# VHL Receiver - Verifiable Health Link v0.0.2-current

* [**Table of Contents**](toc.md)
* [**Artifacts Summary**](artifacts.md)
* **VHL Receiver**

## ActorDefinition: VHL Receiver 

| | |
| :--- | :--- |
| *Official URL*:https://profiles.ihe.net/ITI/VHL/ActorDefinition/VHLReceiver | *Version*:0.0.2-current |
| Active as of 2026-03-12 | *Computable Name*:VHLReceiver |

 
A system or organization that receives a Verified Health Link (VHL) from a VHL Holder and uses it to retrieve health documents from a VHL Sharer, after verifying the authenticity and integrity of the VHL. 

* Requirements: Contact Email
  * This actor fulfills the following requirements:* **Purpose:**
 Ensure that the VHL Receiver generates audit records when receiving and using a Verified Health Link (VHL) to retrieve health information, in support of accountability and traceability.


  **Description:**
 The [VHL Receiver](ActorDefinition-VHLReceiver.md) MAY record audit events for critical events during its handling of a VHL. These MAY include:
* The [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL jointly establish a secure connection prior to executing any Verified Health Link (VHL) transactions involving the exchange of sensitive data.


  This requirement is satisfied by implementing secure channel establishment as defined in the [Audit Trail and Node Authentication (ATNA)](https://profiles.ihe.net/ITI/TF/Volume1/ch-9.html) Profile, specifically through the Authenticate Node [ITI-19] transaction.


  This requirement entails:


  Establishing this secure channel ensures confidentiality, integrity, and bilateral authentication of all subsequent communications, and fulfills the trust obligations defined in the [Establish Trust](Requirements-EstablishTrust.md) requirement.
* Before participating in any Verified Health Link (VHL) transactions, the [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL establish a trust relationship based on shared acceptance of a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  Trust is established by referencing and accepting public key material published and distributed in accordance with this specification ( via [Retrieve Trust List Response](Requirements-RetrieveTrustListResponse.md)).


  All participants MUST validate digital signatures using keys that are anchored in the agreed trust framework.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), as a participant in the trust network, SHALL be capable of retrieving public key infrastructure (PKI) material from a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  The retrieved material MAY include:


  Participants SHOULD cache the received trust list to reduce network and server load.


  **Preconditions:**
* When a [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md) generates a new public-private key pair for use within the VHL trust network, they SHALL submit the corresponding public key material to the [Trust Anchor](ActorDefinition-TrustAnchor.md) for validation and inclusion in the trust list.


  The submission MAY include metadata to support categorization of key usage (e.g., digital signatures, encryption, secure channels) and business or operational context.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), after receiving PKI material from a [Trust Anchor](ActorDefinition-TrustAnchor.md), SHALL validate and process the trust information for subsequent cryptographic operations.


  Participants SHOULD:
* The [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL initiate a request to retrieve a single health document from a [VHL Sharer](ActorDefinition-VHLSharer.md), using a previously received and validated Verified Health Link (VHL).


  This transaction SHALL be conducted over a secure channel. Both the Receiver and Sharer SHALL validate each other's participation in the trust network using PKI material published by the [Trust Anchor](ActorDefinition-TrustAnchor.md).


  **Optional behaviors:**
* The [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL initiate a request to retrieve a set of health documents from a [VHL Sharer](ActorDefinition-VHLSharer.md), using a previously received and validated Verified Health Link (VHL).


  Both the Receiver and Sharer SHALL validate each other's participation in the trust network using PKI material published by the [Trust Anchor](ActorDefinition-TrustAnchor.md).


  **Optional behaviors:**
* The [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL be capable of receiving a Verified Health Link (VHL) from a [VHL Holder](ActorDefinition-VHLHolder.md) through a supported transport mechanism (e.g., QR code scan, direct URL, or digital message).


  Upon receipt, the Receiver SHALL:


  Receipt of the VHL may occur through direct user interaction (e.g., scanning a QR code) or automated channels, depending on the implementation context.
* The [VHL Receiver](ActorDefinition-VHLReceiver.md), upon receiving a digitally signed health document from a [VHL Sharer](ActorDefinition-VHLSharer.md), MAY verify the document's digital signature using previously retrieved PKI material.


  This verification process confirms the authenticity, integrity, and provenance of the document independently of the Verified Health Link (VHL) itself.


