August 2015 - WG-UMA - mailman.kantarainitiative.org

Draft minutes of UMA telecon 2015-08-20
by Eve Maler 20 Aug '15

20 Aug '15

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-20 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-20> Minutes Roll call Quorum was reached. Minutes approval tbs Trust elevation TC writeup reviews and trust elevation/ABAC generally Andrew wants a half-page, and it's hard to keep it that short! Please review and shorten. Is the permission ticket an essential concept for trust elevation, or not? Step-up authentication is one mechanism; non-uniquely identifying, but nonetheless trusted, claims are another that seems special to UMA ("CBAC"). There's a conversation <http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20150810/0056…> going on about the role of software statements and OIDC in trust elevation. Mike has been following this. NIST has an ABAC "building block" under review; Bill Fisher has reached out to offer a conversation with UMAnitarians. Eve will coordinate. Restricting GitHub editing Do we need to worry about this? The upside is total IP protection. The downside is the pain of making all WG participants get GitHub accounts (a pain to the people) and become collaborators on the repo to submit GitHub issues (a pain to the repo admins). Current sensibility is positive. Legal subgroup report We've been in massive use-case collection mode. The APAC sync folks had interest and asked about the big thread. We hope to start mappings to legal concepts very soon. Andi expresses a hope that specific jurisdictional legal requirements won't impact the specs. E.g., US healthcare examples often don't apply to UK and Europe. Adrian would like to focus at some point on adoption strategy, apart from specific legal strategy. We can cast our eye over lessons learned and release strategy. Issue resolution work We cleared about half the outstanding items in the spreadsheet and in the issues list. AI: Maciej: Tweak spec text related to #147, #170, and #172, and close issues as appropriate. AI: Eve to send email to WG links highlighting newly proposed #163 text, which impacts #164 as well; WG to discuss before next week. AI: Eve to send email to WG discussion topic around #168; WG to discuss before next week. AI: Maciej, Eve, and Andi: Do issue assignments before next week. AI status AI: Thomas: Review the charter for potential revisions in this annual cycle. AI: Sal: Investigate IP implications of formal liaison activities with other Kantara groups with the LC, and ultimately draft an LC Note as warranted. AI: Gil: Edit the UIG to add Ishan's content and excerpt it for Eve to add to the FAQ, pointing everyone to the UIG. AI: Sal: Fill out IDESG form to have UMA adopted as a recommended standard for use in the IDESG framework. AI: Mike: Write SCIM protection case study to highlight client claims-based use case. AI: Maciej: Write as many sections for the UIG as he can. AI: Justin: Write a UIG section on default-deny and race conditions. Attendees As of 30 Jul 2015 (pre-meeting), quorum is 7 of 12. (François, Domenico, Sal, Thomas, Andi, Phani, Robert, Maciej, Eve, Arlene, Irwin, Mike) Eve Andi Arlene Mike Maciej Thomas François Non-voting participants: Adrian James Sarah Scott Jin George Regrets: Mark Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Notes from APAC-friendly UMA WG sync 2015-08-20
by Eve Maler 19 Aug '15

19 Aug '15

Attending: Eve, Gil, Allan, Colin Agenda: - "The very long thread” on legal use cases Eve was driving at “negative use cases”, to get at the points where things go wrong and legal experts are needed. E.g., what happens if Bob gets access outside Alice’s stated policy? Mark is intending to map use cases to consent receipts. Adrian is keen to explore Alice-run/built AS variants. - UMA release schedule update We have all hands on deck for working on the patch release, and we’re on track for our stated timeline. We refactored the non-backlog issue list. - UMA Dev update Save the date: A kickoff call is planned for that WG on Sep 9 (in APAC time zones). - GitHub repo hygiene Eve is thinking about requiring collaborator status to submit GitHub issues (that is, “closing" the repo). Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Legal Use Case - User Managed vs. Controlled Access
by Mark Lizar 19 Aug '15

