Stream: argonaut
Topic: Endpoints project
Josh Mandel (Feb 28 2022 at 19:06):
Last week I committed to sharing a proposal for publishing endpoints together with associated organizational metadata. I'll go over the details on this week's call (i.e., I'm not assuming anyone will read this ahead of time) but if anyone wants to take a peek ahead of time:
https://hackmd.io/@argonaut/patient-access-brands
Douglas DeShazo (Mar 01 2022 at 14:07):
Do Wednesday call invites go out from a listserv or should I just use Confluence for meeting information?
Josh Mandel (Mar 01 2022 at 14:09):
For this project (which isn't currently targeting publication of an IG though HL7): details in Confluence, or ping @Brett Marquard to get added on a calendar invitation.
John Moehrke (Mar 01 2022 at 14:12):
IHE has an Implementation Guide going public-comment today on that topic. It can be found https://profiles.ihe.net/ITI/mCSD/3.6.0-comment/index.html
John Moehrke (Mar 01 2022 at 14:15):
This update to the mCSD IG is being driven by @Joe Lamy and the Sequoia Project use-cases. Can I ask that we not start another IG and rather focus on the IHE one?
Josh Mandel (Mar 01 2022 at 14:34):
Thanks for the link. We certainly aim to avoid creating anything unnecessary. Worth taking a look through our goals, which are modest; I don't necessarily see a conflict.
John Moehrke (Mar 01 2022 at 14:35):
I expect this is all early days... but if we end up with two different IGs with two different canonicals and various different extensions and valuesets... then YES there is a conflict.
Brett Marquard (Mar 01 2022 at 14:40):
Thanks for pointing to mCSD -- I see this sentence:
In addition, mCSD can enable connectivity by providing service endpoint lookup, such as “What is the FHIR server for this organization?”
I don't see explicit guidance on how it is recommends EHRs publish endpoints -- there are several detailed diagrams and few profiles. I suspect I am reading too fast! Maybe @Joe Lamy could take a quick peek at the hackmd page and then we can connect.
Brett Marquard (Mar 01 2022 at 14:41):
@John Moehrke Nobody wants different IGS and conflict. If you are seeing something specific already, please le me know
John Moehrke (Mar 01 2022 at 14:44):
public comment phase is just beginning, so now is a great way to put your use-case needs in.
Joe Lamy (Mar 01 2022 at 15:37):
Hey Brett. The Endpoint guidance is in section 1:46.8: https://profiles.ihe.net/ITI/mCSD/3.6.0-comment/volume-1.html#1468-mcsd-endpoint-usage-considerations.
The Argonaut IG, with its focus on patient-facing brands, looks fairly compatible and complementary with mCSD at first glance. mCSD focuses on organizational and personnel structure, and federation of directories. My update to mCSD adds Endpoint and OrganizationAffiliation to directories, and focuses on enabling Endpoints to IHE actors (including SOAP) and Endpoints to federated structures. It does not say much about REST Endpoints.
Douglas DeShazo (Mar 01 2022 at 16:10):
John Moehrke said:
This update to the mCSD IG is being driven by Joe Lamy and the Sequoia Project use-cases. Can I ask that we not start another IG and rather focus on the IHE one?
Does this get discussed in the eHex calls on Thursday or is it over on the IHE side?
Joe Lamy (Mar 01 2022 at 17:24):
Mostly on dedicated IHE calls.
John Moehrke (Mar 01 2022 at 17:29):
so far... flexible to anyone that wants to participate.
Douglas DeShazo (Mar 01 2022 at 17:38):
Infrastructure Planning as opposed to Technical committee?
John Moehrke (Mar 01 2022 at 17:40):
no, this is an active project. the above is the IG going out for public comment, starting today, until April 1.
Douglas DeShazo (Mar 01 2022 at 18:02):
Thanks John.
Jeff Brown (Mar 02 2022 at 12:08):
Where can I find the call details? I cannot find anything on the conference call center.
