[Members] Push for XMPP as mandatory standard for message exchange in Dutch Healthcare

Winfried Tilanus winfried at tilanus.com
Thu Jun 6 21:49:27 UTC 2019


As announced in the XSF muc, some more details on my attempt to push 
XMPP as mandatory standard for messaging in Dutch healthcare. I would 
appreciate it my strategy will not become public yet, so I post it here 
@members. Use it to XMPP's advantage, but don't spread it or cite from 
it without my consent. Any feedback, suggestions or questions are welcome.

I believe XMPP, with its focus on security, federated structure, 
extensibility and patterns like push, pull & pubsub and possibility to 
send both structured as unstructured data has a big potential in 
(health)care. I suggest the use of XMPP where appropriate. Technologists 
willing to investigate in it, feel it is a strong technology. Others 
rather don't learn a new technology. That had been a bit of a blocker 
until now. Right now there are several vendors in Dutch healthcare that 
are using a XMPP server as messaging back-end.

The Dutch ministry of health announced last year they are taking more 
control over data exchange in healthcare. As showcase for their new 
role, they ordered one of the standardisation institutions to create a 
norm for securing messaging/e-mail and to come up with an 
interoperability standard for messaging between different vendors and 
healthcare institutions. (Note the confusion between messaging and 
e-mail here.) The norm commission consisted mainly of vendors of 'secure 
e-mail' solutions. They came a month ago up with a norm that is wrong in 
every aspect you can imagine and their interoperability standard 
consisted out of the intent to cooperate between those vendors (!).

My push:
I couldn't resist attacking this norm publicly. My attack also caught 
the attention of the head of information of the ministry of health, 
making the members of the norm commission quite nervous. In those 
discussions (on LinkedIn, in Dutch, they are on my timeline) I sketched 
a solution for the interoperability standard based on XMPP.

At the same time a group of vendors of patient record systems and 
similar systems that is more care then cure focused (but where also a 
huge vendor for software for general practitioners participates) had a 
meetup to discuss how to support digital multidisciplinary meetings. 
They feel the need for a federated communication standard, an 
authentication standard and a standard / infrastructure for maintaining 
an address book. I knew on forehand that one of the vendors present was 
already considering using XMPP as interoperability standard for exactly 
this use. At the end of the meeting, all vendors present had already 
articulated the intent to continue creating such standard, I proposed to 
team up with the vendor already interested in XMPP and to prepare with 
that vendor a hackaton with all interested vendors to make a proof of 
concept of using XMPP here. And that is where we are now.

My strategy:
Provide a way for the Dutch ministry of health to prove that their new 
strategy is still working, despite the failure of their commission. At 
the same time bypassing all the e-mail vendors and confront them with a 
world that suddenly speaks XMPP. Technical I want to focus on messaging 
and only the communication protocol. The other issues still need to be 
discussed among the vendors.

The technical plan:
Each system for electronic patient records, health communication or each 
personal health environment vendor runs an own federating XMPP server. 
The XMPP servers prove each other they are trusted by presenting a 
certificate that is signed by an auditor. These systems themselves 
function as XMPP clients, but when sufficiently authenticated, the 
servers should allow other client connections too (opening the 
possibility for push messages on any device). If one user has accounts 
on multiple of these systems, then it translates in multiple XMPP 
addresses for that user. Once connected, users can open chats, create 
groups or do whatever they want.

Still open issues:
- Translating known identifiers (SSN, name, medical registration) to 
XMPP addresses. This part needs some serious privacy by design (but this 
is an issue anyway, with or without XMPP). There is a parallel project 
that should supply this. (https://nuts.nl/)
- Proving identities or attributes (over 18, insurance) over XMPP. We 
consider using IRMA here. (https://privacybydesign.foundation/)
- Allowing & signing of self-hosted servers (I would love that)

Proof of concept:
I plan to do more or less the following. Showing messages across systems 
is the main point I want to make, but showing the possibility to 
federate between trusted servers would make the POC stronger.
1 all participating vendors set up an XMPP server
2 an mock-auditor signs the server certificates with his root certificate
3 all servers only accept s2s connections from servers with a 
certificate signed by the root certificate of the mock-auditor
4 all participating vendors integrate some way (separate logins, 
component, server integration) with their existing messaging interface.
5 setting up a mock address book, that can be as little as a list of 
test-accounts handed out to all participating vendors, but can also 
reside in the network somewhere / somehow.
6 the users send messages by name (to be implemented on systems)
7 systems accept messages by people 'not in list'
8 happy messaging ;-)
9 bonus: show that a independent messenger can work too.
10 screencast & document everything, carefully present to the ministry 
of health and/or publish & make lots of noise

If you want to help:
- anybody who wants to think along is welcome
- help with planning/preparing the POC is welcome
- help at or being standby during the POC would be welcome
- if you are aware of or involved with 'sister initiatives' in other 
countries, please let me know, that would strengthen my argument towards 
the Dutch ministry of health.
- it may be interesting to investigate if this can become an EU(-funded) 
project, if you are in the position to help investigate that, please let 
me know

So far for now,



privacy strategist & privacy architect

More information about the Members mailing list