Are we fighting yesterday's war?

[agropper]

A JAMA perspective on vaccines and variants suggests we need to get as much experiential / real world data as we can.

https://jamanetwork.com/journals/jama/fullarticle/2777785

IMHO, digital vaccination credentials are not enough and we need to rethink our priorities.

[jmandel]

I wish there was a way to migrate this issue over to https://github.com/smart-on-fhir/health-cards/discussions ..

My sense is that knowing what vaccinations someone has received is an important part of a risk evaluation strategy. I don't think it'll be the only part. Understanding local infection rates, details about prevalence of particular variants, individual symptoms and history, etc will all be relevant in evaluating risk.

But I expect that knowing what specific vaccine someone received (and when) will be part of these strategies, and so the work we are doing on Health Cards is well placed. in particular, this is why we focus on conveying immutable facts rather than conveying risk assessments in a health card; immutable facts can be used and reused in different contexts as our understanding improves.

[agropper]

Yes, we're conveying immutable facts, but we're making a design choice to convey them by-value instead of by-reference (to a patient-controlled health record). Some of what we're doing, such as the data models and the identifiers of the actors and related trust models will persist. But the conveyance protocol - what's actually coded in the "health card" - is not resilient to the realities of the pandemic / endemic situation.

[jmandel]

OK, so there is a way to turn this into a discussion :-) Moved!

we're making a design choice to convey them by-value instead of by-reference (to a patient-controlled health record)

If you want to share information by reference, we have SMART on FHIR today; it's helpful for this use case but 1) doesn't prevent data sources from tracking everywhere the data are used, and 2) is more widely implemented by EHRs than by patient-controlled records. Some of the challenges of keeping health data hosted indefinitely are discussed in #49.

the conveyance protocol - what's actually coded in the "health card" - is not resilient to the realities of the pandemic / endemic situation.

I'm not sure I understand this @agropper; can you maybe give an example of what resilience means here, and how an immunization record is not resilient and what other kind of data would count as resilient?

[agropper]

@jmandel Here's an update I wrote in a W3C thread discussing access controls to Verifiable Credentials.

Let's look at the "Vaccine Passport" use-case. It's still hot global news and it is also an example of privacy concerns and controversies around the W3C and the broader SSI community.

Definition: A vaccine passport (vc) is a contextual interpretation of a vaccine credential (vp). It's a lucky coincidence that vc / vp parallels VC / VP :-)

1. Alice receives a vaccine for public health reasons without any specific verification context in mind. The vc / VC is available in a vaccine registry run by the state.

2. Alice wants to take a cruise with 1,000 strangers. The cruise operator wants people to be safe and feel safe. For the operator, it's the only way to stay out of bankruptcy. As a result, the operator's policy is that 100% of anyone on board is vaccinated and they have had a negative Covid test within 72 hours. This is not an unusual context. Access to hospital procedures, for example, also requires a recent test regardless of vaccination status.

3. Alice gets tested at some lab 48 hours before boarding the cruise. This allows 24 hours for the lab result and a 24 hr cushion on boarding delays and other schedule mishaps. The test result also ends up in Alice's health record but it is not in the state registry.

4. The cruise operator (as verifier) has contracted with a Contextual Covid Passport Authority (CCPA, not to be confused with CCP as the passport authority in China) to provide a Yes or No answer when Alice wants to board. The CCPA has some complicated method of considering the context (2), the vc in the state registry (1), and the test in Alice's health record (3). But it works well enough for all the parties involved.

5. To process for the Yes / No boarding determination, access will be needed to a VC from the state registry and another VC from the hospital that holds Alice's health records. The Yes / No boarding determination itself is a third VC issued to Alice 24 hours before boarding along with or integrated into her traditional boarding pass. This is useful because nobody wants Alice to discover a problem as she's trying to step off the gangplank.

6. All three of these VCs from three separate issuers are available via VC-HTTP API. Alice hates smartphones and apps but she is willing to use technology to provide consent. For example, when she gets a text message on her feature phone saying: Is it OK for {this}? Reply Yes or No.

7. With GNAP, the cruise operator (trusted by Alice) fronts a GNAP Authorization Server operated by CCPA (trusted by the cruise operator). The cruise operator is able to send consent text messages to Alice (as in step 6) as appropriate and Alice is fine with that because she has a voluntary relationship with the cruise operator. Everyone is fine with that because the consent questions are being presented to Alice in context of something she more-or-less understands and expects.

So, behind the scenes, we have all sorts of servers and clients and user-agents and maybe a mandate to do it all according to zero-trust architecture. There may be middlemen services and trusted microservice platforms. Alice's health records could be in 5,000 different places and her vaccine credential could be in 50 state registries. Of the 1,000 people on board, some are children, others are demented, and a sizable number are not citizens of the US.

Notice that trust federations are of limited help in this situation. The context definition is entirely up to the cruise operator as verifier. No state or federal regulations are involved except to the extent access to the vaccination registry VC is covered by some public sector law and access to the health record is covered by HIPAA. Postulating that 70% of the 1,000 passengers on the cruise has an Apple or Android phone, with or without some app like Microsoft Authenticator is reasonable but I'm not sure it helps the situation.

Finally, I'm not saying this use-case can't work with OAuth2 and client credentials and I'm not saying that GNAP alone will fix this. What I'm claiming is that the success of our SSI adventure depends on not tying VC-HTTP API to OAuth2.

My point is not specific to the SSI standards work. So much of what is being built is captured by incumbent business interests that it's hard to even imagine how we transition to patient-controlled longitudinal health records or to machine learning as just open source medicine. OAuth2 has enabled consolidation into your choice of "Sign-In with Google or Facebook" and is allowing Epic and Cerner to censor what apps a licensed physician can use to access my health record. Physicians are now increasingly employees and patients are not organized.

What will it take for engineers and physicians to start considering the ethics of what we're building? (Where ethics is defined as per Heinz von Foerster as giving people more meaningful choices.)