Enabling Programmable Self with HealthVault

Trusting Data in HealthVault Data Types

Knowing the origin of data is often critical for an application that is using it for sensitive purposes. Some use cases warrant working with only trusted data, some warrant knowing whether the data is from a device or self-entered by the users, and in some cases the application might just want to work with known data providers.

HealthVault provides several ways to look at data provenance. Applications can look at the created_by and updated_by fields of a data type and see whether they were updated by devices or known applications. Additionally, HealthVault provides digital signing of data, which can create a very secure ecosystem of trust.

In our example, we look at the Source attribute of Weight items to see whether they were uploaded by a Withings scale or added manually by the user.

Digitally Signing Data

HealthVault provides a way to digitally sign all data types. For instance, using the .NET SDK, an application can sign HealthVault types very easily. Example 4-13 shows a snippet of code that can be used to sign the Weight data type. The certificate in cert.Import can be obtained from a trusted provider such as VeriSign, Comodo, etc.

Example 4-13. Signing Weight data

 protected void Btn_SubmitAndSignWeight_Click(object sender, EventArgs e) { double weight = double.Parse(Txt_Weight.Text); Weight w = new Weight( new HealthServiceDateTime(DateTime.Now), new WeightValue( weight * 1.6, new DisplayValue(weight, "lbs", "lbs"))); X509Certificate2 cert ...