FHIR Release 3 (STU) 5 Preview #3
This page is part of the FHIR Specification (v3.0.2: STU 3). The current version which supercedes this version is 4.0.1 . For a full list of available versions, see the Directory of published versions
Community Based Collaborative Care Work Group Maturity Level : 1 2   Trial Use Security Category : Patient Compartments : Patient

Detailed Descriptions for the elements in the Consent resource.

Comments This is not the time of the original consent, but the time that this statement was made or derived. Comments If the consent specifies a security label of "R" then it applies to all resources that are labeled "R" or lower. E.g. for Confidentiality, it's a high water mark. For other kinds of security labels, subsumption logic applies. Not all of the security labels make sense for use in this element (may define a narrower value set?). Comments This element is for discoverability / documentation, and does not modify or qualify the policy (e.g. the policy itself describes the purposes for which it applies). Summary true
Consent
Element Id Consent
Definition

A record of a healthcare consumer’s policy choices, consumer’s choices or choices made on their behalf by a third party, which permits or denies identified recipient(s) or recipient role(s) to perform one or more actions within a given policy context, for specific purposes and periods of time.

Control Cardinality 1..1 0..*
Type DomainResource
Comments

Broadly, there are 3 key areas of consent for patients: Consent around sharing information (aka Privacy Consent Directive - Authorization to Collect, Use, or Disclose information), consent for specific treatment, or kinds of treatment, treatment and general advance care directives. consent for research participation and data sharing.

Invariants
Defined on this element
ppc-1 : Either Rule IF Scope=privacy, Consent.subject must be a Policy or PolicyRule ( expression patient : policy.exists() or policyRule.exists(), xpath: exists(f:policy) (scope = 'privacy' and subject.resolve().exists()) implies (subject.resolve() is Patient)
ppc-2 Rule IF Scope=research, Consent.subject must be a patient (scope = 'research' and subject.resolve().exists()) implies (subject.resolve() is Patient)
ppc-3 Rule IF Scope=treatment, Consent.subject must be a patient (scope = 'treatment' and subject.resolve().exists()) implies (subject.resolve() is Patient)
ppc-4 Rule IF Scope=research, ResearchStudyContext allowed Consent.provision.extension("http://hl7.org/fhir/StructureDefinition/consent-ResearchStudyContext").exists() or exists(f:policyRule)) scope.coding.where(system='something' and code='research').exists().not()
Consent.identifier
Element Id Consent.identifier
Definition

Unique identifier for this copy of the Consent Statement.

Note This is a business identifer, identifier, not a resource identifier (see discussion )
Control Cardinality 0..1 0..*
Type Identifier
Summary true
Comments

This identifier is identifies this copy of the consent. Where this identifier is also used elsewhere as the identifier for a consent record (e.g. a CDA consent document) then the consent details are expected to be the same.

Consent.status
Element Id Consent.status
Definition

Indicates the current state of this consent. Consent resource.

Control Cardinality 1..1
Terminology Binding ConsentState ( Required )
Type code
Is Modifier true Requirements The Consent Directive that (Reason: This element is pointed to might be in various lifecycle states, e.g., labelled as a revoked Consent Directive. modifier because it is a status element that contains status entered-in-error which means that the resource should not be treated as valid)
Summary true
Comments

This element is labeled as a modifier because the status contains the codes rejected and entered-in-error that mark the Consent as not currently valid.

Consent.category Consent.scope
Element Id Consent.scope
Definition

A classification selector of the type of consents found in the statement. This element supports indexing and retrieval of consent statements. being presented with the base being Privacy, Treatment, or Research.

Control Cardinality 0..* 1..1
Terminology Binding Consent Category Scope Codes ( Example Extensible )
Type CodeableConcept
Is Modifier true (Reason: Allows changes to codes based on scope selection)
Summary true
Consent.patient Consent.category
Element Id Consent.category
Definition

The patient/healthcare consumer to whom this A classification of the type of consents found in the statement. This element supports indexing and retrieval of consent applies. statements.

