Kantara Initiative » healthcare

Subscribe in a RSS reader • Subscribe via Email

Reporting From RSA 2010: Identity, Health Care, and a Higher Realm of Credentials

Written by Mike Kirkwood. Read the full article.

This week we are reporting from RSA, the security conference in San Francisco. We’ve seen hackers, threats, and industry leaders roaming these halls – and among these we found leaders of the identity community, people who are thought leaders focused on creating a safe Internet for all individuals.

This includes folks who in the Identity Commons and OASIS workgroups, and the 1-year-old Kantara Initiative. The latter was announced to the public at RSA 2009, and this year it hosted an all-day workshop that brought cloud computing into the forefront of the dialog.

Diverse Community of Interests Coming Together

Today’s all-day workshop offered by the Kantara Initiative focused almost exclusively on identity services and included viewpoints from several perspectives: enterprises (CA, Ping Identity, Aetna, Oracle, HP), service providers (NTT), consumer applications (Paypal, Google), and government agencies (NIH).

The room was packed – standing room only. After the kickoff we had a chance to ask Trent Adams, chair of the Kantara leadership council, to share his thoughts about identity, cloud computing and year one of the new organization.

He talked about the potential big win that existed for the organization because of its involvment in preparing standards for federal government approval. These are in historic times, he said, and embracing openness at the federal level was an opportunity the organization decided was valuable for the community. We’re keeping our ears open to learn more about how identity services will be enabled and approved through the government.

Landscape Change: Cloud Computing Invigorates Identity Efforts

One thing that is clear is that things get more complicated when combining identity services with cloud computing. We were reminded that many of the technologies that have been developed, including things like OpenID and SAML were designed around the same scenarios of sharing across domains. Identity can be solved in a multi-vendor, multi-protocol, and multiple-infrastructure world.

Matthew Gardiner of CA summed the importance of the link between identity solutions and cloud computing in his talk, “Identity as Security Glue for the Cloud”:

“I want to say the phrase cloud security in the first few moments of my talk because you’ll be hearing it a thousand times before the end of the conference. Cloud security can be viewed as a Rubik’s cube of security implications, when identity services and combining them within the vectors of Iaas, PaaS, and SasS combined with private, public, and hybrid clouds.”

The West Coast Perspective on Health Care

RSA and HIMSS fall on the same week this year. While nearly all of the healthcare IT leadership headed to Atlanta, several companies also came to San Francisco.

Yesterday, MEDecision presented their solution and connections to different Web applications and health care records and systems, and gave a very tangible set of scenarios showing how cloud computing and identity meet around sharing information about a person who is a patient.

At the same time on the East Cost, MEDecision was also at HIMSS demonstrating open exchange of health information in a HIE product offering that helps connect services across providers in order to aggregate a view of an individual. The company offers software and services to insurers to negotiate their cloud-based work flow, including moving private data across pharmacy, doctors, insurers, and the entire health care landscape.

No Passwords in the Cloud

Patrick Harding of Ping Identity spoke about his company has learn about cloud computing in this session, “How the Cloud is Changing Federated Identity Requirements”. A few of his observations:

Software is no longer build vs. buy. It now includes subscribe, which by definition is a shorter term relationship.
Cloud computing is an evolution of architecture. It arrives after Web services, which evolved from Web, client server, and mainframe.
Complexity of the identity layer is harder than ever for the simple reason that there are more apps per user than ever before.
Services are becoming any-to-any, where internal (employee) and external (customer) classifications don’t matter nearly as much as before. Because of this firewalls are losing their usefulness.
Audit is no longer an afterthought. Auditors don’t care how or where applications hosted, but hey do need their reports! This includes Sarbanes-Oxley, HIPAA, Gramm-Leach, Bliley, and more.

A core theme of this session was how the consumer mindset is driving requirements for application experience. Consumers expect it to work on any device, be secure, and be portable. To deliver on this, it must be easy to use. At the same time, password risk must be reduced.

A key trend that Harding pointed out is moving identity systems from “push” models into “pull” models. Instead of updating partners and directories by batch services, companies need to be building real-time identity resolution in applications.