Brett Marquard (Mar 02 2022 at 12:15):
details on confluence.
Jeff Brown (Mar 02 2022 at 12:17):
Thanks!
John Moehrke (Mar 02 2022 at 12:26):
please put on the HL7 conference call center
Jeff Brown (Mar 02 2022 at 12:36):
Please do, as I still cannot find any schedule on the Argonaut page. Also, I do know that there are others from our Lantern team (including ONC) interested in joining.
Brett Marquard (Mar 02 2022 at 12:45):
Details are on this Argonaut Confluence Page. If you want me to add you to google calendar, send me a note.
John Moehrke (Mar 02 2022 at 12:51):
so this is not an official HL7 meeting? Which would mean the governance rules are not clear.
Brett Marquard (Mar 02 2022 at 12:54):
Participants requested we manage a google calendar invite with named emails so folks get updates properly -- we have several folks that don't track the HL7 calendar.
Jeff Brown (Mar 02 2022 at 13:09):
I believe that it is still relevant to update the HL7 calendar. Even if some don't track the HL7 Calendar, most of us do.
Brett Marquard (Mar 02 2022 at 13:10):
Sure thing, just forgive me if I forget to cancel in both places in the future
John Moehrke (Mar 02 2022 at 13:15):
plus some of us are under corporate rules that would forbid us from participating in a non-open meeting... aka one that is not advertised in HL7 calendar, and by personal invite only. -- known as collusion.
Brett Marquard (Mar 02 2022 at 13:23):
Interesting, I had thought our public meeting notes + access information posted publicly to Confluence were sufficient. Any person that has asked to be added to the Google Invite I have added. The HL7 calendar is challenging and IMHO accessible to 'insiders-only'.
John Moehrke (Mar 02 2022 at 13:26):
not saying your presumptions are wrong. more that perception is more important. -- yes, hl7 calendar does mean membership, but membership also means agreement to the governance rules which include anti collusion principle (and others like patent disclosure). Including others outside that means that you don't know their goal and their principles.
Cooper Thompson (Mar 02 2022 at 14:23):
I'm can't figure out if "colluding for industry interoperability" sounds like a good or bad thing...
Brett Marquard (Mar 02 2022 at 15:02):
@John Moehrke The IG posted here is down: https://profiles.ihe.net/ITI/mCSD/3.6.0-comment/index.html
John Moehrke (Mar 02 2022 at 15:03):
yes, sorry. Publishing issues are forcing me to change the canonical URL.
Brett Marquard (Mar 02 2022 at 15:03):
Will you also update to include an HL7 FHIR logo?
John Moehrke (Mar 02 2022 at 15:03):
give me a minute and I will give you the new one
John Moehrke (Mar 02 2022 at 15:04):
It does have HL7 FHIR logo
John Moehrke (Mar 02 2022 at 15:04):
https://profiles.ihe.net/ITI/mCSD/3.6.1/
John Moehrke (Mar 02 2022 at 15:05):
upper right is FHIR logo
Brett Marquard (Mar 02 2022 at 15:06):
I don't see Hl7 any where in that logo my friend.
John Moehrke (Mar 02 2022 at 15:07):
it is the HL7 fhir logo. not sure what more you are expecting
John Moehrke (Mar 02 2022 at 15:09):
This is an implementation guide from IHE... it would be odd to have a nascar like banner of all the standards organizations used by the IG (IETF, W3C, HL7, ISO, LOINC, SNOMED, etc...).. right?
Brett Marquard (Mar 02 2022 at 15:16):
Definitely not the logo police, but it was my understanding you couldn't use the flame stand alone any longer --
Brett Marquard (Mar 02 2022 at 15:17):
(let's stop cluttering this thread, will start private chat)
Josh Mandel (Mar 02 2022 at 20:05):
@Cooper Thompson I mis-spoke when I tried to answer your question about how an app can tell that multiple "peer" endpoints are associated with the same authorization/portal regime. I said you could tell by "patient portal URL" which is technically correct but unnecessary: as documented right now, it should be even simpler:
Associating multiple Endpoints with a single Brand provides a way to document “peer endpoints” associated with a single patient portal – e.g., to advertise resource servers that an app connecting to this SMART on FHIR server might also be authorized to access.
