Definition of "EHR" needs clarification

[whitehatguy]

In the specification draft, the following definition is made for "electronic health record":

Computer software designed to store and process information about a person's health information, such as medications, allergies, medical history, etc. The EHR acts as a resource server by providing FHIR services, is responsible for authenticating end users, and is responsible for providing an authorization server.

@bakerdb provided the following feedback:

... we've made a conscious effort not to dictate architecture, such as by assuming that the "EHR" is the resource server, authorization server, and client.

It was further indicated that the Argonaut use case documentation provides the following definition:

We use “EHR” in a broad context inclusive of any system that holds and controls individually identifiable health information. Each EHR system has the capability to mediate app requests for access and to authorize access to FHIR resources."

Existing developer documentation 2 refers to entities such as "EHR FHIR server" and "EHR authorization server". How might we best describe the EHR's as an actor in this ecosystem with respect to the FHIR resource server and the authorization server?

[jmandel]

Personally I don't see any problem with the description you provided and quoted below, @whitehatguy. I found it consistent with the Argonaut profiles and explicit about the fact that an EHR "has-a" resource server and also "has-a" authorization server (as two separate components).

[ghost]

I don't consider "the EHR" an "actor" in this ecosystem. The "actors" are the client, the authorization server, and the FHIR server. A single "EHR system" (operated by a single institution) may "have" more than one authorization server and more than one FHIR server, and an "EHR system" comprises more than "computer software." "EHR" is an adjective -- e.g., "EHR technology."

[whitehatguy]

At a minimum, an actor is performing the function of "launching" applications - that role is performed neither by the authorization server or the FHIR server. A private contract must exist between the triad of the component performing that role, the authorization server, and the FHIR resource servers. Would it be amenable to indicate that the "EHR Application" is a role instead, and that it has such private contracts with the components serving the other roles?

[jmandel]

I agree that "EHR Application" is a reasonable term to describe the entity we're talking about.

[ghost]

perfect! Thanks!