In the patient-centered medical home, PCMH, patient care is overseen by a primary care physician leading a team of health care providers, who collaborate to optimize treatment. To facilitate interactions in PCMH, secure collaboration will be needed to: control access to information; dictate who can do what when; and promote sharing and concurrent access. This contrasts approaches such as the National Institute of Standard and Technology (NIST) role-based access control (RBAC), where the emphasis is on controlling access and separating responsibilities. This paper investigates secure collaboration within an application such as PCMH, through: a futuristic scenario for patient care; proposed collaboration extensions to the NIST RBAC standard with a fine-grained obligated mechanism and workflow; and a prototype of PCMH via the Google Wave real-time collaboration platform.