---
# System prepended metadata

title: 'FHIR AuthZ Meetup: SMART, TEFCA, & Beyond'
tags: [presentation]

---

# FHIR AuthZ Meetup: SMART, TEFCA, & Beyond
[@JoshCMandel](https://twitter.com/JoshCMandel)


#### Outline
* Granular scopes in SMARTv2
* Focused sharing with SMART Health Links
* Patient rights vis-a-vis B2B sharing in TEFCA

---

## Granular Scope Capabilities

### FHIR Resource Scope Syntax
- `[level]/[Resource].[cruds]?param=value&param=value`
 - Example: `patient/Observation.rs?category=vital-signs`

---

### Bucketing permissions by level
- `patient/` Allow access to specific data about a single patient
- `user/` Allow access to all data that the authorizing user can access
- `system/` Allow access to all data that the client is authorized to access

---

#### Examples
 - `patient/Observation.rs?category=vital-signs` - Read and search all vitals for a patient
   - Allows an app to view a patient's vital signs, lab results, etc.
 - `user/Immunization.rs` - Read and search all observations that the user can access
   - Allows a parent to coordinate family's immunizations
 - `system/Observation.c` - Create observations from a backend service
   -  Allows B2B integration that can submit new observations
   - Allows an app to record new vital signs, lab results, etc. for a patient

### Challenges with Custom Operations
- No standardized scopes for custom operations like...
  - `/Patient/$export`
  - `/Patient/:id/$purge`
  - `/Patient/$update-name`
 - Difficult to standardize a scope for operations given
   - Attachment point types (`/`, `/:type`, `/:type/:instance`)
   - Attachment point instances (any? any visible?)
   - Input parameter restrictions?
   
   
#### Suggestions

TL;DR Define custom scopes for now. Start with your operation URL for transparency, e.g. `https://myo.example.org/OperationDefinition/locate-patient`

Looking ahead, SMART might focus on standardizing data element-level permissions (example syntax only):

  * Read `Patient.name`
     - `patient/Patient.r{{name}}`
  
  * Write `Patient.address` or `Patient.photo`
     - `patient/Patient.u{{address | photo}}`

---

## End-User Authorization with SMART Health Links
- Simple way for patients to share data directly with apps/individuals
- Example: Sharing glucose measurements via a SMART Health Link
 - Patient generates [a link](https://joshuamandel.com/cgm/#shlink:/eyJ1cmwiOiJodHRwczovL2pvc2h1YW1hbmRlbC5jb20vY2dtL3NobC8xMjBkYXlfYWdwX2J1bmRsZV91bmd1ZXNzYWJsZV9zaGxfaWQwMDAwMDAwIiwiZmxhZyI6IkxVIiwia2V5IjoiYWdwX29ic191bmd1ZXNzYWJsZV9yYW5kb21fa2V5MDAwMDAwMDAwMDAwMCIsImxhYmVsIjoiSm9zaCdzIENHTSBEYXRhIn0) that provides access to their glucose data
![image](https://hackmd.io/_uploads/Hy4OVZnW0.png)
 - Can share this link with a coach, family member, or trusted app
 - Recipient can view/download the patient's glucose measurements
 - Straightforward way to grant targeted data access without complex policies

---

## TEFCA and Network-Based Exchange
- Organizational-level authorization decisions with broad impact
  - Example: All TEFCA participants support "treatment" PoU
   - Participants can query *everywhere* for treatment
 - But what if the query seems unrelated to treatment?
   - Recent issues in the tech news, perceived misuse
   - Highlights grey areas & need for transparency
- Transparency **for individuals**
  - 3 Principles: https://www.jmir.org/2022/11/e41750/
     - See my own data
     - Know when/why my data are queried
     - Opt out of sharing