MHealthDossier Guide

Guidance to using the Mobile access to Health Documents (MHD) profile

• Introduction
• Common Technology
  • Patient Identification
  • Patient ID resolution from one identifier domain to another (PIX)
  • Fully specified Patient ID vs without domain identifier
  • Pseudonym Patient ID – used to mask real patient ID (e.g. in an ATOM feed)
  • How to go from demographics to a patient ID
    • Scoped out
    • Could be through:
      • Device configuration
      • Prior workflow – browser navigation
      • Application setup –
      • PHR like application initial configuration could resolve the patient ID as part of the application setup
      • Other application
      • Future profile
        • ATOM feed of workflow items to a careprovider, with the content containing a MHD URL.
  • Metadata JSON encoding
    • DocumentEntry and SubmissionSet, Folders, Relationships
  • ATOM encoding
  • JSON body
  • Date-Time conversions and interpretations
  • Use of the submission set
  • Encoding of arguments
  • Error handling
• Service Side
  • Examples in Java or pseudocode
  • How to implement PIX inside the service
  • How to implement GET DocumentEntry given that you only get the EntryUUID and PatientID
  • As a Proxy service grouped with XDS Document Source
  • As a Proxy service grouped with XDS Document Consumer
  • As a Proxy service grouped with XCA Initiating
  • As a service interface to a Direct Project HISP
  • Including a RID Information Source (?)
  • Security and Privacy Considerations
• Client Side
  • • Examples in JavaScript
  • Generally how to use MHD client side
    • Discovery of documents
    • Using the ATOM feed
  • Retrieve a Document
    • Not in scope to describe how to consume the document (CDA)
    • Retrieve a Display Ready (RID)
    • Create of a Document
  • Security and Privacy Considerations
    • Risks of retrieving and storing local health information
    • Client responsibility to identity
• Security and Privacy
  • Operational issues
    • To what degree is the device itself involved in authentication. Is it a second-factor
    • To what degree is device location (GPS, WiFi identifiers)
  • User Authentication
    • Use of OpenID
    • Use of OAuth
    • Use of HTTPS
  • Audit Logging
    • To use ATNA formally or not?
    • On the Client
    • Only on the Server
    • Both
• Conclusion