FHIR Consent Directive Implemenation Guide

Back to CBCC Wiki: Meetings

Back to HL7 FHIR Consent Directive Project

You can get to current Privacy Consent Directive IG in the continuous build directly: http://hl7-fhir.github.io/pcd/pcd.html

This page is used to develop new content before committing it to the Current build.

• Do NOT write more than is necessary for our reader to understand how to use
  • Rely on prior works to explain basics
  • Less is More

Draft Privacy Consent Directive IG

Introduction (Glen)

• Note we have an introduction to the PCD http://hl7-fhir.github.io/pcd/pcd.html
• Need to have consent be informed consent
• Relationship with Contract - why is a consent a contract? (Kathleen)
• Relationship with the resources it uses - Patient, Document, AuditEvent, Provenance
• Relationship with Resources it controls -
• Use of Questionnaire for UX with patient

Need to have consent be informed consent

Obtaining informed consent from patients is a central ethical requirement of health care treatment. In the context of clinical research or other areas outside of the essential processes of treatment, obtaining informed consent from the subjects of data is often also a regulatory mandate.

Informed consent for data use consists of this information, in a form that is clearly understandable to a layperson patient:

• Purpose of data use
• Benefits to the patient of data use
• Voluntary participation, including the ability to opt-out
• Degree of confidentiality the patient can expect
• Risks of data misuse and measures taken to prevent it
• Liabilities to the patient that the data-collector has for data misuse
• Contacts that the patient has before, during, and data collection.

The consent must be acknowledged by the patient, or an authorized proxy, plus a representative of the data collecting organization. Acknowledgement may be a signature on a paper document, or an electronic signature with equivalent authenticity. The FHIR consent for data disclosure reflects these elements in a persistent unalterable manner.

Relationship with the resources it uses

Patient The FHIR consent for data disclosure is a resource that is electronically signed by the patient, or proxy, and an authorized representative of the data collection agency.

Document The form of consent is a paper or electronic document authored by an institutional review board (IRB). The form and content may be regulated by laws, government regulations, or institutional policies – often all three – within jurisdictional boundaries. The FHIR consent for data disclosure contains an unalterable dated copy of the original consent document.

AuditEvent Creation of a FHIR consent for data disclosure results in a FHIR audit event, especially noting the participating parties to the consent document. Reading a FHIR consent for data disclosure results in a FHIR audit event, especially noting the party who read it. An attempt to alter to delete a FHIR consent for data disclosure, which should fail, results in a FHIR audit event, especially noting the party the attempted the act. Creation of data copies authorized by a FHIR consent for data disclosure results in a FHIR audit event, especially noting the participating parties. Reading, exporting, updating, or deleting data copies authorized by a FHIR consent for data disclosure results in a FHIR audit event, especially noting the participating parties.

Provenance Creation of a FHIR consent for data disclosure results in a FHIR provenance record, especially noting the data disclosure purpose (e.g., a clinical study identification), the IRB authorship, and the signing parties to the consent document. Creation, update, and deletion of data copies authorized by a FHIR consent for data disclosure results in a FHIR provenance record, especially noting the participating parties.

other A FHIR consent for data disclosure may additionally be related to FHIR resources that:

• Identify and authorize the IRB and other parties who may create a FHIR data disclosure consent form
• Identify and authorize the IRB and other parties who may create an instance of a signed FHIR data disclosure form
• Identify and authorize those who may collect and consume the data, e.g., SMART on FHIR OAuth scopes.

 

Relationship with Resources it controls

The FHIR consent for data disclosure may result in the creation of patient-specific authorization scopes, should such resources be defined as part of FHIR.  

Use of Questionnaire for UX with patient

Although it is possible that the form of consent document is electronic, it is current practice to obtain consent via a paper-based document. The form of consent is determined by an institutional review board (IRB). The form and content may be regulated by laws, government regulations, or institutional policies – often all three – within jurisdictional boundaries.

The UX for an electronic consent document should contain all of the elements of the paper-based equivalent.

Exceptional Cases

Authorization granted by exceptional means

• Court order to access outside of normal use
• Action of auditor
• Foster Care?
• Legal hold

Abstract Data Model (Kathleen)

• What needs to be recorded
• Types of Consent
  • Basic - TPO
  • Exception vs Inclusion
  • Research (Beth)
  • Patient Centric
• Jurisdiction Models (David) -- look to Goldstein paper
  • Implied
  • Explicit
  • Chinese?
• Cross-Organization vs Within-an-Organization

---

Types of Consent

Research (Beth)

An informed consent form for research must provide a potential research subject information about the research study/clinical that will allow the individual to decide whether or not to participate. This information includes a summary of the research study/clinical trial (including its purpose, the treatment procedures and schedule, potential risks and benefits, alternatives to participation, etc.) as well as the rights and responsibilities of all parties involved in the research study/clinical trial. By signing the document, the individual voluntarily consents to participate. Informed consent information is most often presented in the form of a written document, but may also be offered verbally by a member of the study team or in some other format (e.g., online) to the potential subject. Requirements related to the elements, language and format of informed consent can be found in federal regulations 45 CFR 46, Part 46.116.

Abstract Interaction Model (John)

• Actors -- Not clear which of these need to be formally recognized.
  • Involved in capturing consent
    • Registry of template consents available to be used
    • UX with Legal to update template consents
    • UX with Patient to select, and customize captured consent
    • Registry of Consent instances
  • Involved in enforcing consent
    • Registry of Consent instances
    • Protected Resource Service
    • Access Control Decision Engine
      • Uses Registry of Consents as PIP (May be batch, pre-fetch, real-time)
      • Uses Registry of Identities, Patients, Locations, Organizations, etc
      • Uses RBAC for gross protection of various Resource types (FHIR Resource)
      • Uses resulting data metadata to further refine returned results
    • Enforcement - enforces Decisions
  • Affected transparently
    • Repository of data
    • Requesting party
• Transactions
  • Template discovery
  • Create, Read, Update, Delete -- Replace
  • Request access decision
  • Communicate data with Consent attached
    • see CP 6865 asking for guidance on how to add a Consent to an otherwise communication pattern Bundle.
    • For example, pushing some data from one place to another, and needing to communicate the Consent
    • For example, asking for data with attached consent giving authorization for the question.

Related Work (John, Kathleen)

• Consent Receipt
  • Use of AuditEvent - disclosure
• Relationship to OAuth scopes
• Relationship to UMA -- HEART
• IHE BPPC and APPC
• HL7 CDA Privacy Consent Directive IG
• HL7 Patient Frendly Consent
• HL7 HCS
• ONC Patient Choice (David)

Examples

• USA Realm examples (Kathleen)
• Canada Examples (Pat, Ken)
• European Examples (Alex, Tarik)
• Research Examples (Rob, Kathleen)

Other Draft Materials

• Implications of SOA Architectures for Security and Privacy Bernd Blobel, PhD, FACMI, FACHI, FHL7 eHealth Competence Center Regensburg

FHIR Consent Directive in Trust Framework

Discussed in Mike Davis' FHIR Contract Design Considerations

HL7 FHIR Consent Directive Implementation Guide "Comic Book"