# VHL Sharer - Verifiable Health Link v0.0.2-current

* [**Table of Contents**](toc.md)
* [**Artifacts Summary**](artifacts.md)
* **VHL Sharer**

## ActorDefinition: VHL Sharer 

| | |
| :--- | :--- |
| *Official URL*:https://profiles.ihe.net/ITI/VHL/ActorDefinition/VHLSharer | *Version*:0.0.2-current |
| Active as of 2026-03-12 | *Computable Name*:VHLSharer |

 
The VHL Sharer generates a VHL, provides the VHL to a VHL Holder, and responds to requests from a VHL Sharer to utilize the VHL. 

* Requirements: Contact Email
  * This actor fulfills the following requirements:* **Purpose:**
 Ensure that the VHL Sharer records audit events when health documents are accessed or retrieved using a Verified Health Link (VHL).


  **Description:**
 The [VHL Sharer](ActorDefinition-VHLSharer.md) MAY record audit events for critical events involving document access. These MAY include:
* The [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL jointly establish a secure connection prior to executing any Verified Health Link (VHL) transactions involving the exchange of sensitive data.


  This requirement is satisfied by implementing secure channel establishment as defined in the [Audit Trail and Node Authentication (ATNA)](https://profiles.ihe.net/ITI/TF/Volume1/ch-9.html) Profile, specifically through the Authenticate Node [ITI-19] transaction.


  This requirement entails:


  Establishing this secure channel ensures confidentiality, integrity, and bilateral authentication of all subsequent communications, and fulfills the trust obligations defined in the [Establish Trust](Requirements-EstablishTrust.md) requirement.
* Before participating in any Verified Health Link (VHL) transactions, the [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL establish a trust relationship based on shared acceptance of a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  Trust is established by referencing and accepting public key material published and distributed in accordance with this specification ( via [Retrieve Trust List Response](Requirements-RetrieveTrustListResponse.md)).


  All participants MUST validate digital signatures using keys that are anchored in the agreed trust framework.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), as a participant in the trust network, SHALL be capable of retrieving public key infrastructure (PKI) material from a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  The retrieved material MAY include:


  Participants SHOULD cache the received trust list to reduce network and server load.


  **Preconditions:**
* When a [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md) generates a new public-private key pair for use within the VHL trust network, they SHALL submit the corresponding public key material to the [Trust Anchor](ActorDefinition-TrustAnchor.md) for validation and inclusion in the trust list.


  The submission MAY include metadata to support categorization of key usage (e.g., digital signatures, encryption, secure channels) and business or operational context.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), after receiving PKI material from a [Trust Anchor](ActorDefinition-TrustAnchor.md), SHALL validate and process the trust information for subsequent cryptographic operations.


  Participants SHOULD:
* The [VHL Sharer](ActorDefinition-VHLSharer.md) MAY record audit events when health data is accessed through a Verified Health Link (VHL). These events support accountability, traceability, and compliance with applicable security and privacy regulations.


  Audit records MAY include the following metadata:


  Audit events SHALL be represented using the FHIR `AuditEvent` resource, and SHOULD conform to applicable IHE profiles such as ATNA where appropriate. Implementers MAY define additional audit logging behavior to meet jurisdictional or organizational policies.
* The [VHL Sharer](ActorDefinition-VHLSharer.md) SHALL record the consent granted by a [VHL Holder](ActorDefinition-VHLHolder.md) to authorize the sharing of their health data via a Verified Health Link (VHL). This consent confirms that the Holder agrees to the creation of a VHL and its use by authorized [VHL Receivers](ActorDefinition-VHLReceiver.md) to access specific health documents.


  In this requirement, the VHL Sharer acts as a Consent Recorder, as defined in the [Privacy Consent on FHIR (PCF)](https://profiles.ihe.net/ITI/PCF/index.html) profile. Specifically, the Sharer SHALL initiate the [Access Consent - ITI-108](https://profiles.ihe.net/ITI/PCF/ITI-108.html) transaction to formally capture the Holder's consent.


  The ITI-108 transaction SHOULD be invoked as part of the actions triggered by a Generate VHL request, particularly when legal, jurisdictional, or organizational policy requires explicit, recorded consent prior to enabling document sharing.


  This requirement enables lawful, transparent sharing of personal health information across organizations and trust domains.
* The [VHL Sharer](ActorDefinition-VHLSharer.md) SHALL generate a Verified Health Link (VHL) to be issued to a [VHL Holder](ActorDefinition-VHLHolder.md).


  The Sharer SHALL conduct all necessary tasks to prepare the content referenced by the VHL. These tasks MAY be further defined by applicable content profiles or implementation guides, and MAY include:


  Once content preparation is complete, the Sharer SHALL construct the VHL payload and sign it to produce a cryptographically verifiable authorization mechanism.


