EHDS and WHO: how close commvita is, right by right

Prompted by a talk on the European Digital Identity wallet, we checked commvita against what the European Health Data Space asks for from the person’s side: their rights over the record, purpose before data, the wallet, and the minimum data a service should use. Five of the ten rights are in place today and two more are partly there. The wallet isn’t built.

1 What started this

In September, at an openEHR event, Zoltan Lantos of Ireland’s Department of Health gave a talk on the European Digital Identity wallet and what it means for health data. His slides set out, in four pictures, what the European Health Data Space looks like from the side of the person it’s for.

The first picture listed the rights a person has over their own record. The second put context and purpose ahead of any data: what’s going on for the person, what the service is for, and what they’ve agreed to. The third showed what the wallet does. The fourth traced a single transaction from the hospital that holds the data to the service that uses it, and it ended on one line we’d have written ourselves: the service uses the minimum data it needs for a defined purpose.

We’ve used his framing as a checklist, because it’s the clearest statement we’ve seen of what EHDS asks for in practice. He didn’t mention commvita, and nothing on this page suggests he’d endorse it. The measurements are ours, taken from the running platform at build B-740.

2 The person’s rights, one at a time

Five of the ten rights on his slide are in the patient portal today, and two more are partly there. Three aren’t: setting restrictions, sending a copy on, and access across borders.

The access list is the one we’d point a sceptic at first. It names the account that opened the record, with its role and organisation. A line saying “a clinician viewed your record” doesn’t tell you anything you can act on. It also says what it can’t cover, because a list that only starts recording partway through a record’s life shouldn’t read as complete.

The opt-out sits beside a plain account of what it doesn’t do. It doesn’t affect direct care, doesn’t withdraw anyone from a study they agreed to join, and can’t recall data shared before the choice was made.

Asking for a correction uses the same form as asking for a copy. The person picks one of six requests, and the form tells them they can only ask for their own data there.

Linked accounts is where a person lets somebody in. The limits are written on the screen itself.

3 Purpose before data

His second slide started with the person: their clinical state, their life and goals, what the service is for, a professional’s judgement, and the uses they’ve approved. Only after that does data pick up meaning and get turned into something another system can use. Then the loop goes round again with the outcome as the new context.

That’s the shape commvita is built to. Its ontology has three layers: what things mean, how people and work move between services, and how the system adapts as circumstances change. We’ve written about it in how commvita is put together. The outputs on the slide line up like this.

The slide put openEHR at the centre, as the clinical backbone, so we’ll be exact about where commvita stands. It reads the international archetype catalogue and refers to archetypes by name. It doesn’t store records as openEHR, doesn’t ship archetype definitions, and can’t run openEHR queries. The reason isn’t a missing piece of code. The templates that would make storage openEHR are clinical content other people wrote and license, and picking them is a commercial decision we haven’t taken. So commvita shares the talk’s idea of a semantic layer in the middle, and that layer is its own.

4 The wallet does three jobs, and commvita does one of them on its own

The third slide named what the wallet is for: identifying and signing a person in, presenting chosen facts about them, and signing documents. Here’s each one against commvita.

On the fourth slide’s flow, commvita would sit on the right-hand side, as a service that asks a wallet for the least it needs and checks what comes back. That part isn’t built, and we’re not putting a date on it here.

5 The minimum necessary is already in the product

The last box on the fourth slide is the one that matters most to us. A service should use the minimum data it needs for a defined purpose. commvita already does that in places where it’s easy to get wrong, and each of these is a rule the platform holds in its own code and tests.

The platform held this rule while we were building the screens for this page. Two staff accounts asked to open a demonstration record and were refused, because the person was registered with a different practice and no care relationship had been recorded. Once a referral was recorded, they could open it, and both reads went into the log below and the person’s own list above.

6 Where WHO comes in

WHO’s reference architecture for digital public infrastructure in health is still a draft for public comment. We’ve mapped commvita against its building blocks on a separate page, WHO DPI-H and EHDS alignment, so we won’t repeat the table here.

One WHO standard is worth a line of its own. commvita reads ICD-11 from WHO’s own service and never keeps a copy of the classification. WHO holds the copyright and publishes the licence, and reading from WHO means a clinician always codes against the current release. A deployment has to register with WHO to switch this on, so it isn’t connected in the demonstration.

7 What isn’t there yet

Put together, commvita is close to EHDS on minimum-necessary disclosure and on half of the person’s rights. It’s further away on restrictions, on sending data on, on the wallet and on cross-border connection. The gaps, in one place:

• No wallet sign-in, no checking of facts a wallet presents, and no relying-party role.
• Records aren’t stored as openEHR, for the licensing reason in section 3.
• No claim of conformance to the European exchange format or the EHR requirements until both are published, and no conformity assessment against either.
• No connection to MyHealth@EU for care across borders, or to HealthData@EU for research.
• A person can’t restrict which clinicians see which part of their record, and one related portal list is held only in server memory.
• What a person adds goes into their profile, which staff read, and not into the clinical record.
• Nothing sends a copy of the record to another app for them.
• A shared care opt-out can be recorded, but nothing acts on it yet.
• A parent acting for a young child isn’t built, and nor is access for a carer who has no record here.

Where to see it in commvita