19 Aug '15

Pushing the penny forward an inch. As a follow up to the MVCR, there are it seems, some legal considerations that surround the application of policy in terms of what takes precedent, the privacy policy, the terms of use policies. As well, liability around who owns, controls and manages the data is also critical and needs to be clear. T A simple way to start putting this all together is to look at applying the MVCR roles ( that are anchored in ISO 29100 “roles") as an overlay to Adrian's (and any other) UMA use cases to address the legal questions and topics that arrise. To get things going here are a couple of items and their flows for the legal eagles. . A. Data Rights Ownership; User Managed Access Vs. User Controlled Access. (see use case below) B. Are T&C’s subjected to a Privacy Policy? Does the legal chain of authority that leads to the provisioning of roles and privileges, for access to personal attributes, start with the privacy policy for enrolment, then the terms and conditions? For example: 1. In the MVCR their is an undiscussed assumption that the privacy policy which provides the consent is counted as the primary contract for the use of personal information so the service provider may then use the personal information. At which point, The service provider uses the PI provided with the consent and then enrols the service user with a secondary policy, the terms and conditions, which Alice needs to contractually abide by, to use the service. As the requirement for a privacy policy and consent is legal infrastructure, and the T&C’s is organisation specific, the T&C’s are subjected to the privacy policy. i.e. legal requirements trump the business requirements in a court of law. 2. In regards to the above Issue 2 . What are the legal connotations - I.e. If a user blocks access to a PII resources (using EU law), the terms for that service might be that the service is stopped. But, the user may be required by the contract to keep paying for that service according to the contract and licence agreed too, and the service may be legally required to keep the user data while still charging for the service. (of course this is over simplified) i.e. the org indemnifies themself by give the functionality to users to manage the access to a copy of the user data the org controls. But in a very privacy by design way. The point being, this would appear to be different UMA Legal Flows than the user (in control of her own data) licensing access to the use of an attribute using UMA, which seems to me, like a different legal flavour of UMA all together. (closer to the UMA Health Flow) I.e.. Alice can turn on and off access to all or just a single attribute at any time in any scoped context. 3. Legal Flow/Use Case: User Managed Access Vs. User Controlled Access. UMA profile that is of two flavours Flavour A. Alice controls access to her own PII, authorises access using UMA to personal profile Flavour B. Alice Manages Access to her own PII . Using UMA installed behind a company siloed (and own Company copy of PII that the user maintains) that runs UMA so users can have more functionality through this silo. Note: this is the difference between the user being the data controller or the user being the data subject. Who controls and owns the data rights? if the service user is also the data controller, then data protection and privacy laws are effected in that the liability and policy for protecting the data lies with the service user, and the liability or contract/license for the usage of the data lies with the company. - this would be a different policy structure, with a consent directive and UMA, for orgs to agree too. Like a Personal Privacy Policy (PPP) to cover the different liability. liability of being a data controller no longer applies the same way as data protection liability is moved (reduced, or changed into another form) if the data subject is owner/controller of the data and its access. For Example: A good example here is in health care where consent directives and laws and frameworks are mature. (i.e. consent and access controls are being bound together already) With Flavour A, Alice Owns and Manages PII, gets to see how many times her personal data (medical records) were accessed, when and by whom Flavour B, Alice, gives away PII - that is already under the T&C’s of service, and owed by the company or institution. in the second circumstance she does not get to see how many times her data was accessed or even what the live status is of her active consents and medical data usage, unless she pays a fee to the Experian like company that owns them. With the MVCR based authorisation log Alice knows that her permission and access to her data should line up to the purpose of the sharing, the permission to access data, and the specified purpose of the active consent the company now maintains for her This would be a very helpful tool for alice to quickly understand medical sharing policies Without clarity between UMA Flavour A & B, does UMA have the opportunity to be : incredibly good (the good guys), because Alice is in full control of their own data incredibly bad, because Alice thinks she has control of a copy of their data. Or that another service provider, that she is forced to trust, has her best interests at hear. should their be a different flavour of UMA (in terms of legal considerations) that designates between A & B? Can their be a flavour of UMA that is both A&B? The MVCR - Binding A & B Together A consent receipt is being developed as a tool that will help bind consent and legal requirements to access roles and policy rules for sharing data. The MVCR is designed to make explicit the policies and notice requirements to make binding these together legitimate and understandable - i.e. this can be used to tie the role of data subject to the liability of access controls and vice versa For example the various frameworks that are used in the space of consent and access control can be added to a receipt. In this scenario, we would