August 2016 - WG-UMA - mailman.kantarainitiative.org

Agenda for UMA legal telecon 2016-08-05
by Eve Maler 04 Aug '16

04 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web interface <https://panel.turbobridge.com/webcall/>, code 178-2540# - Screen sharing: http://join.me/findthomas – NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-08-05 - Review User-Managed Access (UMA) in Contractual and Regulatory Contexts <https://docs.google.com/a/wunderlich.ca/document/d/1HGM5-PoJFMnepyrTX91hqHK…> - Nailing down the right 1-2 paragraph scenario for use throughout the document (send your alternatives before the meeting) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Apple is trying to patent UMA
by Adrian Gropper 03 Aug '16

03 Aug '16

We must be on the right track. http://www.patentlyapple.com/patently-apple/2016/07/apples-patent-pending-i… Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 1

Sigh, I did not just mean to delete Thursday's call from our calendar
by Eve Maler 03 Aug '16

03 Aug '16

I'm putting it back right now. We're still on. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2016-08-04
by Eve Maler 03 Aug '16

03 Aug '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-08-04 Date and Time - *Thursdays,* 9-10am PT - Skype: +99051000000481 / US +1-805-309-2350 / international lines <https://www.turbobridge.com/join.html> / web calling interface <https://panel.turbobridge.com/webcall/> / code 1782540 - Screen sharing: http://join.me/findthomas - NOTE: do not use the join.me dial-in line - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecon 2016-06-30 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-30> , 2016-07-07 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-07> , 2016-07-14 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-14> - Logistics items - Telecon interruptions - I-D expirations - For reference: MPD sequence diagram <http://www.websequencediagrams.com/files/render?link=2DdzslbnVj3ShhlrLVV-> and generic low-level sequence diagram <http://www.websequencediagrams.com/files/render?link=V0tZE2kWrO0l-tGlZX1a> - Client awareness of scopes and set math <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-06-02> - How to give resource set ID context to standardized resource set and scope semantics profile idea <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-28> ? - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Transferring standardized resource set and scope semantics out of band: digging deeper
by Eve Maler 01 Aug '16

01 Aug '16

Last Thursday we got this far in our understanding about transferring standardized resource set and scope semantics (say, as captured in the FHIR API or some other large, complex API implemented by multiple independent service operators) out of band of the UMA RSR process: http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-07-28 The AS would declare that it's using the protection API extensibility profile, meaning that it's prepare to go outside the normal AS-RS communication route for some part of its interaction with RS's. The community around the relevant API would define an extension profile. (We didn't talk about this, but such an extension profile would define an URI as an identifier, and this URI would be referenced in the AS config data/discovery document, advertising its compatibility with that profile.) The profile would, we believe, possibly involve explicit registration of a "bootstrap" resource that signals implicit registration of other resources that have standardized "type" fields. It occurs to me that what's incomplete about this scheme (at a minimum -- there may be other things missing) is that, in explicit RSR, we register "instances" and not "types" of resource sets, and the RS gets back from the AS a specific resource set ID that has been dynamically created for it, and can't *tell* the AS what resource set ID it wants. E.g., let's say that the RS registers a "bootstrap resource set" of "FHIR:EHR" type with the AS on Alice's behalf (and gets back a resource set ID of "foo"), which the HEART-UMA-FHIR profile defines as signaling that a whole bunch of other "sub-resource sets" of other specific types should be automatically registered too, like one with the "FHIR:medicationlist" type and one with the "FHIR:allergylist" type and whatever. What, exactly, are their resource set IDs in the Alice context? Since we had wanted to create these implicitly and not with an API call, how would the RS be informed of what these are? Or do we have to actually invent new bulk ways of doing this in-band? (In a draft version of the RSR API, we used PUT instead of POST, which enabled the RS to dictate its own resource set IDs, but gave that up for very good reasons.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 2