1. Privacy on FHIR Overview What we are working on…. 42CFRPart2 Organization MyHealtheVet (VA) Military Health Systems (MHS) Tricare Health Information Exchange (ONC) The Resource Server Stack OpenID Connect Server (Oauth2 + UMA) Consent Directive Management Services Access Control Services Providers Consent PHR Heart Rate Diabetes Fitness Patient Tools PhoneGap, Cordova, Vaadin Touchkit

2. Privacy on FHIR Overview What version… DSTU2 Currently Refactoring Privacy Protective Services (PPS) and Security Labeling Services (SLS) --- Broken Utilizing HAPI FHIR Java Libraries(SNAPSHOTS) for DSTU2

3. Privacy on FHIR Overview What version… In DSTU2 security labels now in ResourceMetadataMap…

4. Privacy on FHIR Overview Rules are same… rule "Clinical Rule Abnormal mammogram, unspecified" dialect "mvel" when $cd : FHIRClinicalFact(codeSystem == "http://snomed.info/sct", code == "168750009") then ruleExecutionContainer.addExecutionResponse(new FHIRConfidentialityRuleExecutionResponse("168750009", "http://snomed.info/sct", "Abnormal mammogram, unspecified", "PRS", "R", "Restricted")) end

5. Privacy on FHIR Overview What version… http://jamesagnew.github.io/hapi-fhir/download.html

6. Privacy on FHIR Overview Server Platform HAPI FHIR Implementation Both DSTU1 & 2 SMART on FHIR API DSTU2? USING DATA FROM SMART (Clinically Relevant)

7. Privacy on FHIR Overview Oauth2 and UMA Clients, Scopes, and Claims Utilizing Existing Libraries (interceptors) Anxiously awaiting UMA

8. Privacy on FHIR Overview Stop Leakage Need more that just authorization to Resource! Final mile is on PPS and SLS Patient Consent DirectiveOrganizational Policy Obligations PPS lives on both sides of the fence Obligations+