  The public key used for this verification MAY:


  Implementers SHOULD consult cross-profile guidance regarding interoperability with the [IHE Document Digital Signature (DSG) profile](https://profiles.ihe.net/ITI/TF/Volume1/ch-37.html), particularly in cases where additional attestation, long-term non-repudiation, or multi-party signatures are involved.: No contact email has been registered.
* Requirements: Jurisdiction
  * This actor fulfills the following requirements:* **Purpose:**
 Ensure that the VHL Receiver generates audit records when receiving and using a Verified Health Link (VHL) to retrieve health information, in support of accountability and traceability.


  **Description:**
 The [VHL Receiver](ActorDefinition-VHLReceiver.md) MAY record audit events for critical events during its handling of a VHL. These MAY include:
* The [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL jointly establish a secure connection prior to executing any Verified Health Link (VHL) transactions involving the exchange of sensitive data.


  This requirement is satisfied by implementing secure channel establishment as defined in the [Audit Trail and Node Authentication (ATNA)](https://profiles.ihe.net/ITI/TF/Volume1/ch-9.html) Profile, specifically through the Authenticate Node [ITI-19] transaction.


  This requirement entails:


  Establishing this secure channel ensures confidentiality, integrity, and bilateral authentication of all subsequent communications, and fulfills the trust obligations defined in the [Establish Trust](Requirements-EstablishTrust.md) requirement.
* Before participating in any Verified Health Link (VHL) transactions, the [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL establish a trust relationship based on shared acceptance of a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  Trust is established by referencing and accepting public key material published and distributed in accordance with this specification ( via [Retrieve Trust List Response](Requirements-RetrieveTrustListResponse.md)).


  All participants MUST validate digital signatures using keys that are anchored in the agreed trust framework.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), as a participant in the trust network, SHALL be capable of retrieving public key infrastructure (PKI) material from a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  The retrieved material MAY include:


  Participants SHOULD cache the received trust list to reduce network and server load.


  **Preconditions:**
* When a [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md) generates a new public-private key pair for use within the VHL trust network, they SHALL submit the corresponding public key material to the [Trust Anchor](ActorDefinition-TrustAnchor.md) for validation and inclusion in the trust list.


  The submission MAY include metadata to support categorization of key usage (e.g., digital signatures, encryption, secure channels) and business or operational context.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), after receiving PKI material from a [Trust Anchor](ActorDefinition-TrustAnchor.md), SHALL validate and process the trust information for subsequent cryptographic operations.


  Participants SHOULD:
* The [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL initiate a request to retrieve a single health document from a [VHL Sharer](ActorDefinition-VHLSharer.md), using a previously received and validated Verified Health Link (VHL).


  This transaction SHALL be conducted over a secure channel. Both the Receiver and Sharer SHALL validate each other's participation in the trust network using PKI material published by the [Trust Anchor](ActorDefinition-TrustAnchor.md).


  **Optional behaviors:**
* The [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL initiate a request to retrieve a set of health documents from a [VHL Sharer](ActorDefinition-VHLSharer.md), using a previously received and validated Verified Health Link (VHL).


  Both the Receiver and Sharer SHALL validate each other's participation in the trust network using PKI material published by the [Trust Anchor](ActorDefinition-TrustAnchor.md).


  **Optional behaviors:**
* The [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL be capable of receiving a Verified Health Link (VHL) from a [VHL Holder](ActorDefinition-VHLHolder.md) through a supported transport mechanism (e.g., QR code scan, direct URL, or digital message).


  Upon receipt, the Receiver SHALL:


  Receipt of the VHL may occur through direct user interaction (e.g., scanning a QR code) or automated channels, depending on the implementation context.
* The [VHL Receiver](ActorDefinition-VHLReceiver.md), upon receiving a digitally signed health document from a [VHL Sharer](ActorDefinition-VHLSharer.md), MAY verify the document's digital signature using previously retrieved PKI material.


  This verification process confirms the authenticity, integrity, and provenance of the document independently of the Verified Health Link (VHL) itself.


  The public key used for this verification MAY:


  Implementers SHOULD consult cross-profile guidance regarding interoperability with the [IHE Document Digital Signature (DSG) profile](https://profiles.ihe.net/ITI/TF/Volume1/ch-37.html), particularly in cases where additional attestation, long-term non-repudiation, or multi-party signatures are involved.: 001

