Sharing Health Information Through APIs
summary
Describes a Norway health-sector trust framework that pairs legal, organizational, semantic and technical layers to safely share sensitive records via APIs, using FAPI 2.0 as the protocol baseline. Explains the attacker model (web vs network) and concrete mitigations: PKCE, PAR and JAR for request integrity, mutual TLS or DPoP for sender‑constrained tokens, strict grant restrictions, and conformance testing. Reports a national OpenID Connect federation gateway that enforces checks and measurably raises inter‑actor trust.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:51What Is Trust
- 7:00Patient Security
- 12:45Hierarchy of Trust
- 13:07Trust Framework
- 17:02Attacker Model
- 18:02The Attacker Model for Oauth
- 35:49Identity Assurance Specification
- 36:46Strong Client Authentication
- 39:07Rich Authorization Requests
- 40:44Strict Requirements for the Authorization Service
related talks
59mOAuth2 on a national level - how to secure extremely sensitive apis
01h 00mHelseID Introducing Modern Web Security in a Geriatric Health Sector
21mUnlocking Data Silos Securely: Standards‑Based APIs for Regulated Sectors
45mApisecure, 14 & 15 March 2023 - John Moehrke, Co-Chair at Security Working Group.
01h 04mApisecure, 14 & 15 March 2023 - Grahame Grieve, Principal at Health Intersections Pty Ltd.
08mFederating Trust in Healthcare with SPIFFE
23mThe Smart4Health project
57mDeath by downtime