VCI™ Directory: Issuer Types
SMART Health Cards provide an open standard-based framework for generating, presenting, and verifying clinical information. By design, anyone can generate, present, and verify a SMART Health Card, allowing flexible deployments that meet new use cases in a dynamic, open world. Flexibility is a benefit but can also cause implementation challenges if every participant in the ecosystem makes different choices about which SMART Health Cards to consider trustworthy. To alleviate these challenges, trust frameworks are a critical part of the SMART Health Cards ecosystem, establishing consistent choices about which SMART Health Cards should be considered reliable in which circumstances. Resources like the VCI Directory and the CommonTrust Network establish this kind of consistency by assembling and openly publishing a list of organizations issuing SMART Health Cards that will be reliably accepted by verifiers in diverse use cases including return-to-school, return-to-work, and international travel.
Because this model of sharing verifiable clinical information is new, and because clinical record-keeping can be fragmented and complex, we have chosen to build up our directory of trusted issuers thoughtfully and carefully. We have started with the most direct and familiar sources of clinical information: pharmacies offering vaccines, labs performing tests, clinicians providing care, insurers settling bills, and public health departments keeping communities safe. We'll use the term "clinical and government" to refer to these organizations with a longstanding responsibility for maintaining individual clinical records.
Clinical and government organizations are the only issuers we include in our directory today. We’ve started with clinical and government issuers because it’s easy for verifiers to understand who these issuers are, how they work, and how clinical information can be traced back to a point of origin or audited if need be. At the same time, many other health and technology organizations play an important role in the ecosystem. We’ll use the term “networks and platforms” to refer to a diverse set of participants who provide technology to facilitate the flow of clinical information. These entities include data networks, data aggregators, and other health IT vendors.
Today, our directory maintains a bright line between the flow of information and the flow of trust. While networks and platforms support the flow of information, we anchor the flow of trust in the clinical and government issuers who bear responsibility for maintaining records. We are working with networks and platforms to find ways to increase availability of SMART Health Cards while defining the characteristics that would make networks and platforms trustworthy members of the directory. These topics are deep and complex, including aspects of data use agreements, provenance, interoperability, transparency of system design and policy, as well as legal obligations, responsibilities, and recourse in the event of mistakes. We are committed to devoting the time and careful attention this work requires.
In the meantime, we strongly encourage networks and platforms to participate in the SMART Health Cards ecosystem by enabling the clinical and government organizations they work with to issue SMART Health Cards for their constituents. The requirements to become listed in the VCI Directory are straightforward and have already been met by multiple networks and platforms on behalf of hundreds of issuers supporting hundreds of millions of individuals. Those requirements include:
- SMART Health Cards must be issued by a clinical or government organization.
- A unique issuer identifier ("iss") must be provided for each clinical or government organization represented, such that any SMART Health Card can be validated in the context of that issuer.
- SMART Health Cards must only include data that the issuer considers accurate.
We recognize that in some cases, networks and platforms may have the ability to aggregate data across borders and technical boundaries. For example, a data aggregator may be able to assemble information about immunization doses administered in different states or jurisdictions. Within the scope of our current directory, these aggregated records could still be combined into a single SMART Health Card if they can first be incorporated within a single issuer’s record set.
We strongly encourage any new issuer who wants to be listed in the VCI Directory and the CommonTrust Network to reach out to our team early and often. The best way to engage with our technical team is to join chat.fhir.org and subscribe to the "smart/health-cards” stream.