We asked Harding if he had any predictions for where that type of service will come from. His response led us to the conclusion that the leader will be a brand and service that people trust and understand the motivations of. It will likely enter the market from a higher realm of credentials than Twitter or Facebook – perhaps from financial services.

Context is Fundamental: Person, Father, Employee, All of the Above

One thing we learned today is that Google’s App Engine is worth watching as this space evolves. Several interesting things are being done in this sandbox that haven’t been accomplished other places, including how to connect consumer services to enterprise login discovery using domain.

Google has inserted itself into the sweet spot by getting consumers and enterprises alike hooked on their applications, giving the company a unique view of the challenges and solutions in joining identity with cloud computing. We’ll be taking a closer look at these offerings and where Google is headed.

Another thing we observed is the power of the network. NTT gave a demonstration of the power of mixing identity protocols (SAML and OpenID) for the purpose of connecting social, information, and financial transactions in the browser with one login. It starts to show how the next generation Internet might work, where the application requests profile from the cloud rather than a user typing it in.

A summary of overlapping-world-multi-protocol integration has been shared on Google’s site.

Comments (0)

Subscribe in a RSS reader • Subscribe via Email

What do Electronic Patient Records mean?

Posted May 21, 2009

OK, it’s a trick question. The answer, as with much data and all personal data, is “it’s contextual”… which is basically a fancy way of saying “it depends”. This CNet News article from yesterday throws up some of the questions, in a US-centric context, though there are many more, and even those it raises, the article doesn’t necessarily resolve.

So, what do I mean by contextual? Well, I’ve already given one example of that; the CNet News article (entitled “What you need to know about e-health records”) is fairly useful if you’re in the US healthcare system – but a lot of it is irrelevant if you aren’t. One huge contextual factor is which country you live in, with the associated factors like that country’s attitude towards state- vs. privately-funded healthcare, preventive medicine, health insurance, family doctors, privacy law and so on.

Here are a few more examples of contextuality which the CNet article illustrates:

* at a “political” level, Electronic Patient Records (EPRs) ‘mean’ money. If you’re a techno vendor only interested in cornering a chunk of President Obama’s stimulus package for commercial gain, the data is incidental (in fact, paying to secure it only reduces your bottom line): what’s important is the subsidy;
* if you’re an insurer, EPRs mean being able to get sufficient detail to judge – automatically if at all possible – whether a given treatment is covered under the policy or not. In that context, the distinction between “cancer which has spread to the brain” and “cancer which has spread to the spine” may well be irrelevant, as the article notes;
* if you’re the patient or the physician, of course, that distinction might be highly relevant… but in the example given, the data in the EPR was ambiguous because it was designed primarily to meet the insurer’s requirements, rather than those of the other relevant stakeholders.

So what EPRs mean depends on things like who you are, what you’re doing with the data, where you’re doing it, why you’re doing it, and very often even when you’re doing it… (it’s one thing to need data urgently in the heat of emergency treatment – it’s another to need it forensically post mortem).

Why’s all this an issue? Well, as the CNet article points out, the stimulus package is driving a lot of efforts to standardise EPRs and make them portable, interoperable and consistent. At a syntactic level, that raises one set of problems (which experience suggests are solvable with time and effort). At a semantic level, as the contextual examples show, the problems are of a quite different order of difficulty.

That’s the point at which the technical work on interoperability needs to be complemented by work on contextual factors like policy, regulatory measures, user consent and control, and matching purpose of collection against purpose of use. These are the kinds of question we have worked on for some time in the Liberty Alliance Public Policy Expert Group (PPEG), and which I confidently hope will continue to grow into a compelling work stream under the Kantara Initiative. Also in the Kantara structure there is a proposal for a Health Information Assurance (HIA) Work Group, whose draft charter you can find here. I will be adding a draft charter for the Privacy and Public Policy Work Group (P3WG) within the next few days, and that will include a goal of effective liaison with the HIA group.

Precisely because EPRs raise so many issues – both within and between different national healthcare and regulatory systems – this work needs to be able to draw on a broad range of expertise. Please have a good look around the Kantara website; there are many levels at which you can participate in this work, and I would encourage anyone with a stakeholder interest in EPRs to do so.

–posted by Robin Wilton, Director of Privacy and Public Policy, Liberty Alliance

Comments (0)