Consent Management

Overview

The system implements GDPR-compliant consent management using FHIR Consent resources. Every patient interaction that requires consent is tracked with a formal consent record.

Category	Description	Required
Treatment	Consent for medical treatment	Yes
Data Processing	GDPR data processing consent	Yes
Data Sharing	Sharing data with other providers	Optional
Communication	Email/SMS notifications	Optional
Research	Data use for research purposes	Optional

{
  "resourceType": "Consent",
  "status": "active",
  "scope": {
    "coding": [
      {
        "system": "http://terminology.hl7.org/CodeSystem/consentscope",
        "code": "patient-privacy"
      }
    ]
  },
  "category": [
    {
      "coding": [
        {
          "system": "http://loinc.org",
          "code": "59284-0",
          "display": "Patient Consent"
        }
      ]
    }
  ],
  "patient": { "reference": "Patient/ZCT_patient_001" },
  "dateTime": "2026-01-15",
  "organization": [
    { "reference": "Organization/ZCT" }
  ],
  "provision": {
    "type": "permit",
    "period": {
      "start": "2026-01-15",
      "end": "2027-01-15"
    }
  }
}

During Registration — Patients provide initial consents
At Encounter Start — Additional treatment-specific consents collected
Ongoing — Patients can review/revoke consents from their profile
Expiration — Time-limited consents are tracked and renewal reminders sent

Status	Description
`draft`	Being prepared
`proposed`	Proposed to patient
`active`	Patient agreed
`rejected`	Patient declined
`inactive`	Expired or superseded

API Endpoints

GET /Consent?patient={id}&status={status}&category={cat}
POST /Consent
GET /Consent/{resource_id}
PUT /Consent/{resource_id}
DELETE /Consent/{resource_id}

All consent decisions are timestamped and immutable
Patients can view all their active consents
Withdrawal of consent is tracked (status changes, not deletions)
Organization-specific consent requirements are configurable

Consent Management

Overview

Consent Categories

Consent Resource

Consent Flow

Consent Status Values

API Endpoints

GDPR Compliance