Lessons learned in building the CMS Blue Button 2.0 API using HL7 FHIR and positioning it to expand across healthcare.

1. Tackling the barriers to Consumer-Mediated
Interoperability
Lessons learned in building the
Blue Button 2.0 API and positioning it to expand
across healthcare

2. CMS Blue Button Innovator
& Developer Evangelist
HL7 FHIR Da Vinci
Implementation Guide
Author
NewWave
Entrepreneur In Residence
Mark Scrimshire
#BlueButton

3. CMS Blue Button 2.0 - A Guiding Vision
“To build a developer-friendly,
standards-based data API that
enables beneficiaries to connect
their data to the applications,
services, and research programs
they trust “
#BlueButton

4. • Build from established Profiles (US Core)
• Share New Profiles across IG Projects
• Use Established Communication Frameworks
– SMART-on-FHIR
– CDS-Hooks
– Blue Button 2.0 Member-Authorized Exchange
Interoperability Objectives
Transport PayloadAvoid Duplication of Effort

5. • Explosion of Developer Portals
• Developer/App Registration
Access Approval Challenges
• App Discoverability
• Bad Actor Discoverability
Current Registration Doesn’t Scale
3rdPartyApp
DataHolder
FHIRAPI

6. • Education
• Documentation
• Support
• Environment Information
• Application Credentials
Why Do You Need a Developer Portal?
To Provide:

7. • Verifiable Key and Secret Issuing Process
• A published list of authorized apps
What does Blue Button 2.0 Need
Submission Review
Approve /
Validate
Issue Activate

8. Components of a Blue Button 2.0 Solution
Member
Identity
Manager
3rd Party
Apps
Registered
with
Credentials
OAuth2.0
Authorization
Server
FHIR Server
OpenID
Connect
FHIR REST
API
Developer
Portal
“App
Store”

9. HIPAA Privacy Rule
…gives patients the right to direct a
covered entity to transmit a copy of their
medical records to the third party the
patient chooses.
…allows covered entities to offer patients
electronic means to request access to
their medical records.
…establishes appropriate safeguards that
covered entities must achieve to protect
the privacy of health information.
#BlueButton

10. Sandbox: Registered Organizations
August, 2019
1,300+
#BlueButton
Is there demand to access Blue Button?

11. Member-authorized Exchange: The new normal
907US Health Plans
4.0Average Qualified
Health Plans Per State

12. Network Density Becomes a Problem…
208 207*
2
= 21,528
Potential Approvals

13. A Thousand App Stores
Does Not Solve
App Discoverability

14. What does a Plan need to support Blue Button 2.0?
Member
Identity
Manager
3rd Party
Apps
Registered
with
Credentials
OAuth2.0
Authorization
Server
FHIR Server
OpenID
Connect
FHIR REST
API
Independent
Verifying
Organization POET/UDAP
Enhanced
DCRP
“App
Store”

15. OAuth2.0
Dynamic Client Registration
A Little Used Standard

16. OAuth2.0
Secure Dynamic Client Registration

17. • http://hl7.org/fhir/us/davinci%2Dhrex/2019Jun/Dy
namic_Registration_for_SMART_Apps.html
Unified Data Access Profiles / POET:
• http://www.udap.org/udap-dynamic-client-
registration.html
There’s a Standard for that…

18. {"name": "DCRTestApp",
"redirect_uris": "http://localhost:8080",
"agree": true,
"certification_callback": "http://172.17.0.1:8080",
"user_id": 1,
"authorization_grant_type": "authorization-code",
"client_type": "confidential",
"tos": "Lorem ipsum ...",
"privacy_policy": "Lorem ipsum …",
"jwk": {
"kty": "RSA",
"n": "0n3kHh072fbUi8fOKZ…._ow",
"e": "AQAB"}}
OAuth2.0 DCRP with Verifiable Payload

19. Blue Button 2.0 is a safe pilot
Dynamic Registration Access!=
Registration + Individual Access=

20. Making waves across the Industry
#BlueButton

21. Making waves across the Industry
Let’s work together to
Solve the Registration
Challenge.

22. Making waves across the Industry
App
Makers
Consumers
Data
Holders
It’s a Win, Win,
WIN!

23. bluebutton.cms.gov
go.cms.gov/bluebuttonapps
#BlueButton

24. #BlueButton

25. bluebutton.cms.gov
Mark.Scrimshire@newwave.io
@ekivemark
Newwave.io/bb2
#bluebutton