Enabling a Web Application
    In which I refactor my OAuth implementation to make it easier to retrofit existing web apps.

Styling CDA Based on Entry Content

I've long advocated that CDA Entries be linked back to the narrative text that they are associated with.  There are some very good reasons for doing this, and I discovered a new one yesterday.  What that allows you to do is set display formatting based on what the narrative content means.

Suppose you had the following content in your CDA document:

<table border="1">

  <thead>
    <tr><th>Severity</th><th>Problem</th><th>Date</th><th>Comments</th></tr>
  </thead>
  <tbody><tr>
    <td><content ID="severity-1">Severe</content></td>
    <td><content ID="problem-1">Ankle Sprain</content></td>
    <td>3/28/2005</td>
    <td><content ID="comment-1">Slipped on ice and fell</content></td>
  </tr></tbody>
</table>

Note the <content> elements and the ID attributes.

Assume you had an entry with the following content (I've removed all but the templateId and element container for the reference in the following for brevity):

<entry>
  <observation classCode="COND" moodCode="EVN">
    <templateId root="1.3.6.1.4.1.19376.1.5.3.1.4.5"/>
      ...<value code="44465007" codeSystem="2.16.840.1.113883.6.96"
      codeSystemName="SNOMED CT" xsi:type="CV">
      <originalText><reference value="#problem-1"/></originalText>
    </value>...
    <entryRelationship inversionInd="true" typeCode="SUBJ">
      <observation classCode="OBS" moodCode="EVN">
        <templateId root="1.3.6.1.4.1.19376.1.5.3.1.4.1"/>

        ...<value code="H" codeSystem="2.16.840.1.113883.5.1063"

          codeSystemName="ObservationValue" displayName="High" xsi:type="CD">
          <originalText><reference value="#severity-1"/></originalText>
        </value>...

      </observation>
    </entryRelationship>
    <entryRelationship inversionInd="true" typeCode="SUBJ">
      <observation classCode="OBS" moodCode="EVN">
        <templateId root="1.3.6.1.4.1.19376.1.5.3.1.4.2"/>

        ...<text><reference value="#comment-1"/></text>...

      </observation>
    </entryRelationship>
  </observation>
</entry>

Note how each entry template includes a reference pointing back to the ID.  Let's classify each of these references:

#problem-1: References the name of the problem.  Suppose in this case, we'd like these to be in bold and small-caps.
#severity-1:  References the severity of theproblem.  We don't want to do anything special with these.
#comment-1: References the comment on the problem.  Suppose here we want this to be italicized, and furthermore, would like a mouse-over to display the author name.

This is a modest extension of the Stupid Mouse-Over trick that I teach when I talk about how to render CDA documents.  You'll need a template for each special style you want to apply, and you'll also need to apply a template to the ID attribute that you invoke for each CDA narrative element you process.

Here's the template for the ID attribute.

<xsl:template match="@ID">

  <xsl:attribute name="ID">
    <xsl:value-of select="."/>
  </xsl:attribute>
  <xsl:variable name="theID" select="concat('#',.)"/>
  <xsl:variable name="theRef" select="//cda:reference[@value=$theID]/../.."/>
  <xsl:apply-templates select="$theRef" mode="style">
    <xsl:with-param name="ID" select="."/>
  </xsl:apply-templates>
</xsl:template>

This template copies the ID to element you just created (e.g., <p>, <li>, <td> et cetera, using this mapping). It locates any references to that ID in entries anywhere within the CDA document, and calls a template to set the class attribute on the output element.  This template is invoked either on the value or code element (e.g., where originalText would appear), or on the entry element itself (when the reference appears in act/text).

The next two examples show how to create templates that would set the style to use for the problem name and severity.

<xsl:template match="cda:value[
  parent::cda:observation/cda:templateId/
    @root='1.3.6.1.4.1.19376.1.5.3.1.4.5']" mode="style">
  <xsl:attribute name="class">problem-name</xsl:attribute>
</xsl:template>

<xsl:template match="cda:value[
  parent::cda:observation/cda:templateId/
    @root='1.3.6.1.4.1.19376.1.5.3.1.4.1']" mode="style">
  <xsl:attribute name="class">severity</xsl:attribute>
</xsl:template>

You may recall that I said we don't want to do anything special for severity.  That's still true, but read on:

Here's the template for the comment.
<xsl:template match="cda:observation[
    cda:templateId/@root='1.3.6.1.4.1.19376.1.5.3.1.4.2']" mode="style">
  <xsl:param name="ID"/>
  <xsl:attribute name="class">comment</xsl:attribute>
  <xsl:attribute name="title"><xsl:apply-templates 
    select="ancestor-or-self::*[cda:author][1]/
     cda:author[descendant::cda:assignedPerson][1]" mode="title"/>
  </xsl:attribute>
</xsl:template>

I said we wanted a mouse-over to display the name of the author for the comment.  To do that, we'll assign a title attribute to the wrapping tag, and fill it in with the author name.  To do that, we have to find the author.  The select attribute of the apply-templates requires a little bit of explanation.  It locates any element ancestor where we have the reference that has an author.  These will be ordered in reverse document order.  The first of these will be the closest ancestor that assigns one or more authors to the entry.  From there, we select the authors who are people rather than devices (this is what descendant::cda:assignedPerson] does), and choose the first one of those (the [1]) to display in the title.

The final template converts a person name into a string appropriate for display in a title. It just concatenates the name parts with a space delimiter after each one (a purist would strip off the last space, but for this demonstration it doesn't matter).

<xsl:template match="cda:author" mode="title">

  <xsl:for-each select="./cda:assignedAuthor/cda:assignedPerson/cda:name/cda:*">
    <xsl:value-of select="."/>
    <xsl:text> </xsl:text>
  </xsl:for-each>
</xsl:template>

Finally, somewhere at the top of the XSLT stylesheet, you need to output a <style> element that contains the following:

<style>

  ...

  .problem-name { font-weight: bold; font-variant: small-caps; }
  .severity { }
  .comment { font-style: italic; }
</style>

While we assign a class to severity in the generated HTML, the style associated with that class does nothing.  This allows me to change my mind later about how severity would be represented in the output.

Using the sample file that I started with (one I used for CRS Release 1), the result looks something like this.  Note that while I started with something old, the same techniques can be applied to CCD, C-CDA or any other set of templates using the CDA standard.

Good Health Clinic Care Record Summary

Conditions

SeverityProblemDateComments
Severe Ankle Sprain 3/28/2005 Slipped on ice and
fell

ONC Challenge

ONC yesterday issued a design challenge for Blue Button.  It should be fairly straight-foward to apply this technique in a CDA Stylesheet that implements one of the chosen designs.  What this technique does support is applying specific styles to narrative content that already appears and is linked to entries.  What it won't do is generate narrative from the entries.  For that, you'd need a different kind of style sheet, and that would need to be used by producers of CDA documents, rather than consumers of them.  This technique can be used by either producers or consumers.