Our recent HL7 FAST webinar, “Building the Consent Trust Stack: Scaling Privacy, Patient Choice and Data Exchange Across Healthcare,” reinforced an important point for our industry:
Computable consent is more than converting a paper form into structured digital data; it provides the infrastructure for trusted, policy-aware data exchange.
As healthcare becomes increasingly connected across providers, payers, HIEs, national networks, state ecosystems, and consumer applications, we face a fundamental challenge: How do we enable information to move while ensuring that all data holders understand and consistently apply the patient’s choices, applicable privacy laws, and other conditions governing the use and disclosure of that information?
That challenge is becoming more urgent as federal and state privacy requirements continue to intersect with sensitive information such as behavioral health, substance use disorder, reproductive health, and other categories of data. At the same time, patients increasingly expect greater control over what is shared, with whom, for what purpose, and for how long. Manual workflows and scanned consent forms were never designed to support that environment. Automation is essential to sharing large volumes of data with the right, authorized parties: providers, payers, caregivers, researchers, and others.
Consent Must Become Operational
FAST Consent Co-Lead Mohammad Jafari walked through the architecture required to move from capturing a patient's preference to enforcing that preference within a data-access workflow.
A scalable environment must discover applicable patient consent, validate whether it remains active, determine whether patient consent is required for the transaction, request patient consent when it does not exist, evaluate the resulting permissions in the context of applicable privacy rules and other policies, and ultimately connect those decisions to authorization and enforcement.
This is where the distinction between simply having consent and having computable consent becomes critical.
The FAST Scalable Consent Managementapproach defines the exchange patterns needed to manage the consent lifecycle across systems; it does not define or prescribe the content of the consent itself. These patterns support requesting, reviewing, and recording a patient’s consent decision—whether the underlying consent content is computable or non-computable—as well as revocation, delegation, provenance, auditing, and communication of consent-status changes across repositories throughout the ecosystem.
One particularly important capability now being finalized is the use of FHIR Subscriptions for consent events. Rather than organizations repeatedly checking whether a consent has changed, systems can be notified when consent is granted, revoked, replaced, delegated, or expires. This allows EHRs, HIEs, payers, networks, and applications to remain synchronized with the patient's current decision, ensuring the patient’s consent preferences are consistent throughout their care journey. FAST plans to continue testing this capability at the September HL7 Connectathon.