Model patient consent in FHIR by first choosing the release, then recording the source directive and its scope, and only then encoding machine-readable rules if a deployment needs them. A FHIR Consent records choices about use or disclosure; it does not, by itself, prove that a directive is legally valid or enforce access. This guide uses the permanent FHIR R4 (4.0.1) and R5 (5.0.0) specifications, and focuses on the privacy-consent use case.
Choose the FHIR release before designing the record
FHIR R4 and R5 use different element names and structures for consent. Select the version supported by the system and its implementation guide; do not copy an example from one release into another without checking it against that release’s profile and validation rules.
As an Amazon Associate I earn from qualifying purchases.
| Concern | FHIR R4 (4.0.1) | FHIR R5 (5.0.0) |
|---|---|---|
| Person or resource covered | patient |
subject |
| Consent date | dateTime |
date |
| Recipient party | performer |
grantee |
| Policy reference | policy |
policyBasis |
| Source document or reference | source[x] |
sourceAttachment and sourceReference |
| Scope of modeled consent use | Privacy is modeled; advance care directives are among anticipated uses. | Privacy is the only fully modeled use; treatment and research are anticipated but not formally modeled to the same degree. |
These are release-level distinctions in the FHIR R4 Consent specification and FHIR R5 Consent specification. Element requirements and available profiles can vary by implementation guide.
Decide what the Consent record represents
FHIR describes privacy consent, consent for a specific treatment, and research participation or data sharing as broad areas of patient consent. In R5, however, privacy consent is the only one fully modeled; treatment and research are anticipated uses rather than equally formalized workflows. Do not assume a generic Consent instance is sufficient for treatment or research consent without an applicable profile or implementation guide. HL7 describes privacy consent as authorization to collect, use, or disclose information in a policy context (R5 Consent).
Choose between a record that helps users discover and retrieve the directive and a record intended to carry computable rules. A metadata-only record can describe an implicit consent event or an explicit consent document and attach or reference its original content. It should not be presented as a machine-executable policy unless it actually contains or references rules that the consuming system can interpret.
Record the subject, parties, dates, and source
For an R5 record, begin with the required status and identify the subject to whom the consent applies. Record the fully executed date in date, the effective interval in period when applicable, and the party granting rights in grantor. Use grantee for recipients, when known. An external business identifier can help identify the consent record outside FHIR.
Preserve the human-readable source directive instead of relying solely on a derived representation. R5 sourceReference can point to a Consent, DocumentReference, Contract, or QuestionnaireResponse; sourceAttachment can carry source content. Choose the appropriate element for the source and implementation, and keep the link between the source and any derived rules clear. These elements are described in the R5 Consent specification.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Choose how to represent the rules
Use metadata and a source document when that is the real purpose
If the system needs to index, search for, or retrieve a consent record, capture enough metadata to identify its subject, status, source, and relevant dates, then attach or reference the directive. This is useful as a record of a consent event or document, but the metadata alone does not tell a decision engine which operation to permit or deny.
Use structured provisions for common computable rules
When the deployment requires machine-readable privacy preferences, R5 provides provision for structured rules. Model the dimensions that matter to the policy, such as data, actors or roles, actions, purposes, and time periods. R5’s policyBasis can reference a computable policy or backing policy, including one expressed in a policy language (R5 Consent).
Do not treat a field value as self-interpreting across organizations. The applicable profile and policy must define what opt-in, opt-out, exceptions, and other rule patterns mean in the specific deployment. A rule that appears permissive in a FHIR instance can still be constrained by organizational or jurisdictional policy.
Link derived rules to the authoritative directive
If a human directive is transformed into a computable representation, maintain an explicit relationship between the two and make clear which one is authoritative for the particular use. That prevents a receiving system from mistaking a workflow record or translation for the legally operative source. The choice between source document, structured provisions, and referenced policy is an implementation decision, not a substitute for defining authority and lineage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Design access enforcement separately
A Consent record expresses choices; it does not specify the complete behavior that protects data. HL7 states that enforcement is outside the resource’s scope and may use access-control methods such as OAuth, UMA, or XACML (R5 Consent). A deployment therefore needs a decision and enforcement architecture that maps the consent representation, applicable policy, and requested operation to an access outcome. Depending on the system, that design may also require role-based or attribute-based rules.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory Caregiver journal is a great gift, or purchase for anyone caring for someone else - whether that be in an assisted living facility, long term care facility, or any other instance where daily logs for patient care are needed
- There are spaces to log various important information like insurance and pharmacy info, as well as vaccination, emergency room visits, medical conditions and any other info that would be necessary to know and keep track of
- Daily, there are pages to log who is the caregiver that day (if they rotate), medication doses and times given, physical activity, bowel movements, personal and physical care, housekeeping, meals, behavior, supplies needed, and other important notes
- Wire-O, 100 Pages, Dimensions: 8.5" x 11” Reorder SKU: JOU-100-7CW-PP(Caregiver-Journal)
In practical terms, decide how a request is evaluated, how relevant consent rules are found and interpreted, and how the resulting decision is applied to the protected operation. The FHIR resource supplies data for that process; it is not itself the access-control engine.
Preserve legal meaning and provenance
FHIR’s data model does not determine whether a consent is legally binding in a particular jurisdiction. HL7 says legal effect depends on meeting the applicable policy-domain requirements for an enforceable contract; a representation that does not meet those requirements should be identified as a derivative of the legally binding directive (R5 Consent).
Retain the authoritative directive and the information needed to establish its lineage. Provenance can help track changes and signatures, while DocumentReference or Contract can help retain source documents or stages in a consent process. Questions such as representative authority, capacity, required signatures, revocation procedure, and legal sufficiency depend on applicable jurisdictional requirements and implementation guidance; the FHIR resource alone does not settle them.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