Control Cardinality 1..1 1..*
Type Terminology Binding Reference Consent Category Codes ( Patient Extensible )
Summary Type true CodeableConcept
Comments Commonly, the patient the consent pertains to is the author, but for young and old people, it may be some other person. Summary true
Consent.period Consent.subject
Element Id Consent.subject
Definition

Relevant time or time-period when The patient/healthcare practitioner to whom this Consent is applicable. consent applies.

Control Cardinality 0..1
Type Period Reference ( Patient | Practitioner )
Meaning if Missing Patterns all date ranges included Reference(Patient,Practitioner): Common patterns = Participant , ParticipantContactable , ParticipantLiving
Summary true
Comments

This can be a subset of Commonly, the period of subject the original statement. consent pertains to is the author, but for young and old people, it may be some other person.

Consent.dateTime
Element Id Consent.dateTime
Definition

When this Consent Date and time the consent instance was issued / created / indexed. agreed to.

Control Cardinality 0..1
Type dateTime
Summary true
Consent.consentingParty Consent.performer
Element Id Consent.performer
Definition

Either the Grantor, which is the entity responsible for granting the rights listed in a Consent Directive or the Grantee, which is the entity responsible for complying with the Consent Directive, including any obligations or limitations on authorizations and enforcement of prohibitions.

Control Cardinality 0..*
Type Reference ( CareTeam | HealthcareService | Organization | Patient | Practitioner | RelatedPerson | PractitionerRole )
Patterns Reference(CareTeam,HealthcareService,Organization,Patient,Practitioner,RelatedPerson,PractitionerRole): Common patterns = Participant
Alternate Names consentor
Summary true
Comments

Commonly, the patient the consent pertains to is the consentor, but particularly for young and old people, it may be some other person - e.g. a legal guardian. Consent.actor Definition Who or what Where HealthCareService is controlled by this consent. Use group listed, some services might not be appropriate based on the type of service and if they can be segmented as an independent or dependent individual entity that might not be eligible to identify be a set grantee.

A Consent without a listed performer may be used as a statement of actors preference by some property they share (e.g. 'admitting officers'). the subject and is not in force.

Control 0..* Consent.manager Meaning if Missing There is no specific actor associated with the consent
Summary Element Id true Consent.actor.role Consent.manager
Definition

How the individual is involved in the resources content The actor that is described in manages the consent. consent through its lifecycle.

Control Cardinality 1..1 0..*
Terminology Binding Type SecurityRoleType Reference ( Extensible HealthcareService | Organization | Patient | Practitioner )
Type Patterns CodeableConcept Reference(HealthcareService,Organization,Patient,Practitioner): Common patterns = Participant
Alternate Names manager
Consent.actor.reference Consent.controller
Element Id Consent.controller
Definition

The resource actor that identifies controls/enforces the actor. To identify a actors by type, use group access according to identify a set of actors by some property they share (e.g. 'admitting officers'). the consent.

Control Cardinality 1..1 0..*
Type Reference ( Device | Group | CareTeam HealthcareService | Organization | Patient | Practitioner | RelatedPerson ) Consent.action Definition Actions controlled by this consent. Control 0..* Terminology Binding Consent Action Codes ( Example )
Type Patterns CodeableConcept Reference(HealthcareService,Organization,Patient,Practitioner): Common patterns = Participant
Alternate Names Meaning if Missing all actions controller
Summary true Consent.sourceAttachment
Comments Element Id Note that this is the direct action (not the grounds for the action covered in the purpose element). At present, the only action in the understood and tested scope of this resource is 'read'. Consent.organization Consent.sourceAttachment
Definition

The organization that manages the consent, and the framework within source on which it this consent statement is executed. based. The source might be a scanned original paper form.

Control Cardinality 0..*
Type Reference ( Organization Attachment ) Alternate Names custodian
Summary Comments true

The source can be contained inline (Attachment), referenced directly (Consent), referenced in a consent repository (DocumentReference), or simply by an identifier (Identifier), e.g. a CDA document id.

