The ROI form is one of the three common legal documents in healthcare. (The other two are the Notice of Privacy Practices that's a meaningless and often unsigned notification about HIPAA and informed consent notices for specific procedures. )
The ROI form (attached) is quite typical and demonstrates all of the common elements. I've annotated it with the UMA terms. Jim Hazard and I have some experience translating the ROI form into the Common Accord format.
I see the ROI form as the institutional complement to the 4 use-cases I shared last week. The use-cases were presented entirely from Alice's perspective. The ROI form is presented entirely from the service provider perspective.
There is, of course, a third dimension: the third parties and intermediaries in the real world that have contractual relationships with Alice and her service provider. These are sometimes called Business Associates in healthcare and sometimes overlap with federations. Alice's third parties often look like software clients and apps.
Adrian