View source for BB+ Direct PULL

'''Blue Button + Pull''': 

<br />
'''Use Case Description''': A patient directs an electronic health data holder to allow a designated third party to access to his/her personal health information using an existing trusted credential held by the patient  (mobile, email acct etc) via the internet.


<br />
'''Use Case Category''': Authentication, Authorization, Consent

<br />
'''Contributor''': IDESG Health Care Committee

<br />

=== Use Case Details ===
'''Actors''': 
* Data Provider (EHR Portal) 
* Identity Provider
* Relying Party (3rd Party application and/or Delegated Patient Proxy)
* Patient
<br />
'''Goals''': Permit patients to delegate access to their own personal health information.

<br />
'''Assumptions''': 
''''''3rd Party application has registered Blue Button Root CA with Blue Button Plus''' NEEDS  MORE WORK
'''

<br />
'''Requirements''': 
* There is a existing record or data in a data holder store
* The patient has an existing trusted credential
* The data holder has a legal, defined agreement to share data under HIPAA, its extensions or other formal agreements.


<br />
'''Process Flow''': 
*Patient authenticates to an EHR or other data holder and request that EHR send patient information to a 3rd Party Application (3PA) by providing a unique URI - Direct address
*EHR/data holder uses address to locate 3PA public certificate and reconcile that certificate with the legal defined agreement 
     ''*EHR wraps up CCDA using the Direct Message protocol to transport for delivery 
     ''*3PA unwraps Direct Message and notifies the patient to confirm delivered information
     ''*3PA registers with EHR Authorization server and generates a shared secret
     ''*Patient authenticates to 3PA application, verifies information.
     ''*3PA prompts user to confirm if they would like set up periodic updates
     ''*If yes -3PA redirects patient to authenticate EHR to generate token necessary for future access behind.''
     ''LINES IN ITALICS ABOVE NEED MORE WORK''''
'''


<br />
'''Success Scenario''': 

<br />
'''Error Conditions''': 

<br />

=== Relationships ===
* Extended by:
** 
**
* Extension of: 
* Remote electronic identity proofing
* Authenticate Person Use case
* Delegated Authentication of User Managed access

=== References and Citations ===
* NIST SP 800-63
* HIPAA
* Meaningful Use Stage 2 45 CFR 170.314(b)(2) Federal Register /Vol. 77, No.171 September 4, 2012 54163  at 54288 
<br />

[[Category:Authentication Use Cases]]
[[Category:Use Cases]]