Patient Credential - Revision history

Tom: /* References */

2021-11-16T00:54:06Z

‎References

Tom: /* Format */

2019-07-31T23:40:28Z

‎Format

Tom: /* Format */

2019-07-31T23:30:04Z

‎Format

Tom: /* Format */

2019-07-31T23:01:28Z

‎Format

Tom: /* Format */

2019-07-31T23:00:16Z

‎Format

Tom: /* Format */

2019-07-31T22:57:34Z

‎Format

Tom: /* Format */

2019-07-31T18:01:15Z

‎Format

Tom: /* Format */

2019-07-31T17:56:44Z

‎Format

Tom: /* Format */

2019-07-29T03:01:54Z

‎Format

Tom: /* Context */

2019-07-20T17:54:57Z

‎Context

@@ Line 75: / Line 75: @@
 [[Category:Health]]
 [[Category:Identity]]
-[[Category:Standard]]
+[[Category: Standard]]

@@ Line 23: / Line 23: @@
    "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",   // patient id as selected by the patient
    "client_id": "User Agent Ver 1.0",                  // identity of native app asking for the credential
    "code": "kjdslk:ekke:aksfd23inn98",                 // the QR code
    "iat": 1541493724,                                  // issued date

@@ Line 24: / Line 24: @@
    "client_id": "User Agent Ver 1.0",                  // identity of native app asking for the credential
    "code": "kjdslk:ekke:aksfd23inn98",                 // the QR code
-   "iat": 1541493724,                                // issued date
+   "iat": 1541493724,                                  // issued date
-   "exp": 1573029723,                                // expiry date
+   "exp": 1573029723,                                  // expiry date
    "jti": "660!6345FSer",                              // unique request ID - should also serve a nonce to prevent replay
    "jwk": json key object                              // of the subject
@@ Line 34: / Line 34: @@
+{
    "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",   // patient
-   "jti": "https://pcp.com/credentials/3732",          // unique identifier for the token used to prevent reuse
+   "jti": "660!6345FSer",                              // unique identifier generated by the user to prevent spoofing
    "iss": "did:example:abfe13f712120431c276e12ecab",   // some covered entity must attest that they performed identity proofing
    "aud": :did:exmaple:wxyz89879872937498938749244",   // data controller (EHR) is audience for token
-   "iat": 1541493724,                                // issued date
+   "iat": 1541493724,                                  // issued date
-   "exp": 1573029723,                                // expiry date
+   "exp": 1573029723,                                  // expiry date
    "vc": {
      "@context": [

@@ Line 24: / Line 24: @@
    "client_id": "User Agent Ver 1.0",                  // identity of native app asking for the credential
    "code": "kjdslk:ekke:aksfd23inn98",                 // the QR code
-   "iat": "1541493724",                                // issued date
+   "iat": 1541493724,                                // issued date
-   "exp": "1573029723",                                // expiry date
+   "exp": 1573029723,                                // expiry date
    "jti": "660!6345FSer",                              // unique request ID - should also serve a nonce to prevent replay
    "jwk": json key object                              // of the subject
@@ Line 37: / Line 37: @@
    "iss": "did:example:abfe13f712120431c276e12ecab",   // some covered entity must attest that they performed identity proofing
    "aud": :did:exmaple:wxyz89879872937498938749244",   // data controller (EHR) is audience for token
-   "iat": "1541493724",                                // issued date
+   "iat": 1541493724,                                // issued date
-   "exp": "1573029723",                                // expiry date
+   "exp": 1573029723,                                // expiry date
    "nonce": "660!6345FSer",
    "vc": {

@@ Line 23: / Line 23: @@
    "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",   // patient id as selected by the patient
    "client_id": "User Agent Ver 1.0",                  // identity of native app asking for the credential
-   "code": "aksfd23inn98",                             // the QR code
+   "code": "kjdslk:ekke:aksfd23inn98",                 // the QR code
    "iat": "1541493724",                                // issued date
    "exp": "1573029723",                                // expiry date
-   "jti": "660!6345FSer",                               // unique request ID - should also serve a nonce to prevent replay
+   "jti": "660!6345FSer",                              // unique request ID - should also serve a nonce to prevent replay
-   "jwk": json key object                               // of the subject
+   "jwk": json key object                              // of the subject
+}
 </pre>

@@ Line 17: / Line 17: @@
 ==Format==
 Example of a JWT payload of a JWT-based verifiable [[Patient Credential]] using JWS as a proof
-* The [[User Agent]] must request the [[Patient Credential]] using an [[Authorization Code]] supplied during the [[Identity Proofing]] process. This will be signed by the private key as a JWS. The private key will be available from the did, accessed by a JWKS, or in the JSON packet.
+* The [[User Agent]] must request the [[Patient Credential]] from the CSP using an [[Authorization Code]] supplied during the [[Identity Proofing]] process. This will be signed by the private key as a JWS. The private key will be available from the did, accessed by a JWKS, or in the JSON packet.
 <pre>
+{
    "grant_type": "authorization_code",                 // say what is happening
-   "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",   // patient
+   "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",   // patient  --  it is unlikely that the CSP will have this value to send
    "client_id": "User Agent Ver 1.0",                  // identity of native app asking for the credential
    "code": "aksfd23inn98",                             // the QR code
@@ Line 28: / Line 28: @@
    "iat": "1541493724",                                // issued date
    "exp": "1573029723",                                // expiry date
-   "rid": "660!6345FSer",                               // request ID - should serve a nonce as well.
+   "jti": "660!6345FSer",                               // unique request ID - should also serve a nonce to prevent replay
    "jwk": json key object                               // of the subject
+}

@@ Line 5: / Line 5: @@
 * Strictly speaking this format is for a document that can be used to create the working [[Credential]] in a device controlled by the patient.
 * When a patient has gone through [[Identity Proofing]] and is "known to the practice", the [[Patient Credential]] can be installed on the patient's [[User Device]] to allow IAL2 level of assurance authentication to access their [[PHI]] at the [[EHR]].
 * Before the patient can enable a [[User Device]], a trusted [[User Agent]] must be installed and at least one patient [[Identifier]] created to use with the device.
 * Note that the [[Identifier]] of the issuer will be the practice (PCP), but the [[Identifier]] of the [[Data Controller]] of the [[EHR]] may be different. It is required that the two [[Identifier]]s are both part of the same [[Best_Practice_in_HealthCare#Federated_Trust_Anchor|Trust Anchor]] so that the patient (or guardian) will trust one because of the trust of the other.