see Alice is at a hospital in the US Alice consents to provide PII to hospital for medical treatment Alice gets a consent receipt On receipt is UMA Icon and a HIPPA icon linked to legal requirements, or maybe just a field for a URI that links directly to the PPP, which has all the links and info needed for Alice’s medical records and consent directives (from her AS) Every test or comment can be then linked to her PPP and available for the next health data context This receipt under info sharing would have the PPP Icon, the HIPPA TrustMark icon, and the UMA icon all linked to the audit, enforcement and complaint processes that all of these frameworks require. In parallel to the US health System The UK’s heath care system is the reverse and has the same problems but for different reasons it is a universl health care system, where it costs the infrastructure money to provide medical services. (as oppose to the US) where the infrastructure makes money by providing medical services. In the UK you (the patient) are unable to see if you have consented to sharing PII, with whom you have shared, what medical records you have with Sensitive Medical Data spread on computers ranging from win 95 and up. An UMA enabled doctors office in the UK should be able to receive consent, use the medical data from the US and provide seamless service. So how would a consent receipt look like if it was used to bind ths A Consent Receipt extend the MVCR by: Adding UMA Framework Adding PPP (Personal Privacy Policy: Like a Consent Directive) police requirements Adding HIPPA: Add UK Jurisdiction profile and Medical PII profile to the consent requirements, add these processes at point of consent or enrollment at UK health care centre. These might all appear as ICONS of the above listed to the receipt and managed by 3rd parties operating the trust frameworks for the above elements. Mark > On 10 Aug 2015, at 18:36, Dazza Greenwood <dazza(a)civics.com <mailto:dazza@civics.com>> wrote: > > Ok Eve, I'm on it. Looking forward to see the negative cases. > > Hi Mark, do you have any additional use cases to consider? > > Thanks, > - Dazza > > _ _ _ _ _ _ _ _ _ _ _ _ _ _ > | Dazza Greenwood, JD > | CIVICS.com <http://civics.com/>, Founder & Principal > | MIT Media Lab, Visiting Scientist > | Vmail: 617.500.3644 > | Email: dazza(a)CIVICS.com <mailto:dazza@CIVICS.com> > | Biz: http://CIVICS.com <http://civics.com/> > | MIT: https://law.MIT.edu <https://law.mit.edu/> > | Me: DazzaGreenwood.com <http://dazzagreenwood.com/> > | Twitter: @DazzaGreenwood > | Google+: google.com/+DazzaGreenwood <http://google.com/+DazzaGreenwood> > | LinkedIn: linkedin.com/in/DazzaGreenwood <http://linkedin.com/in/DazzaGreenwood> > | GitHub: github.com/DazzaGreenwood/Interface <http://github.com/DazzaGreenwood/Interface> > | Postal: P.O. Box 425845 Cambridge, MA 02142 > | _ _ _ _ _ _ _ _ _ _ _ _ _ _ > > On Mon, Aug 10, 2015 at 3:44 PM, Eve Maler <eve(a)xmlgrrl.com <mailto:eve@xmlgrrl.com>> wrote: > Hi Dazza— Please feel free to send links and updates to the list. I have an action item to work on additional use cases (“negative” ones), and health use case patterns definitely aren’t the only ones we want to consider (nor am I positive that Adrian has captured all of those). Mark may want to contribute some too. And we probably want to spend more than one week on reviewing and understanding them. :-) > > Eve > >> On 10 Aug 2015, at 12:12 PM, Dazza Greenwood <dazza(a)civics.com <mailto:dazza@civics.com>> wrote: >> >> Update - As promised, I put the draft mission, use cases and other background materials on the current GitHub wiki and am UMA-customizing a basic "how to use GitHub issues and wiki pages - for lawyers" faq. >> >> Are the use cases from Adrian solid enough to work on and reflect the business case(s) you need to focus on? Also, do these use cases correctly and completed highlight the UMA functions and flows or is anything off base, incomplete etc? >> >> Anything else needed before next meeting? Should probably send links and ask people to contribute or think about something. Minimally, I'd suggest maintaining some focus on the use cases for now, to ensure an apples to apples anchor for legal conversation and to provide a double check basis for mapping stuff people say from legal to tech and vice versa. >> >> Thanks, >> - Dazza >> >> | Sent from my iPhone >> | Please Forgive Typos >> _________________ >> | Dazza Greenwood, JD >> | CIVICS.com <http://civics.com/>, Founder & Principal >> | MIT Media Lab, Visiting Scientist >> | Vmail: 617.500.3644 <tel:617.500.3644> >> | Email: dazza(a)CIVICS.com <mailto:dazza@CIVICS.com> >> | Biz: http://CIVICS.com <http://civics.com/> >> | MIT: https://law.MIT.edu <https://law.mit.edu/> >> | Me: DazzaGreenwood.com <http://dazzagreenwood.com/> >> | Twitter: @DazzaGreenwood >> | Google+: google.com/+DazzaGreenwood <http://google.com/+DazzaGreenwood> >> | LinkedIn: linkedin.com/in/DazzaGreenwood <http://linkedin.com/in/DazzaGreenwood> >> | GitHub: github.com/DazzaGreenwood/Interface <http://github.com/DazzaGreenwood/Interface> >> >> On Aug 10, 2015, at 2:59 PM, Eve Maler <eve(a)xmlgrrl.com <mailto:eve@xmlgrrl.com>> wrote: >> >>> I created a (really huge) swimlane and a pro/con list, and a bit more... I ended up writing a recommendation. You can find the whole thing linked from here: >>> >>> https://docs.google.com/document/d/1OsIqPbVNx66vypnCzjxoFjX0AHCD_rEmgP8Q-5h… <https://docs.google.com/document/d/1OsIqPbVNx66vypnCzjxoFjX0AHCD_rEmgP8Q-5h…> >>> >>> Eve >>> >>> Eve Maler | cell +1 425.345.6756 <tel:%2B1%20425.345.6756> | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com> >>> >>> _______________________________________________ >>> WG-UMA mailing list >>> WG-UMA(a)kantarainitiative.org <mailto:WG-UMA@kantarainitiative.org> >>> http://kantarainitiative.org/mailman/listinfo/wg-uma <http://kantarainitiative.org/mailman/listinfo/wg-uma> > > > Eve Maler | cell +1 425.345.6756 <tel:%2B1%20425.345.6756> | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com> > >

