Technical Architecture

[janieTC-USDS]

big picture

Patrick's casual stroll through VA.gov ecosystem: https://app.mural.co/t/departmentofveteransaffairs9999/m/departmentofveteransaffairs9999/1709152531566/47d3c9ec5a36ec4553e80faf13c80b5752e72e01?sender=u8d8ad2ff1f0bbe49db5d6986

vets-api

https://department-of-veterans-affairs.github.io/va-digital-services-platform-docs/api-reference/?url=https://dev-api.va.gov/my_health/apidocs#/

SM API

MHV SM Patient API Swagger (you do have to be on VA network for this one) SM-API Interface Control Document 1.2.0 Veteran.doc MHV SM Patient API Map - used to understand mapping with vets-api

https://[code.va.gov](https://code.va.gov/)/

[janieTC-USDS]

[janieTC-USDS]

SM Access Requirements for SM Access

From 3/7 conversation with Bhanu https://github.com/department-of-veterans-affairs/va.gov-team/blob/82343f0f3e0d40df42987d3a192b96363fb5c1c9/products/health-care/digital-health-modernization/engineering/mhv-account-options.md

• (1) They have to have an MHV account with Premium status

  • Matched and correlated with a Level 2

    • Level 2 means they physically went in and got ID’ed or they did self-authentication (Login.gov, ID.me, DS Log-in)
    • Match = For any account, we interface with IAM to check if there is a match with patient account (Name, DOB, etc)
    • Correlation = This is where we get the ICN and store in MHV.
    • After matched & correlated you are just Basic. And then you do authentication, to get the 200 MHV is added as facility, which designates that you are a level 2 user. Now your premium account is live.
    • Similar to Cerner: 200 CRNR = this mean they have an account in OH
    • We always go back to IAM as the single source of truth that we have to keep in sync with. For ex: if there is a change in trait (ex gender), there is a process to change.
      • Ex: IAM has date of death, and this allows us to deactivate.

  • Ask Access team - is there an API? Or can they make changes this API?

    • API : Determine if the Veteran is using Secure Messaging - Dept of Veterans Affairs-External - Confluence (va.gov) is mainly owned by Access team

  • 2) MHV Account needs to be active status

    • Ways to get deactivated:
      • if a user hasn’t logged in for a certain amount of time (26 months), they get notified. Security doesn’t want us to keep accounts open if they aren’t logging in. Will get auto-deactivated.
      • Date of death / someone dies
      • Sometimes duplicated accounts (I created an account years ago, then I created a new one, need to de-duplicate)

  • 3) User needs to be VA patient

    • VA patient = actively receiving care at a facility
    • When user registers, there are different types: CHAMPVA beneficiaries, etc.
    • We get this from IAM, we get a list of facilities
      • Anything that is non-200 is an actual facility
      • They need to have at least one non-200 facility in order to a patient to get SM

If all of the true, a record in the SM Table is created (by Access team).

• There are also other places that Access can check this information
• EVAULT MHV Table that has user info - this is a check to see in MHV active
• SM User Table - this is the check for SM account active

So once we have SM User in User Table, we have a sync job to keep traits and statuses in sync.

• Access team will grab any changes and make updates to the SM User Table.
• Note: there is a bug where some users were not getting to SM User Table.

Then, all SM APIs use the SM User Table

Other requirements:

• Latest VA Terms of Use signed off (handled by Access team, in MHV profile)
  • Changes every few years with different versions
  • Now there is one overarching ToU - once you sign, you are good for all systems and don’t have to resign
  • Access team has more details (3.0?)