Trustworthy Healthcare Application - Revision history

Tomjones: /* Online Trust */

2021-03-21T22:40:01Z

Online Trust

← Older revision		Revision as of 22:40, 21 March 2021
Line 54:		Line 54:
	* User Identity proofing needs to be portable among healthcare providers.		* User Identity proofing needs to be portable among healthcare providers.
	* All devices and user agent software will come with certifications of compliance.		* All devices and user agent software will come with certifications of compliance.
	* The [https://trustregistry.org/ Kantara Trust Registry] will make a [https://kantarainitiative.org/download/kantara-mobile-assurance-statement/ Mobile Authentication Assurance Statement] available for all apps ~~the~~ access private health information (PHI).		* The [https://trustregistry.org/ Kantara Trust Registry] will make a [https://kantarainitiative.org/download/kantara-mobile-assurance-statement/ Mobile Authentication Assurance Statement] available for all apps that access private health information (PHI).

	===Patient Consent===		===Patient Consent===

Tomjones: /* Online Trust */

2021-03-21T22:39:36Z

Online Trust

← Older revision		Revision as of 22:39, 21 March 2021
Line 51:		Line 51:

	===Online Trust===		===Online Trust===
	* All ~~online service endpoints shall be equipped with capability metadata~~ that ~~informs communications partners~~ as to the ~~services offered~~.		* All providers that authenticate patients and authorize services will make their own determination as to the patient's identity.
	* ~~All online service endpoints shall supply certificates that can be verified~~ to ~~prove compliance with minimal health industry standards.~~		* User Identity proofing needs to be portable among healthcare providers.
	* All patients will be ~~provided with proof of acceptance into a provider's practice~~.
	* All devices and user agent software will come with certifications of compliance.		* All devices and user agent software will come with certifications of compliance.
	* ~~All providers that authenticate patients and authorize services~~ will make ~~their own determination as to~~ the ~~patient's identity~~.		* The [https://trustregistry.org/ Kantara Trust Registry] will make a [https://kantarainitiative.org/download/kantara-mobile-assurance-statement/ Mobile Authentication Assurance Statement] available for all apps the access private health information (PHI).

	===Patient Consent===		===Patient Consent===

Tomjones: /* Real World Participants */

2021-03-21T19:14:59Z

Real World Participants

← Older revision		Revision as of 19:14, 21 March 2021
Line 25:		Line 25:
	# Patient Support - is source of the user phone or computer and the code running on the user's phone or computer. It is trusted to protect the patient's credentials and medical records from disclosure.		# Patient Support - is source of the user phone or computer and the code running on the user's phone or computer. It is trusted to protect the patient's credentials and medical records from disclosure.
	# Covered Entities (called providers below) - Any entities that is covered by HIPAA rules including the places that a patient goes for medical care. They will all be recognized as such in the digital world by virtue of trust certificates. Many of these will perform [[Identity Proofing]]. All will provide evidence that a user is accepted as a patient at the entity to any other registered covered entity. (For the [[Record Locator Service]].) The services that they provide are listed below.		# Covered Entities (called providers below) - Any entities that is covered by HIPAA rules including the places that a patient goes for medical care. They will all be recognized as such in the digital world by virtue of trust certificates. Many of these will perform [[Identity Proofing]]. All will provide evidence that a user is accepted as a patient at the entity to any other registered covered entity. (For the [[Record Locator Service]].) The services that they provide are listed below.
			# Electronic Health Record (EHR) is where the patient records are accessible. It is a Covered Entity, but is not alway the provider. For example the EHR can be on HIE.

	===Identifers use within the Ecosystem===		===Identifers use within the Ecosystem===

Tomjones: /* Identifers use within the Ecosystem */

2021-03-21T19:13:07Z

Identifers use within the Ecosystem

← Older revision		Revision as of 19:13, 21 March 2021
Line 31:		Line 31:
	# Patient ID = this is an identifier that is known to the Patient. The goal is that the patient ID is created by the patient and is self-sovereign, that is owned by the patient.		# Patient ID = this is an identifier that is known to the Patient. The goal is that the patient ID is created by the patient and is self-sovereign, that is owned by the patient.
	# eID = an electronic ID issued by a sovereign state. This may not apply to all jurisdictions or interactions. (Sometime call a mobile id (MID) which can be confusing in healthcare.)		# eID = an electronic ID issued by a sovereign state. This may not apply to all jurisdictions or interactions. (Sometime call a mobile id (MID) which can be confusing in healthcare.)
	3 WebID = a name of the website (or EHR) than can be recognized by the application when connecting.		# WebID = a name of the website (or EHR) than can be recognized by the application when connecting (aka an EHR URL). This is not always the provider when an EHR covers several providers.)
	# Medical Record Locater = this is a combination of the EHR locator and the Medical ID (MID) that they EHR creates for the patient.		# Medical Record Locater = this is a combination of the EHR locator and the Medical ID (MID) that they EHR creates for the patient.

Tomjones: /* Names use within the Ecosystem */

2021-03-21T19:11:51Z

Names use within the Ecosystem

← Older revision		Revision as of 19:11, 21 March 2021
Line 26:		Line 26:
	# Covered Entities (called providers below) - Any entities that is covered by HIPAA rules including the places that a patient goes for medical care. They will all be recognized as such in the digital world by virtue of trust certificates. Many of these will perform [[Identity Proofing]]. All will provide evidence that a user is accepted as a patient at the entity to any other registered covered entity. (For the [[Record Locator Service]].) The services that they provide are listed below.		# Covered Entities (called providers below) - Any entities that is covered by HIPAA rules including the places that a patient goes for medical care. They will all be recognized as such in the digital world by virtue of trust certificates. Many of these will perform [[Identity Proofing]]. All will provide evidence that a user is accepted as a patient at the entity to any other registered covered entity. (For the [[Record Locator Service]].) The services that they provide are listed below.