4 12

Agenda for UMA telecon 2015-08-20 (those with assignments, please do them...)
by Eve Maler 19 Aug '15

19 Aug '15

See the spreadsheet for assignments and which ones I’m hoping we’ll knock down on Thursday. Thanks! http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-20 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-20> Date and Time Thu Aug 20 8:30-10am PT (we start 30 minutes earlier and meet for 90 minutes in August) Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> Agenda Roll call Minutes approval Sample motion: Approve the minutes of UMA telecon 2015-08-13 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2015-08-13>. Last-minute quick hits Trust elevation TC writeup reviews Legal subgroup report APAC sync report Issue resolution work (issues on GitHub <https://github.com/xmlgrrl/UMA-Specifications/issues>) (UMA V1.0.1 issue nominations spreadsheet <https://docs.google.com/spreadsheets/d/1s27E3JsHdvl_UzhGkQ8ZWP2dnyAXQAj5sxE…>) ("sprint" document <https://docs.google.com/document/d/1c50top8X6Aqw3CEVeX_SD2THqO508ihs14QwLem…>) Our timeline has us trying to knock down all of our issues by this week and next Then approving our Draft Recommendations for next-stage LC approval the following week or so AOB Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Fwd: NCCoE Seeks Collaborators for Access Control, PIV, and Mobile Device Security Projects
by Adrian Gropper 18 Aug '15