Consent.source[x] Consent.sourceReference
Element Id Consent.sourceReference
Definition

The source on which this consent statement is based. The source might be a scanned original paper form, or a A reference to a consent that links back to such a source, a reference to a document repository (e.g. XDS) that stores the original consent document.

Control Cardinality 0..1 0..*
Type Attachment | Identifier | Reference ( Consent | DocumentReference | Contract | QuestionnaireResponse )
[x] Note See Choice of Data Types for further information about how to use [x] Summary Patterns true Reference(Consent,DocumentReference,Contract,QuestionnaireResponse): No common pattern
Comments

The source can be contained inline (Attachment), referenced directly (Consent), referenced in a consent repository (DocumentReference), or simply by an identifier (Identifier), e.g. a CDA document id.

Consent.policy
Element Id Consent.policy
Definition

The references to the policies that are included in this consent scope. Policies may be organizational, but are often defined jurisdictionally, or in law.

Control Cardinality 0..*
Comments

if policy and policyRule are not present, the resource must include the policy being agreed to, or complied with, and that policy and/or policyRule SHOULD be populated as soon as is practical to support workflows that require computability. In addition, the policy could be indicated via the sourceReference or sourceAttachment content.

Alternately, creating an invariant for individual scopes that forces one or more of the elements to be populated as part of a profile or Implementation Guide may be advisable.

Consent.policy.authority
Element Id Consent.policy.authority
Definition

Entity or Organization having regulatory jurisdiction or accountability for  enforcing enforcing policies pertaining to Consent Directives.

Control Cardinality 0..1
Type uri
Invariants
Affect this element
ppc-1 : Either Rule IF Scope=privacy, Consent.subject must be a Policy or PolicyRule ( expression patient : policy.exists() or policyRule.exists(), xpath: exists(f:policy) or exists(f:policyRule)) (scope = 'privacy' and subject.resolve().exists()) implies (subject.resolve() is Patient)
Consent.policy.uri
Element Id Consent.policy.uri
Definition

The references to the policies that are included in this consent scope. Policies may be organizational, but are often defined jurisdictionally, or in law.

Control Cardinality 0..1
Type uri
Comments

This element is for discoverability / documentation, documentation and does not modify or qualify the policy rules.

Invariants
Affect this element
ppc-1 : Either Rule IF Scope=privacy, Consent.subject must be a Policy or PolicyRule ( expression patient : policy.exists() or policyRule.exists(), xpath: exists(f:policy) or exists(f:policyRule)) (scope = 'privacy' and subject.resolve().exists()) implies (subject.resolve() is Patient)
Consent.policyRule
Element Id Consent.policyRule
Definition

A referece reference to the specific base computable regulation or policy.

Control Cardinality 0..1
Terminology Binding Consent PolicyRule Codes ( Extensible )
Type uri CodeableConcept
Requirements

Might be a unique identifier of a policy set in XACML, or other rules engine.

Summary true
Comments

If the policy reference policyRule is not known, the resource cannot absent, computable consent would need to be processed. Where constructed from the reference is absent, there is no particular policy other than what is expressed directly in elements of the consent Consent resource.

Invariants
Affect this element
ppc-1 : Either Rule IF Scope=privacy, Consent.subject must be a Policy or PolicyRule ( expression patient : policy.exists() or policyRule.exists(), xpath: exists(f:policy) or exists(f:policyRule)) (scope = 'privacy' and subject.resolve().exists()) implies (subject.resolve() is Patient)
Consent.securityLabel Consent.verification
Definition A set of security labels that define which resources are controlled by this consent. If more than one label is specified, all resources must have all the specified labels. Control Element Id 0..* Consent.verification
Terminology Binding Definition All Security Labels ( Extensible )

Whether a treatment instruction (e.g. artificial respiration yes or no) was verified with the patient, his/her family or another authorized person.

