notes: events/talks/kericonf26-03-jeffery-fhir-and-cms

This data as json

path title type status classification words body
events/talks/kericonf26-03-jeffery-fhir-and-cms Jared Jeffery: FHIR and CMS (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 810 # Jared Jeffery: FHIR and CMS (KERIConf 2026) **Abstract.** Jared Jeffery, chief executive and founder of healthKERI, gave a primer on US healthcare interoperability for the KERI (Key Event Receipt Infrastructure) community: why healthcare is the most attacked industry, how the Centers for Medicare and Medicaid Services (CMS) turns industry standards into mandates, what FHIR (Fast Healthcare Interoperability Resources) is, and what the CMS-0057-F rule requires. He closed with the VITAL (Verifiable Identity and Trust Automation Layer) initiative, which proposes the vLEI (verifiable Legal Entity Identifier) as the trust layer for FHIR connections. The talk is for KERI practitioners coming up to speed on healthcare as an application domain. ## Summary Jeffery introduced healthKERI as a startup working on what he called the missing trust layer for healthcare, built on open protocols. He gave his background in healthcare information technology and research, and explained that his motivation is personal: as a brain cancer patient he depended on a single treatment machine, and ransomware that shuts down a hospital diverts ambulances and puts patients at risk. He described healthcare as the most targeted industry for a decade running. A patient record is worth far more than a credit card on the black market because its contents (identity numbers, birth date, diagnoses) cannot be rotated. Stolen data feeds fraud, such as fake clinics billing CMS, and extortion, which he said AI (artificial intelligence) has made cheap enough to aim at individual patients. A typical health system or payer has around 1,500 vendor connections, each an attack surface; attackers move through trusted, encrypted channels by stealing shared secrets such as passwords and bearer tokens. His proposal is to remove shared secrets altogether. He reported a penetration test of a KERI-based system carrying FHIR traffic in which testers found no serious flaws, and said healthKERI regards KERI-based connectivity as a replacement for TLS (Transport Layer Security). He then explained CMS: it rarely writes standards itself, but works with bodies such as HL7 (Health Level Seven) to develop them, then writes them into regulation and ties compliance to payment. He walked through a ladder of interoperability (foundational, structural, semantic, and what he calls network, meaning governed) and a short history: admissions, discharges and transfers messages, HL7 version 2 with its local Z segment extensions, clinical document standards, FHIR from 2011, and TEFCA (the Trusted Exchange Framework and Common Agreement). Audience members added detail on Medicaid's state funding, paywalled older standards and ONC (Office of the National Coordinator for Health IT) certification. FHIR, he said, is a data model, RESTful APIs (application programming interfaces), tooling and a community; its main gain is retrieving discrete data elements instead of whole documents. CMS-0057-F requires every payer taking Medicare or Medicaid money to stand up FHIR APIs for payer-to-payer exchange, patient access, payer-to-provider exchange and prior authorization by 1 January 2027, which will add many new connections. FHIR, in his framing, fixes the how but not the who, and he described the Epic lawsuits as a dispute over whether networks can be trusted. A trusted connection, he argued, needs organizational binding, provable delegated authority and scope limited to purpose of use, on a base that is verifiable, auditable, automated, secure and open. Using a diagram he credited to Phil (Philip Feairheller), he traced the vLEI chain from GLEIF (the Global Legal Entity Identifier Foundation) through QVIs (Qualified vLEI Issuers) to organizations and their staff, with roles for DirectTrust and SEDI (State-Endorsed Digital Identity). In questions he said the credential presentation would ride inside each FHIR call, and that provider credentialing is a later, harder step. ## Key terms shared secrets, CMS-0057-F, FHIR, HL7 version 2, network interoperability, TEFCA, prior authorization, purpose of use, trust equity, VITAL initiative ## Claims and their evidence - Healthcare has been the most targeted industry for about a decade, and around three quarters of attacks come through an external party connection. [presenter-reported] - A penetration test of a KERI-based system running FHIR transactions found no serious flaws. [presenter-reported] - CMS-0057-F requires payers receiving Medicare or Medicaid funds to provide FHIR APIs for four use cases by 1 January 2027, with penalties. [presenter-reported] - Credential-based onboarding can cut connection time from weeks to a day or two and cost per connection by 75 percent or more. [presenter-reported] - In the vLEI chain, GLEIF accredits QVIs, which issue vLEIs to organizations, which in turn issue role credentials to people, all verifiable back to the root of trust. [informative] - The VITAL initiative is backed by the CARIN Alliance, DirectTrust and GLEIF. [presenter-reported] ## Related FHIR (HL7), CMS-0057-F, TEFCA, US Core, vLEI ecosystem governance framework (GLEIF), VITAL initiative, DirectTrust, SEDI, FAST (FHIR at Scale Taskforce, an HL7 effort covered in an earlier session) ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (03-jared-jefferey-fhir-and-cms.md), all minutes read. No quotations; paraphrase only. Not yet read by Mark.

Links from other tables