	===~~Names~~ use within the Ecosystem===		===Identifers use within the Ecosystem===
	There are a variety of identifiers used by the real-world entities described above. These are the handles to which trust is assigned.		There are a variety of identifiers used by the real-world entities described above. These are the handles to which trust is assigned.
	# ~~Legal name in~~ the ~~jurisdiction(s) of interest. (eg 1- certificate of incorporation (Providence who owns several DBAs)~~. ~~2- A DNS domain name.)~~		# User ID = the identifier used by the patient or guardian when the sign into the provider or IHE portal.
	# ~~Doing Business As (DBA) for~~ the ~~practice~~. ~~( eg Swedish Physicians) Note~~ that ~~this may or may not have a legal or DNS name~~ - ~~not sure if~~ that is ~~important)~~		# Patient ID = this is an identifier that is known to the Patient. The goal is that the patient ID is created by the patient and is self-sovereign, that is owned by the patient.
	# ~~Specific physical location where service was provided~~ to a ~~patient.~~ (~~eg Pine Lake Office of Swedish Physicians~~) ~~(aka POP - point of presence~~)		# eID = an electronic ID issued by a sovereign state. This may not apply to all jurisdictions or interactions. (Sometime call a mobile id (MID) which can be confusing in healthcare.)
	~~# Endpoint were~~ a ~~specified digital service is provided.~~ (~~eg A url consisting of: DNS scheme: host name: port number / service name # information provided~~ by ~~user)~~		3 WebID = a name of the website (or EHR) than can be recognized by the application when connecting.
	~~# Specific person providing~~ the ~~service~~.		# Medical Record Locater = this is a combination of the EHR locator and the Medical ID (MID) that they EHR creates for the patient.
	#~~# The endpoints~~ of ~~particular interest to the user are~~ the ~~PHI records location~~ and the ~~place where appointments are made and calendars kept.~~
	~~# PHI processing entity~~ (~~eg Epic~~)

	==Problems==		==Problems==

Tomjones: /* Real World Members */

2021-03-21T19:04:54Z

Real World Members

← Older revision		Revision as of 19:04, 21 March 2021
Line 19:		Line 19:
	# After the patient has visited a PCP (Primary Care Physician) they are entitled to acquire their medical records. Where the records are stored digitally, the patient must be give online access.		# After the patient has visited a PCP (Primary Care Physician) they are entitled to acquire their medical records. Where the records are stored digitally, the patient must be give online access.

	===Real World ~~Members~~===		===Real World Participants===
	*The patient and the physical places where the patient goes are all legal entities and have legal obligations.		*The patient and the physical places where the patient goes are all legal entities and have legal obligations.

Tomjones: /* Full Title or Meme */

2021-03-21T19:01:49Z

Full Title or Meme

← Older revision		Revision as of 19:01, 21 March 2021
Line 2:		Line 2:
	There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two levels of protection that are prescribed:		There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two levels of protection that are prescribed:
	# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)		# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)
	# Applications that are designed to work with a patient's health plan and provide information ~~bace~~ to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)		# Applications that are designed to work with a patient's health plan and provide information back to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)
	# Applications that are designated as medical devices by the FDC are currently out-of-scope, but may be addressed at a future time.		# Applications that are designated as medical devices by the FDC are currently out-of-scope, but may be addressed at a future time.

Tomjones: /* Full Title or Meme */

2021-03-21T19:01:17Z

Full Title or Meme

← Older revision		Revision as of 19:01, 21 March 2021
Line 2:		Line 2:
	There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two levels of protection that are prescribed:		There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two levels of protection that are prescribed:
	# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)		# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)
	# Applications that are designed to work with a patient's health plan an provide information bace to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)		# Applications that are designed to work with a patient's health plan and provide information bace to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)
	# Applications that are designated as medical devices by the FDC are currently out-of-scope, but may be addressed at a future time.		# Applications that are designated as medical devices by the FDC are currently out-of-scope, but may be addressed at a future time.

Tomjones: /* Full Title or Meme */

2021-03-21T19:00:28Z

Full Title or Meme

← Older revision		Revision as of 19:00, 21 March 2021
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two ~~level~~ of protection that are prescribed:		There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two levels of protection that are prescribed:
	# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)		# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)
	# Applications that are designed to work with a patient's health plan an provide information bace to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)		# Applications that are designed to work with a patient's health plan an provide information bace to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)

Tomjones: /* Full Title or Meme */

2021-03-21T18:59:58Z

Full Title or Meme

← Older revision		Revision as of 18:59, 21 March 2021
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	There are two ~~contexts~~ where [[Trustworthy Healthcare Application]] ~~is defined~~ and so there are two ~~memes~~ that ~~it covers~~:		There are two models where [[Trustworthy Healthcare Application]] guidelines are needed and so there are two level of protection that are prescribed:
	# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)		# Applications that are designed specifically to meet the Cures act requirements for access to download patient information (aka a read-only app.)
	# Applications that are designed to work with a patient's health plan an provide information bace to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)		# Applications that are designed to work with a patient's health plan an provide information bace to the health care provider ([https://tcwiki.azurewebsites.net/index.php?title=Healthcare_Write-back called write-back by the ONC].)