Type Cardinality Coding 0..*
Summary true
Consent.purpose Consent.verification.verified
Definition Element Id The context of the activities a user is taking - why the user is accessing the data - that are controlled by this consent. Consent.verification.verified
Control Definition 0..*

Has the instruction been verified.

Terminology Binding Cardinality PurposeOfUse ( Extensible ) 1..1
Type Coding boolean
Summary true
Consent.dataPeriod Consent.verification.verificationType
Element Id Consent.verification.verificationType
Definition

Clinical or Operational Relevant period Extensible list of time that bounds the data controlled by this consent. verification type starting with verification and re-validation.

Control Cardinality 0..1
Type Terminology Binding Period Consent Vefication Codes ( Extensible )
Summary Type true CodeableConcept
Comments

This has a different sense to the Consent.period - that is when the consent agreement holds. This is allows the time period verification element to hold multiple use cases including RelatedPerson verification of the data that is controlled by Grantee decision and periodic re-validation of the agreement. consent.

Consent.data Consent.verification.verifiedBy
Element Id Consent.verification.verifiedBy
Definition

The resources controlled by this consent, if specific resources are referenced. person who conducted the verification/validation of the Grantee decision.

Control Cardinality 0..* 0..1
Meaning if Missing Type all data Reference ( Organization | Practitioner | PractitionerRole )
Summary Patterns true Reference(Organization,Practitioner,PractitionerRole): Common patterns = Participant
Consent.data.meaning Consent.verification.verifiedWith
Element Id Consent.verification.verifiedWith
Definition

How Who verified the resource reference is interpreted when testing consent restrictions. instruction (Patient, Relative or other Authorized Person).

Control Cardinality 1..1 0..1
Terminology Binding Type ConsentDataMeaning Reference ( Required Patient | RelatedPerson )
Type code Patterns Summary Reference(Patient,RelatedPerson): Common patterns = Participant , ParticipantContactable , ParticipantLiving true
Consent.data.reference Consent.verification.verificationDate
Element Id Consent.verification.verificationDate
Definition

A reference to a specific resource that defines which resources are covered by this consent. Date(s) verification was collected.

Control Cardinality 1..1 0..*
Type Reference ( Any dateTime )
Summary Comments true

Allows for history of verification/validation.

Consent.except Consent.provision
Element Id Consent.provision
Definition

An exception to the base policy of this consent. An exception can be an addition or removal of access permissions.

Control Cardinality 0..* 0..1
Summary true
Consent.except.type Consent.provision.type
Element Id Consent.provision.type
Definition

Action to take - permit or deny - when the exception rule conditions are met. Not permitted in root rule, required in all nested rules.

Control Cardinality 1..1 0..1
Terminology Binding ConsentExceptType ConsentProvisionType ( Required )
Type code
Summary true
Consent.except.period Consent.provision.period
Element Id Consent.provision.period
Definition

The timeframe in this exception rule is valid.

Control Cardinality 0..1
Type Period
Summary true
Comments

This is the bound effective time of the consent and should be in the base provision in the Consent resource.

Consent.except.actor Consent.provision.actor
Element Id Consent.provision.actor
Definition

Who or what is controlled by this Exception. rule. Use group to identify a set of actors by some property they share (e.g. 'admitting officers').

Control Cardinality 0..*
Meaning if Missing There is no specific actor associated with the exception
Consent.except.actor.role Consent.provision.actor.role
Element Id Consent.provision.actor.role
Definition

How the individual is involved in the resources content that is described in the exception.

Control Cardinality 1..1
Terminology Binding SecurityRoleType ( Extensible )
Type CodeableConcept
Consent.except.actor.reference Consent.provision.actor.reference
Element Id Consent.provision.actor.reference
Definition

The resource that identifies the actor. To identify a actors by type, use group to identify a set of actors by some property they share (e.g. 'admitting officers').