18 Aug '15

The ABAC one-pager mentions UMA by name. https://nccoe.nist.gov/sites/default/files/ABAC.pdf We're in the big leagues! Happy weekend, Adrian ---------- Forwarded message ---------- From: *National Cybersecurity Center of Excellence* < nccoe(a)service.govdelivery.com> Date: Friday, August 14, 2015 Subject: NCCoE Seeks Collaborators for Access Control, PIV, and Mobile Device Security Projects To: info(a)healthurl.com Today's Federal Register contains notices inviting technology vendors to collaborate with the National Cybersecurity Center of Excellence on three new projects to provide mobile device security, attribute based access control, and derived personal identity verification (PIV) credentials for mobile devices. Commercially available and open source products will be the modules in end-to-end example solutions to these challenges. All collaborators will enter into a Cooperative Research and Development Agreement (CRADA; see an example <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…>) with NIST in order to participate in a consortium for each build team. The projects will result in NIST Cybersecurity Practice Guides that show organizations how they can adopt these or similar capabilities. Companies with product characteristics that meet the desired characteristics in the Federal Register notices can submit letters of interest indicating that they'd like to work on one or more of these projects. Each Federal Register notice contains instructions for how to submit a letter of interest. Project pages and Federal Register notices can be found at: - Mobile Device Security Building Block <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - https://federalregister.gov/a/2015-20040 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - Attribute Based Access Control Building Block <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - https://federalregister.gov/a/2015-20041 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - Derived Personal Identity Verification Building Block <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> - https://federalregister.gov/a/2015-20039 <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> To learn more, read the NIST press release <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> . SUBSCRIBER SERVICES: Manage Preferences <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> | Unsubscribe <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> | Help <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> . Technical questions? Contact inquiries(a)nist.gov <javascript:_e(%7B%7D,'cvml','inquiries(a)nist.gov');>. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: Powered by GovDelivery] <http://links.govdelivery.com:80/track?type=click&enid=ZWFzPTEmbWFpbGluZ2lkP…> -- Adrian Gropper MD RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

4 4

Trust Elevation Model for OASIS Trust-El TC
by Mike Schwartz 18 Aug '15

18 Aug '15

UMA WG, Here is the copy I worked up per Andrew's request on the trust-el model for UMA: https://docs.google.com/document/d/1nRrQe9U0EiQpibYnUl-uYFW92LSRcegQfsQ6kfv… Andrew only wanted 1/2 page, so I tried not to get to lost in the details (i.e. that's why I didn't mention the permission ticket...) Anyway, if its so summary as to be misleading, any suggestions are welcome! - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Reminder: APAC-friendly UMA sync 2015-08-20
by Eve Maler 18 Aug '15

18 Aug '15

Thu Aug 20 at APAC-friendly times Voice: Skype: +99051000000481, room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) See the UMA calendar for additional dial-in and timing details (e.g., in the Pacific time zone the call will be held on 2015-08-19): http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> If you wish to be added to the calendar invitation, send a private message to me. The standing agenda is to review recent WG progress, collect participant feedback, check on action item status, and attend to any other relevant business. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

UMA Legal - Release of Information (ROI) Form
by Adrian Gropper 17 Aug '15

17 Aug '15

The ROI form is one of the three common legal documents in healthcare. (The other two are the Notice of Privacy Practices that's a meaningless and often unsigned notification about HIPAA and informed consent notices for specific procedures. ) The ROI form (attached) is quite typical and demonstrates all of the common elements. I've annotated it with the UMA terms. Jim Hazard and I have some experience translating the ROI form into the Common Accord format. I see the ROI form as the institutional complement to the 4 use-cases I shared last week. The use-cases were presented entirely from Alice's perspective. The ROI form is presented entirely from the service provider perspective. There is, of course, a third dimension: the third parties and intermediaries in the real world that have contractual relationships with Alice and her service provider. These are sometimes called Business Associates in healthcare and sometimes overlap with federations. Alice's third parties often look like software clients and apps. Adrian -- Adrian Gropper MD RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 2

