Indeed. Smaller hospitals sell the data. The larger academic ones don’t even have to sell the patient records. They can take grants to do machine learning and AI right behind their firewall and then transfer just the intellectual property in return for the “grant”. These deals are obviously secret because both parties want the grant to look like charity. Patient data never leaves the academic hospital so no patient consent is needed and privacy scandals are avoided. The only problem is for society as a whole, as medicine is privatized and turned into for-profit AI deal-by-deal.

Not Direct. FHIR. OAuth2. UMA. The standards (and policies) for managing access need to be separate from the standards from the data model, encoding, and transport. The industry chose to bundle the authorization models with the data model. That is reasonable from some perspectives but it’s not a sound foundation in my opinion.

The current debates around consent for patient-directed access, both API and “push” in TEFCA, integration of PDPMPs into EHRs, lack of end-to-end encryption in TEFCA are all due to this unsound foundation.

SMART or HEART could be chartered to deal with the authorization aspects of FHIR separately form the data model. Maybe we should start a new group.

Push messaging? Using direct? That’s a different use case to the framework for SMART on FHIR. FHIR can support push messaging, and we worked with direct to define how that would work across direct. Using direct does have it’s own problems from the patient’s pov, but we’re not about to take on the distribution identification/certificate problem – that’s more TEFCA space. If you think there’s a deficiency in the technical standards here, we can talk about that

It’s not about ONC enforcement or even about the US. The SMART on FHIR use-cases that have been developed are strategically designed to put messaging under the control of the hospital instead of the doctor or patient.

What is the EHR / FHIR equivalent of being able to send a fax to a pharmacy or another EHR by having the doctor or patient enter a destination address?

We declined to *enforce* patient directed access because that’s ONC business. What we do is enable it technically. We haven’t ignored requests for that to my knowledge…