Stream: smart/health-cards
Topic: Validating SHC terminologies
Grahame Grieve (Sep 02 2021 at 01:59):
Validating Vaccine Coding Systems
- GTIN: there's no way I can validate a GTIN? Does anyone have any ideas how I'd do that?
- CVX: I think is working fine
- AIR: System URI is https://www.humanservices.gov.au/organisations/health-professionals/enablers/air-vaccine-code-formats. I will figure out how to get this working
- SNOMED CT: all supported as far as I know. The validation comments say that tx.fhir.org doesn't host the UK edition, but is there UK users of this thing?
- ICD-11: Time for me to host it, I guess. We've been doing license negotiations slowly with WHO, which is why I haven't loaded it on tx.fhir.org
- ATC: The ATC expansion is wrong. @Rob Hausam this appears to be because the source is incomplete?
The validation instructions says "GLN" is not supported, but I didn't find any reference to that?
Grahame Grieve (Sep 02 2021 at 11:27):
AIR is fully supported now.
Max Masnick (Sep 02 2021 at 17:17):
@Grahame Grieve thanks, this is great! I will test with AIR.
Re: GTIN, we asked GS1 (the org responsible for GTIN) and there is not a central list of GTINs anywhere. My understanding is that an organization can request a GTIN from the GS1 office in their jurisdiction (e.g. GS1 United States), and that org is assigned a prefix as a "namespace" of sorts. What they do inside that namespace is up to them. So given a GTIN it's possible to know who owns it using something like https://gepir.gs1.org/index.php/search-by-gtin, but not possible to validate beyond that.
Some jurisdictions do have GTIN databases for drugs, like in the UK: https://services.nhsbsa.nhs.uk/dmd-browser/code-lookup
In the US, GTINs are the same as National Drug Codes so there is a database for that.
If you want to follow up with the GS1 folks to get more information, I'm happy to put you in touch with our contact there.
Grahame Grieve (Sep 02 2021 at 19:13):
I'm talking to GS1 central. But presumably the list of possible GTINs for vaccines is a relatively short list. When would you use a GTIN instead of a clinical code?
Grahame Grieve (Sep 03 2021 at 20:04):
more, I don't understand this. The guidance says "Verifiers SHALL be able to meaningfully process and interpret codes from ALL of the systems listed above." And then it rules display out for GTIN. So you just get a raw GTIN.
How can any system conform to this? How can it be useful? How can you possibly do anything presented with a GTIN, even if you can somehow magically get a display?
Peter Jordan (Sep 03 2021 at 21:45):
In NZMT, GTINs are mapped to CTTP (and some TPUU) codes. So far, there's only a single mapping to a COVID-19 vaccine. However, within the NZ ePrescription Service, GTINs don't come with descriptions, so are used purely as supplementary identifiers (and the FHIR spec states that "GTINs may be used in both Codes and Identifiers").
Max Masnick (Sep 07 2021 at 14:52):
When would you use a GTIN instead of a clinical code?
@Grahame Grieve when we were developing the IG, we couldn't find any terminology other than GTIN that could identify specific formulations of all (or at least many of) the various vaccines worldwide.
It is possible to look up the manufacturer associated with a GTIN even if you don't know the specific product that GTIN refers to. When using GTIN in conjunction with a less specific code like ICD11#XM0GQ8 ("COVID-19 vaccine, RNA based"), this can identify the formulation so Verifiers can determine if the right vaccination schedule was followed.
It looks like CVX now includes a bunch of additional vaccines now, so this may be a better choice now for most/all SHCs so a single code can be used to identify the vaccine.
Max Masnick (Sep 07 2021 at 14:58):
The guidance says "Verifiers SHALL be able to meaningfully process and interpret codes from ALL of the systems listed above." And then it rules display out for GTIN. So you just get a raw GTIN.
If only the GTIN is provided (e.g., they don't also have an ICD11 or SNOMED code), the Verifier could look up the manufacturer associated with the GTIN and display "unknown vaccine from Acme, Inc.".
If GTINs are used by Issuers of SHCs then someone will presumably come up with a list of valid GTINs with human-readable descriptions...but I agree this could be hard as GTINs may differ country by country for the same product
Grahame Grieve (Sep 07 2021 at 19:58):
the Verifier could look up the manufacturer associated with the GTIN
how? so far GS1 have told me that you can't do this by API without commercial arrangements...
Grahame Grieve (Sep 07 2021 at 19:59):
And at a minimum, the specification should explain the issues and provisos around the use of GTINs
Max Masnick (Sep 08 2021 at 10:12):
And at a minimum, the specification should explain the issues and provisos around the use of GTINs
:thumbs_up: We were in contact with GS1 when developing the IG so I'm getting back in touch with them to see what they recommend.
Isaac Vetter (Sep 09 2021 at 21:47):
It looks like CVX now includes a bunch of additional vaccines now, so this may be a better choice now for most/all SHCs so a single code can be used to identify the vaccine.
There's at least a few countries doing exactly this, notably multiple Canadian provinces. May we consider stronger guidance in the specification to elevate CVX as the best choice for issuers in the absence of a obvious candidate (e.g. AIR), even when used issued and/or verified outside of the US?
Josh Mandel (Sep 09 2021 at 21:49):
I would love to see that happen. There is immense confusion, and we have almost as many vocabularies as we have vaccine products at this point, with substantial overlap.