Control Cardinality 1..1
Type Reference ( Device | Group | CareTeam | Organization | Patient | Practitioner | RelatedPerson | PractitionerRole )
Patterns Reference(Device,Group,CareTeam,Organization,Patient,Practitioner,RelatedPerson,PractitionerRole): Common patterns = Participant
Consent.except.action Consent.provision.action
Element Id Consent.provision.action
Definition

Actions controlled by this Exception. Rule.

Control Cardinality 0..*
Terminology Binding Consent Action Codes ( Example )
Type CodeableConcept
Meaning if Missing all actions
Summary true
Comments

Note that this is the direct action (not the grounds for the action covered in the purpose element). At present, the only action in the understood and tested scope of this resource is 'read'.

Consent.except.securityLabel Consent.provision.securityLabel
Element Id Consent.provision.securityLabel
Definition

A set security label, comprised of 0..* security labels that label fields (Privacy tags), which define which resources are controlled by this exception. If more than one label is specified, all resources must have all the specified labels.

Control Cardinality 0..*
Terminology Binding All Security Labels SecurityLabels ( Extensible )
Type Coding
Summary true
Comments

If the consent specifies a security label of "R" then it applies to all resources that are labeled "R" or lower. E.g. for Confidentiality, it's a high water mark. For other kinds of security labels, subsumption logic applies. Not all When the purpose of use tag is on the security labels make sense for data, access request purpose of use in this element (may define a narrower value set?). shall not conflict.

Consent.except.purpose Consent.provision.purpose
Element Id Consent.provision.purpose
Definition

The context of the activities a user is taking - why the user is accessing the data - that are controlled by this exception. rule.

Control Cardinality 0..*
Terminology Binding PurposeOfUse ( Extensible )
Type Coding
Summary true
Comments

E.g. if When the purpose of use tag is 'research', then the operational context must be research, in order for on the consent to apply. Not all data, access request purpose of the security labels make sense for use in this element (may define a narrower value set?). shall not conflict.

Consent.except.class Consent.provision.class
Element Id Consent.provision.class
Definition

The class of information covered by this exception. rule. The type can be a FHIR resource type, a profile on a type, or a CDA document, or some other type that indicates what sort of information the consent relates to.

Control Cardinality 0..*
Terminology Binding Consent Content Class ( Extensible )
Type Coding
Summary true
Comments

Multiple types are or'ed together. The intention of the contentType element is that the codes refer to profiles or document types defined in a standard or an implementation guide somewhere.

Consent.except.code Consent.provision.code
Element Id Consent.provision.code
Definition

If this code is found in an instance, then the exception rule applies.

Control Cardinality 0..*
Terminology Binding Consent Content Codes ( Example )
Type Coding CodeableConcept
Summary true
Comments

Typical use of this is a Document code with class = CDA.

Consent.except.dataPeriod Consent.provision.dataPeriod
Element Id Consent.provision.dataPeriod
Definition

Clinical or Operational Relevant period of time that bounds the data controlled by this exception. rule.

Control Cardinality 0..1
Type Period
Summary true
Comments

This has a different sense to the Consent.period - that is when the consent agreement holds. This is the time period of the data that is controlled by the agreement.

Consent.except.data Consent.provision.data
Element Id Consent.provision.data
Definition

The resources controlled by this exception, rule if specific resources are referenced.

Control Cardinality 0..*
Meaning if Missing all data
Summary true
Consent.except.data.meaning Consent.provision.data.meaning
Element Id Consent.provision.data.meaning
Definition

How the resource reference is interpreted when testing consent restrictions.

Control Cardinality 1..1
Terminology Binding ConsentDataMeaning ( Required )
Type code
Summary true
Consent.except.data.reference Consent.provision.data.reference
Element Id Consent.provision.data.reference
Definition

A reference to a specific resource that defines which resources are covered by this consent.

Control Cardinality 1..1
Type Reference ( Any )
Summary true
Consent.provision.provision
Element Id Consent.provision.provision
Definition

Rules which provide exceptions to the base rule or subrules.

Cardinality 0..*
Type See Consent.provision