Blue button presentation

1. Tackling the barriers to Consumer-Mediated
Interoperability
Lessons learned in building the
Blue Button 2.0 API and positioning it to expand
across healthcare

2. CMSBlue Button Innovator
& Developer Evangelist
HL7 FHIR Da Vinci
Implementation Guide
Author
NewWave
Entrepreneur In Residence
Mark Scrimshire
#BlueButton

3. CMS Blue Button 2.0 - A Guiding Vision
“To build a developer-friendly,
standards-based data API that
enables beneficiaries to connect
their data to the applications,
services, and research programs
they trust “
#BlueButton

4. • Build from established Profiles (USCore)
• Share New Profiles across IG Projects
• Use Established Communication Frameworks
– SMART-on-FHIR
– CDS-Hooks
– Blue Button 2.0 Member-Authorized Exchange
Interoperability Objectives
Transport Payload
Avoid Duplication of Effort

5. • Explosion of Developer Portals
• Developer/App Registration
Access Approval Challenges
• App Discoverability
• Bad Actor Discoverability
Current Registration Doesn’t Scale
3
rd
Party
App
Data
Holder
FHIR
API

6. Why Do You Need a Developer Portal?
To Provide:
• Education
• Documentation
• Support
• Environment Information
• Application Credentials

7. • Verifiable Key and Secret Issuing Process
• A published list of authorized apps
What does Blue Button 2.0 Need
Submission Review
Approve /
Validate
Issue Activate

8. Components of a Blue Button 2.0 Solution
Member
Identity
Manager
3rd Party
Apps
Registered
with
Credentials
OAuth2.0
Authorization
Server
FHIR Server
OpenID
Connect
FHIR REST
API
Developer
Portal
“App
Store”

9. #BlueButton

10. Sandbox: Registered Organizations
August, 2019
+
#BlueButton
Is there demand to access Blue Button?

11. Member-authorized Exchange: The new normal
907
USHealth Plans
4.0
Average Qualified
Health Plans Per State

12. Network Density Becomes a Problem…
208 *207
= 21,528
2 Potential Approvals

13. A Thousand App Stores
Does Not Solve
App Discoverability

14. What does a Plan need to support Blue Button 2.0?
Member
Identity
Manager
3rd Party
Apps
Registered
with
Credentials
OAuth2.0
Authorization
Server
FHIR Server
OpenID
Connect
FHIR REST
API
Independent
Verifying
Organization POET/UDAP
Enhanced
DCRP
“App
Store”

15. OAuth2.0
Dynamic Client Registration
A Little Used Standard

16. OAuth2.0
Secure Dynamic Client Registration

17. • http://hl7.org/fhir/us/davinci%2Dhrex/2019Jun/Dy
namic_Registration_for_SMART_Apps.html
Unified Data Access Profiles / POET:
• http://www.udap.org/udap-dynamic-client-
registration.html
There’s a Standard for that…

18. {"name": "DCRTestApp",
"redirect_uris": "http://localhost:8080",
"agree": true,
"certification_callback": "http://172.17.0.1:8080",
"user_id": 1,
"authorization_grant_type": "authorization-code",
"client_type": "confidential",
"tos": "Lorem ipsum...",
"privacy_policy": "Lorem ipsum …",
"jwk": {
"kty": "RSA",
"n": "0n3kHh072fbUi8fOKZ…._ow",
"e": "AQAB"}}
OAuth2.0 DCRP with Verifiable Payload

19. Blue Button 2.0 is a safe pilot
Access
Dynamic Registration !=
Registration + = Individual Access

20. Making waves across the Industry
#BlueButton

21. M n a a oss the Industry
Let’s work together to
Solve the Registration
Challenge.

22. M n a a oss the Industry
App
Makers
Consumers
Data
Holders
It’s a Win, Win,
WIN!

23. bluebutton.cms.gov
go.cms.gov/bluebuttonapps
#BlueButton

24. #BlueButton

25. bluebutton.cms.gov
Mark.Scrimshire@newwave.io
@ekivemark
Newwave.io/bb2
#bluebutton