Consent management

What it is

Managing consent is more than obtaining a signature. It covers three planes:

• Policy: which model applies, which uses require permission and which have another legal basis.
• Process: how the person is informed, how they record or change their decision and how they revoke it.
• Technology: how the decision is stored in a format systems understand and how it is applied at each access.

Models

• Opt-in or opt-out. The IHE BPPC profile supports both implied and explicit consent environments.
• Granularity. In Austria, ELGA provides three kinds of objection: general, partial (to one application, such as eBefund or eMedikation) and situational (for one episode of care, only at the point of care).
• Primary and secondary use. In the European Health Data Space, people can restrict health professionals' access to their data and opt out of secondary use in a simple and reversible way, although under safeguards their data may still be used for certain important public interest purposes.
• When it is not based on consent. The OECD Recommendation on Health Data Governance asks that people can still express preferences: object, or actively request that their data be shared, and be told the reasons if their request cannot be honoured.

Standards

Common misconceptions

• Confusing recording with enforcing. HL7 states that the Consent resource does not enforce decisions: that belongs to access control mechanisms such as OAuth, UMA or XACML.
• Expecting the standard to define the policy. IHE says so explicitly in BPPC: each domain writes its own policies.
• Forgetting revocation. In ELGA, if a person withdraws their objection, data that were not made available while it applied are not restored.
• Using one model for everything. FHIR distinguishes privacy, treatment and research consents; only privacy consent is formally modeled in the resource.