Notes from UMA legal subgroup telecon 2015-08-14
by Eve Maler 14 Aug '15

14 Aug '15

Attending: Eve, Jon, Dazza, Mark, Tom, Adrian, Jeff S The wg-uma GitHub area has a wiki <https://github.com/KantaraInitiative/wg-uma/wiki> that Dazza has been populating. Work through Adrian email thread to discuss UMA flow and use cases Walk through an UMA demonstration? (Eve) Discuss consent receipts and logging — how do they map to use cases? See consent receipt generator demo? (Mark) How many more use cases do we really need? a lot? a few? none? Discuss licensure vs. contract (if time?) We walked through the UMA FAQ descriptions of the UMA flow. An autonomous web service client can often be in a data broker role: an institution where the RO doesn’t have a login. What about where “data rights ownership” resides in multiple parties? UMA the technology settled on a simplification where only a single entity (meaning a hunk of software or operator of same) can be an RO. But in reality, multiple parties (meaning persons or non-person entities that can do things like sign contracts) could have rights. Adrian says “There’s only one Alice”. Are we focusing exclusively, or primarily, on “Alice” use cases? UMA was originally intended to focus first and foremost on the individual as an RO, which is why our BO spec <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> points to NSTIC (while slightly debugging its definition of Individual). Action item/issue: We should circle back around to revising the definitions of party/entity/role etc. Look at the BO spec <https://docs.kantarainitiative.org/uma/draft-uma-trust.html> for background. The notion of data sharing with third parties is not very well covered in law, so UMA is significant in this area. The proposed EU Data Protection Law revisions do seem to have some relevance here, though. And this is where Consent Receipts are also relevant. Dazza suggests that the ISO 29100 statutory privacy roles <https://github.com/KantaraInitiative/wg-uma/wiki/UMA-Legal:-Use-Cases,-Role…> have relevance here, but Adrian isn’t so sure. Analysis of Alice-to-Alice N use case: The OAuth model is “pairwise” between each service and client app. UMA, by contrast, allows Alice to aggregate the records of all of her consents (and ultimately receipts of her consents). “Accounting for Disclosures” (A4D) is a HIPAA term of art; think of this just as a record of the consents, not as the “CDC" point. Ultimately, the use cases can blend; each is just meant to highlight a few aspects of desired features but they’re not mutually exclusive. How would we map the people and organizations named to roles? Would one of the EHRs be something like a Microsoft HealthVault? Where would a physician come into play? Adrian has kept PCPs and personal health records (PHRs) out of this use case for simplicity. Adrian’s “Release of Information” (ROI) form goes into detail about the “who to sue” question. In the US, frequently a PCP has a hospital affiliation, and the hospital uses a SaaS product run by an EHR vendor like Cerner. Eve has a login to evergreenhealth.cerner.com <http://evergreenhealth.cerner.com/>. She can use the (proprietary but UMA-like) portal to share the allergy portion of her health record with her husband. In this case, Cerner is a “Business Associate” of the institution. What Eve calls “figuring out who to sue” is what the pros would call “structuring the transaction”. When using a standard that allows multiple parties to hook up and use others for authorization, this is the goal. Next time: Accelerating on the use cases, and mapping to consent receipts, given our deeper understanding. Today counts as excellent progress — thanks, all! Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

2 1

UMA Legal - Mapping Roles
by Mark Lizar 14 Aug '15

14 Aug '15

Dazza and I were chatting about how roles might map between UMA and the MVCR, (which references roles from ISO 29100). We thought this might be useful in providing a place to start. - Mark Extracted from Binding Obligations Requesting Party Resource Server Operator Authorization Server Operator Authorizing Party Statutory Privacy Roles Extracted from ISO 29100 2.11 PII controller entity (or entities) that determines the purposes and means for processing PII other than individual persons who use data for personal purposes NOTE A PII controller sometimes instructs others (e.g., PII processors) to process PII on its behalf while the responsibility for the processing remains with the PII controller. 2.12 PII principal natural person to whom the PII relates NOTE Depending on the jurisdiction and the particular data protection and privacy legislation, the concept of a “PII principal” may also be defined as a “data subject”. 2.13 PII processor entity that processes PII on behalf of and in accordance with the instructions of a PII controller 2.26 third party an entity other than the PII principal, the PII controller and the PII processor, and the persons who are authorized to process the data under the direct authority of the PII controller or the PII processor UMA Healthcare Use Case Roles Extracted from Adrian's use cases Alice Bob EHR-1 Operator EHR-2 Operator PCP (Primary Care Provider) Custodian 3.1.1 Extrapolating from Existing Legal Scenarios"

1 0