Isaac Vetter (Sep 09 2021 at 21:55):
https://jira.hl7.org/browse/FHIR-33475
Peter Jordan (Sep 09 2021 at 21:56):
Josh Mandel said:
I would love to see that happen. There is immense confusion, and we have almost as many vocabularies as we have vaccine products at this point, with substantial overlap.
e.g. https://terminz.azurewebsites.net/fhir/ValueSet/covid-19-vaccines/$expand
Max Masnick (Sep 10 2021 at 10:26):
Thanks @Josh Mandel and @Isaac Vetter -- we'll look at prototyping this approach. I would also love to simplify the vocabulary given the changes since the spring.
Max Masnick (Sep 10 2021 at 10:29):
@Peter Jordan for NZ, do you know if CVX is typically used?
And what's this code system? http://nzmt.org.nz 47407721000116102 Comirnaty (Pfizer-BioNTech) (trade product)
Peter Jordan (Sep 10 2021 at 19:53):
CVX is the code system used in NZ for recording vaccines used in medications. http://nzmt.org.nz is the NZ Medicines Terminology used, not surprisingly, for coding medications.
Max Masnick (Sep 10 2021 at 20:00):
Peter Jordan said:
CVX is the code system used in NZ for recording vaccines used in medications. http://nzmt.org.nz is the NZ Medicines Terminology used, not surprisingly, for coding medications.
Ok, so CVX is what would be in a SMART Health Card then?
Peter Jordan (Sep 10 2021 at 20:51):
Yes - I certainly hope so, unless our Ministry of Health decides to map them to SNOMED CT (possible) or ICD-11 (unlikely).
Rob Hausam (Oct 15 2021 at 11:11):
The full version of ATC (from May 2020) is now available on tx.fhir.org. It took a while to get there, but now that the process is worked out, when we have get further updates to the source the updates on the server should be much easier and quicker.
Poonam Kariya (Dec 10 2021 at 13:28):
Hi,
We are trying to pass canada pass to smart health card SDK "https://github.com/smart-on-fhir/health-cards-dev-tools"
and we are facing this issue for one canada pass and FHIR bundle is not showing results
Other two canada pass are successfully showing results.
How can we get FHIR bundle content even if issuer or public key is not verified by JWS?
How we can resolve this error ? can we find the list of issuers public keys from Canada?
"errors": [
"JWS verification failed: can't find key with 'kid' = qFdl0tDZK9JAWP6g9_cAv57c3KWxMKwvxCrRVSzcxvM in issuer set",
"JWS.payload.vc shouldn't have a @context property",
"JWS.payload.vc.type : 'VerifiableCredential' is not required and may be omitted to conserve space",
"Schema: /type error : must be equal to one of the allowed values",
"Schema: property must must match exactly one schema in oneOf",
"Schema: /type error : must be equal to one of the allowed values",
"Schema: property must must match exactly one schema in oneOf"
we are checking it on https://demo-portals.smarthealth.cards/VerifierPortal.html and we have implemented this SDK already
https://github.com/smart-on-fhir/health-cards-dev-tools
Hi,
We are trying to pass canada pass to smart health card SDK "https://github.com/smart-on-fhir/health-cards-dev-tools"
and we are facing this issue for one canada pass and FHIR bundle is not showing results
Other two canada pass are successfully showing results.
How can we get FHIR bundle content even if issuer or public key is not verified by JWS?
How we can resolve this error ? can we find the list of issuers public keys from Canada?
"errors": [
"JWS verification failed: can't find key with 'kid' = qFdl0tDZK9JAWP6g9_cAv57c3KWxMKwvxCrRVSzcxvM in issuer set",
"JWS.payload.vc shouldn't have a @context property",
"JWS.payload.vc.type : 'VerifiableCredential' is not required and may be omitted to conserve space",
"Schema: /type error : must be equal to one of the allowed values",
"Schema: property must must match exactly one schema in oneOf",
"Schema: /type error : must be equal to one of the allowed values",
"Schema: property must must match exactly one schema in oneOf"
we are checking it on https://demo-portals.smarthealth.cards/VerifierPortal.html and we have implemented this SDK already
https://github.com/smart-on-fhir/health-cards-dev-tools
Vitor Pamplona (Dec 10 2021 at 13:36):
Canadian provinces rotate KIDs frequently. You will need to manage a trust registry with cached keys of the past in order to successfully verify Canadian SHCs
Vitor Pamplona (Dec 10 2021 at 13:38):
That's what we do on our SDK, it pings a cache of keys we maintain to make sure keys can always be found even if the issuer disappears.
Vitor Pamplona (Dec 10 2021 at 13:39):
We happen to have the key qFdl0tDZK9JAWP6g9_cAv57c3KWxMKwvxCrRVSzcxvM on our registry. See if this verifier helps: https://github.pathcheck.org/verify.html
Josh Mandel (Dec 10 2021 at 14:38):
To be clear, rotating keys is something SMART Health Cards supports in the core spec, and the rotated keys are still available for discovery. The practices Vitor is describing (where currently valid keys are absent from the public key set) are inconsistent with the specification, which is why you're having trouble with the standard tools.
Grahame Grieve (Dec 10 2021 at 19:48):
but the key issues shouldn't be relevant to the bundle, really. What exactly does "FHIR bundle is not showing results" mean? what results?
Last updated: Apr 12 2022 at 19:14 UTC
