Update NOTE 4.1 one to state: { } " However, patient-initiated workflows (for example, “patient request” purpose of use) SHALL always include explicit end-user authorization." Examples: Patient authorizes access as in SMART App Launch with clicking a button to authorize the transaction as a mechanism for capturing and carrying consent in authorization code flow Tiered OAuth Use Case - same as nominal SMART App Launch, except user profile data includes sufficiently high IAL1.8 identity assurance and AAL2 authorization assurance B2B Patient User Use Case - include consent, IAL1.8 identity assurance, and AAL2 authentication assurance Update first bullet in 4.2 to state: "Recognize that the patient already has an account (when a record represents an account)" ... "and allow them authenticate when the credentials are sufficiently strong (IAL1.8/AAL2) and the patient can be matched based on best-practice matching" Update language in 1.3 regarding App-Mediated B2B with Patient User to state : "... verify the identity of the patient or their authorized rep at IAL1.8 and authenticate them at AAL2 prior to capturing the consent or allowing their access to data." instead of: "... though the requirements on how data are restricted are beyond this guide’s scope."