Josh Mandel (Mar 02 2022 at 20:06):
in other words, the fact that multiple Endpoints share the same Endpoint.managingOrganization is what identifies them as peers in this sense.
Cooper Thompson (Mar 02 2022 at 21:21):
That managingOrganization link probably often lets you make the inference in practice, but it doesn't seem explicit enough for an app developer to determine that there is a trust relationship between the auth server and the relevant resource servers, and it's ok to send an access token to a different resource server. What I'm really looking for is a statement from the managing organization that tells an app developer which URLs they can send an access token to.
Cooper Thompson (Mar 02 2022 at 21:22):
But maybe there are two parts: 1) doing the rough inference from managing organization and 2) getting the run-time actual aud list from the token issuer.
Josh Mandel (Mar 02 2022 at 21:36):
If the .well-known/smart-configuration from https://ehr.example.org/r2 points to a patientAccessBrands file advertising other FHIR endpoints associated with the same org, that should be an explicit enough representation. But perfectly fair for apps to match "token_endpoint" from smart-configuration as a sanity check.
Nick George (Mar 03 2022 at 00:35):
(deleted)
Josh Mandel (Mar 05 2022 at 00:46):
I've update the proposed spec to better explain how "interesting" cases are handled, and added three detailed examples
- Lab with thousands of locations nationwide
- Regional health system with independently branded affiliated practices sharing a portal
- Cancer center affiliated with one provider's portal for adult patients and another provider's portal for pediatric patients
Proposal: https://hackmd.io/@argonaut/patient-access-brands
Examples: https://hackmd.io/@argonaut/patient-access-brand-examples
Josh Mandel (Mar 09 2022 at 20:02):
From today's call: Please give respond here with a thumbs-up on this message if you'd prefer we skip next weeks call because of HIMSS!
Josh Mandel (Mar 11 2022 at 18:00):
If there's only one vote on the point above, we'll plan to keep next week's call. Will evaluate Monday.
(Also: I've started playing with UI for authoring branding bundles at https://joshuamandel.com/patient-access-brands. Hitting the "copy" button in the top row puts a FHIR bundle on your clipboard. I could easily set this up to start from an existing org tree in a published bundle, so orgs could propose updates to their entries in an EHR vendor-managed bundle. Could make it configurable to POST results back to a specified endpoint, or open an email to a specified address... Let's talk through integration strategies if this sounds useful.)
Brendan Keeler (Mar 14 2022 at 04:29):
Oh this thread is fun :popcorn:
Josh Mandel (Mar 14 2022 at 20:46):
Updating as promised: based on feedback so far, the plan is to keep our call this Wed.
Josh Mandel (Mar 23 2022 at 18:47):
OK, from today's call (notes here):
- We're happy with the state of the spec at https://hackmd.io/@argonaut/patient-access-brands -- we have no outstanding comments or unaddressed concerns, though we recognize that more may arise in testing.
- To that end: we plan to host a testing session in the May/June timeframe, meaning that EHRs would do implementation legwork between now and then. Please share any constraints re: timing ASAP, and we'll pick a date by next week.
- We'll be transitioning to zulip-based discussions, and spinning down our weekly calls. We'll use ad-hoc calls if discussion warrants.
Brett Marquard (Apr 06 2022 at 11:19):
What day is best for a one day Connectathon?
Brett Marquard (Apr 06 2022 at 11:20):
/poll Endpoint and Structure Connectathon
May 27
May 31
June 2
Last updated: Apr 12 2022 at 19:14 UTC
