1 of 27

How can we improve SMART scopes?

Zooming in on FHIR authz

isaac vetter, epic

http://bit.ly/smartscopesv2-devdays2019

HL7®, FHIR® and the flame Design mark are the registered trademarks of Health Level Seven International and are used with permission.

Redmond, June 10 – 12 | @HL7 @FirelyTeam | #fhirdevdays | www.devdays.com/us

​

2 of 27

Exploring SMART on FHIR for Research and Quality Purposes

​

  • Tuesday @4:50
  • in Sonora
    • Sebastiaan Knijnenburg

1

3 of 27

  • Wednesday
  • 11:05 am - 11:45 am
  • in St. Helens
    • Josh Mandel

2

4 of 27

SMART App Launch protocol

  • HL7 standard
    • Authorization (patient, provider, backend system)
    • OAuth2 scopes
    • Access to FHIR server
  • Standalone launch
    • User authenticates
  • “EHR Launch”
    • Single sign-on.

​

www.hl7.org/fhir/smart-app-launch/

5 of 27

Current

http://www.hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html

6 of 27

Current

clinical-scope ::=

( 'patient' | 'user' | 'system' )

'/' ( fhir-resource | '*' )

'.' ( 'read' | 'write' | '*' )`

http://www.hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html

7 of 27

App requests scopes

Location: https://ehr/authorize?

response_type=code&client_id=app-client-id&

redirect_uri=https%3A%2F%2Fapp%2Fafter-auth& scope=Observation.read+patient%2FPatient.read+openid+fhirUser&

state=98wrghuwuogerg97&

aud=https://ehr/fhir

http://www.hl7.org/fhir/smart-app-launch/#for-example-2

8 of 27

User approves scope

https://sandbox.hspconsortium.org/

9 of 27

User approves scope

https://sandbox.hspconsortium.org/

10 of 27

Machine-facing scopes should be different from consumer-facing scopes!

  • Wildcards
  • Reading level
  • “Purpose of app”
    • research, care, ?

​

11 of 27

Current

  • patient/Observation.read

12 of 27

FHIR Observation.category

https://www.hl7.org/fhir/valueset-observation-category.html#expansion

13 of 27

FHIR Observation.category

https://www.hl7.org/fhir/valueset-observation-category.html#expansion

patient/Observation.read

14 of 27

Wilcard scopes

  • patient/*.*

http://www.hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html#wildcard-scopes

​

When a wildcard is requested for the FHIR resource, the client is asking for all data for all available FHIR resources, both now and in the future.

15 of 27

Scopes should sometimes be finer-grained than FHIR resources.

  • Observation.category
  • Basic.code
  • Condition.category?

​

16 of 27

17 of 27

18 of 27

Facebook authz example:

​

​

{dataType}.read

19 of 27

Consumer-facing scopes should be simple and relatable.

  • but describing dataTypes for read is okay.

20 of 27

Facebook user explanations

21 of 27

  • Consumer-facing write scopes are special
  • Consumer authz requires info about the app, not just the data.

22 of 27

Facebook scopes

https://developers.facebook.com/docs/facebook-login/permissions/#reference-pages_messaging

23 of 27

https://developers.facebook.com/docs/facebook-login/permissions/#reference-pages_messaging

31 hardcoded scopes with allowed usages

24 of 27

Simple enhancement

  • patient/Observation:lab.read
  • patient/Observation:activity.read
  • patient/Condition:encounter-diagnosis.read

25 of 27

Complex enhancement (stolen from Josh)

https://docs.google.com/presentation/d/1CqRCrNB17XXzeff0guDo1inM-gdy2k0aBc16OcdZKHM/edit#slide=id.g5b57552282_1_9

26 of 27

Principles

  • Machine-facing scopes should be different from consumer-facing scopes!
  • Scopes should sometimes be finer-grained than FHIR resources.
  • Consumer-facing scopes should be simple and relatable.
  • Consumer-facing write scopes are special
  • Consumer authz requires info about the app, not just the data.

27 of 27

Next steps?

  1. Collect production AS scopes descriptions.
  2. Talk through syntaxes for the low-hanging fruit for category.
  3. Grahame to write up auth denied OO.
  4. Scope to include operations, non-standard webservices.

​

Continue the conversation in #smart zulip stream.

?

26