notes: events/talks/kericonf26-13-panel-provenanting-medical-records

This data as json

path title type status classification words body
events/talks/kericonf26-13-panel-provenanting-medical-records Scott Stuewe, Mark Scrimshire, Jared Jeffery: Provenancing Patients' Medical Records (panel) (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 787 # Scott Stuewe, Mark Scrimshire, Jared Jeffery: Provenancing Patients' Medical Records (panel) (KERIConf 2026) **Abstract.** Three panelists, Mark Scrimshire (chief interoperability officer at ONYX), Scott Stuewe (president and chief executive of DirectTrust) and Jared Jeffery (founder and chief executive of healthKERI), described how the vLEI (verifiable Legal Entity Identifier) could identify organizations and their authority in United States healthcare data exchange. They framed the problem, the regulatory deadline driving it and a proposed payer-to-payer pilot. The session is for anyone interested in applying KERI (Key Event Receipt Infrastructure) credentials to healthcare interoperability. No moderator is named in the transcript; the panelists hand off to one another. ## Summary **Who spoke.** Scrimshire described his background building the Blue Button 2.0 API at CMS (the Centers for Medicare and Medicaid Services) and writing HL7 implementation guides. Stuewe described DirectTrust as a nonprofit trade association supporting trust in healthcare, whose members operate a PKI (public key infrastructure) framework. Jeffery described healthKERI's aim to bring KERI into healthcare data exchange. **The problem.** The panelists described a vast, diffuse ecosystem in which protected health information must move securely among many kinds of organizations. Individual providers are enumerated in the federal NPPES database, but organizations are poorly identified and payers not at all, and onboarding is light. In the national networks, Carequality and TEFCA (the Trusted Exchange Framework and Common Agreement, operated through QHINs, qualified health information networks), messages pass through several hops, so receivers often cannot tell who sent them. Digital certificates show control of a domain but say little about the organization. Scrimshire stressed that individual identity is not enough: what matters is the organizational context a person is acting in. **The deadline.** The CMS-0057 rule expands patient access, adds prior authorization requests through standard FHIR (Fast Healthcare Interoperability Resources) APIs, and requires payer-to-payer exchange, with a deadline of 1 January 2027. Scrimshire recounted that connecting a consumer app to 350 health plans took about six months of manual, repetitive onboarding, and said the APIs cannot be run at scale without automating it. Stuewe illustrated the hierarchy problem with large insurers whose many subsidiaries roll up through one parent, and noted that most payers already hold LEIs. **The proposal.** The panel proposed moving organizations from an LEI to a vLEI credential, then using ECR (engagement context role) credentials to express purpose of use, with delegation showing who in an organization, or which agent such as ONYX acting for a Medicaid agency, may set up connections. Scrimshire suggested the canonical URL of a FHIR implementation guide as a shorthand for purpose of use. A payer granting a connection could return a credential saying it approved the requester, so a record of existing connections could support automatic registration elsewhere, an idea the panel called connectedness is trust or trust equity. Jeffery presented this as an alternative to depending on a few clearinghouses, citing the Change Healthcare attack. **Meeting the market.** The mechanism extends FAST Security (from the FHIR at Scale Taskforce, an HL7 accelerator), which adds X.509 certificates to OAuth 2.0 dynamic client registration, by adding a vLEI check and a configurable confidence threshold. Jeffery acknowledged that KERI advocates might question building on OAuth, and explained the choice as a minor augmentation to systems payers have already approved. The panel proposed a small CMS-aligned network of payers as a first pilot. **Questions and close.** Answers covered why a canonical URL is used as shorthand and why state license numbers do not solve organizational identity across states and hierarchies. Jeffery closed by pointing attendees to KERI Foundation sessions, noting healthKERI's open-source release of witnesses, watchers and the Locksmith wallet. ## Key terms vLEI, LEI, ECR credential, purpose of use, CMS-0057, payer-to-payer, FHIR, FAST Security, dynamic client registration, trust equity ## Claims and their evidence - About 90 percent of health plans already hold an LEI. [presenter-reported] - Connecting one consumer app to 350 health plans took about six months of manual onboarding. [presenter-reported] - By the end of the year, ONYX expects to provide interoperability capability for more than half of the state Medicaid agencies. [presenter-reported] - A valid vLEI alone would not admit an organization to healthcare exchange; specific ECR credentials would define the permitted purposes of use. [presenter-reported] - healthKERI has released its witness, watcher and Locksmith wallet code as open source through the KERI Foundation. [presenter-reported] ## Related CMS-0057, FHIR and SMART on FHIR, FAST Security (also known as UDAP), OAuth 2.0 dynamic client registration, TEFCA, Carequality, the GLEIF vLEI ecosystem, the Provenant telecommunications use case, Philip Feairheller's KERIConf 2026 sessions, KERI Foundation sessions at KERIConf 2026. ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (13-scott-stuewe-mark-scrimshire-jared-jeffery-provenanting-patient-s-medi.md), all minutes read. No quotations; paraphrase only. Not yet read by Mark.

Links from other tables