  **Optional behaviors:**: No contact email has been registered.
* Requirements: Jurisdiction
  * This actor fulfills the following requirements:* **Purpose:**
 Ensure that the VHL Sharer records audit events when health documents are accessed or retrieved using a Verified Health Link (VHL).


  **Description:**
 The [VHL Sharer](ActorDefinition-VHLSharer.md) MAY record audit events for critical events involving document access. These MAY include:
* The [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL jointly establish a secure connection prior to executing any Verified Health Link (VHL) transactions involving the exchange of sensitive data.


  This requirement is satisfied by implementing secure channel establishment as defined in the [Audit Trail and Node Authentication (ATNA)](https://profiles.ihe.net/ITI/TF/Volume1/ch-9.html) Profile, specifically through the Authenticate Node [ITI-19] transaction.


  This requirement entails:


  Establishing this secure channel ensures confidentiality, integrity, and bilateral authentication of all subsequent communications, and fulfills the trust obligations defined in the [Establish Trust](Requirements-EstablishTrust.md) requirement.
* Before participating in any Verified Health Link (VHL) transactions, the [VHL Sharer](ActorDefinition-VHLSharer.md) and [VHL Receiver](ActorDefinition-VHLReceiver.md) SHALL establish a trust relationship based on shared acceptance of a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  Trust is established by referencing and accepting public key material published and distributed in accordance with this specification ( via [Retrieve Trust List Response](Requirements-RetrieveTrustListResponse.md)).


  All participants MUST validate digital signatures using keys that are anchored in the agreed trust framework.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), as a participant in the trust network, SHALL be capable of retrieving public key infrastructure (PKI) material from a designated [Trust Anchor](ActorDefinition-TrustAnchor.md).


  The retrieved material MAY include:


  Participants SHOULD cache the received trust list to reduce network and server load.


  **Preconditions:**
* When a [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md) generates a new public-private key pair for use within the VHL trust network, they SHALL submit the corresponding public key material to the [Trust Anchor](ActorDefinition-TrustAnchor.md) for validation and inclusion in the trust list.


  The submission MAY include metadata to support categorization of key usage (e.g., digital signatures, encryption, secure channels) and business or operational context.
* A [VHL Sharer](ActorDefinition-VHLSharer.md) or [VHL Receiver](ActorDefinition-VHLReceiver.md), after receiving PKI material from a [Trust Anchor](ActorDefinition-TrustAnchor.md), SHALL validate and process the trust information for subsequent cryptographic operations.


  Participants SHOULD:
* The [VHL Sharer](ActorDefinition-VHLSharer.md) MAY record audit events when health data is accessed through a Verified Health Link (VHL). These events support accountability, traceability, and compliance with applicable security and privacy regulations.


  Audit records MAY include the following metadata:


  Audit events SHALL be represented using the FHIR `AuditEvent` resource, and SHOULD conform to applicable IHE profiles such as ATNA where appropriate. Implementers MAY define additional audit logging behavior to meet jurisdictional or organizational policies.
* The [VHL Sharer](ActorDefinition-VHLSharer.md) SHALL record the consent granted by a [VHL Holder](ActorDefinition-VHLHolder.md) to authorize the sharing of their health data via a Verified Health Link (VHL). This consent confirms that the Holder agrees to the creation of a VHL and its use by authorized [VHL Receivers](ActorDefinition-VHLReceiver.md) to access specific health documents.


  In this requirement, the VHL Sharer acts as a Consent Recorder, as defined in the [Privacy Consent on FHIR (PCF)](https://profiles.ihe.net/ITI/PCF/index.html) profile. Specifically, the Sharer SHALL initiate the [Access Consent - ITI-108](https://profiles.ihe.net/ITI/PCF/ITI-108.html) transaction to formally capture the Holder's consent.


  The ITI-108 transaction SHOULD be invoked as part of the actions triggered by a Generate VHL request, particularly when legal, jurisdictional, or organizational policy requires explicit, recorded consent prior to enabling document sharing.


  This requirement enables lawful, transparent sharing of personal health information across organizations and trust domains.
* The [VHL Sharer](ActorDefinition-VHLSharer.md) SHALL generate a Verified Health Link (VHL) to be issued to a [VHL Holder](ActorDefinition-VHLHolder.md).


  The Sharer SHALL conduct all necessary tasks to prepare the content referenced by the VHL. These tasks MAY be further defined by applicable content profiles or implementation guides, and MAY include:


  Once content preparation is complete, the Sharer SHALL construct the VHL payload and sign it to produce a cryptographically verifiable authorization mechanism.


  **Optional behaviors:**: 001

