Omaerz: 36 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T03:00:51Z

36 revisions imported: Initial Upload of old pages from IDESG Wiki

New page

'''Blue Button + Pull''':

 
'''Use Case Description''': A patient directs an electronic health data holder to allow a designated third party to access to his/her personal health information using an existing trusted credential held by the patient (mobile, email acct etc) via the internet.

 
'''Use Case Category''': Authentication, Authorization, Consent

 
'''Contributor''': IDESG Health Care Committee

 

=== Use Case Details ===
'''Actors''':
* Data Provider (EHR Portal)
* Identity Provider
* Relying Party (3rd Party application and/or Delegated Patient Proxy)
* Patient
 
'''Goals''': Permit patients to delegate access to their own personal health information.

 
'''Assumptions''':
''''''3rd Party application has registered Blue Button Root CA with Blue Button Plus''' NEEDS MORE WORK
'''

 
'''Requirements''':
* There is a existing record or data in a data holder store
* The patient has an existing trusted credential
* The data holder has a legal, defined agreement to share data under HIPAA, its extensions or other formal agreements.

 
'''Process Flow''':
*Patient authenticates to an EHR or other data holder and request that EHR send patient information to a 3rd Party Application (3PA) by providing a unique URI - Direct address
*EHR/data holder uses address to locate 3PA public certificate and reconcile that certificate with the legal defined agreement
''*EHR wraps up CCDA using the Direct Message protocol to transport for delivery
''*3PA unwraps Direct Message and notifies the patient to confirm delivered information
''*3PA registers with EHR Authorization server and generates a shared secret
''*Patient authenticates to 3PA application, verifies information.
''*3PA prompts user to confirm if they would like set up periodic updates
''*If yes -3PA redirects patient to authenticate EHR to generate token necessary for future access behind.''
''LINES IN ITALICS ABOVE NEED MORE WORK''''
'''

 
'''Success Scenario''':

 
'''Error Conditions''':

 

=== Relationships ===
* Extended by:
**
**
* Extension of:
* Remote electronic identity proofing
* Authenticate Person Use case
* Delegated Authentication of User Managed access

=== References and Citations ===
* NIST SP 800-63
* HIPAA
* Meaningful Use Stage 2 45 CFR 170.314(b)(2) Federal Register /Vol. 77, No.171 September 4, 2012 54163 at 54288
 

[[Category:Authentication Use Cases]]
[[Category:Use Cases]]

BB+ Direct PULL - Revision history

Omaerz: 36 revisions imported: Initial Upload of old pages from IDESG Wiki