Privacy Consent on FHIR (PCF)
1.1.1-current - ci-build International flag

Privacy Consent on FHIR (PCF), published by IHE IT Infrastructure Technical Committee. This guide is not an authorized publication; it is the continuous build for version 1.1.1-current built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/IHE/ITI.PCF/ and changes regularly. See the Directory of published versions

Example Consent: Consent allowing most sharing but NOT data related to an encounter

Generated Narrative: Consent ex-consent-intermediate-not-encounter

status: Active

scope: Privacy Consent

category: Consent

patient: Jack Smith Male, DoB: 1923-07-25

dateTime: 2022-06-13

performer: Jack Smith Male, DoB: 1923-07-25

organization: Organization somewhere org

source: DocumentReference: status = current; type = Release of information consent; description = The captured signed document

Policies

-Uri
*http://example.org/policies/basePrivacyConsentPolicy.txt

provision

type: Opt In

purpose: ActReason TREAT: treatment, ActReason HPAYMT: healthcare payment, ActReason HOPERAT: healthcare operations

provision

type: Opt Out

Data

-MeaningReference
*RelatedEncounter: status = finished; class = home health (ActCode#HH)

Notes:

IUA Access Token

Provided an ITI-71 results in a PERMIT access token issued. That token would have the following residual element to inform the Consent Enforcement Point that it needs to restrict the results.

Given that the token will express the permit portion, the residual would need to express the refinement. In this case the oAuth token and scope will address a general permit, and thus the residual need only express the forbid to information related to the encounter.

The token would need to include an ihe_pcf extension to point at this consent, and that would include a residual to express the refinement. Shown as followed:

  • The restriction to the given purpose (Treatment, Payment, and Operations) would be expressed in the ihe_iua extension
    • The other ihe_iua extension parameters are not shown below
  • The restriction to forbid data related to the given encounter
"extensions" : {
  "ihe_iua" : {
    ...
    "purpose_of_use" : [{
        "system" : "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "code" : "TREAT"
      },{
        "system" : "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "code" : "HPAYMT"
      },{
        "system" : "http://terminology.hl7.org/CodeSystem/v3-ActReason",
        "code" : "HOPERAT"
    }]
  }
  "ihe_pcf" : {
    "patient_id" : "http://example.org/fhir/Patient/ex-patient",
    "doc_id" : ["http://example.org/fhir/Consent/ex-consent-intermediate-not-encounter"],
    "residual" : [
      {
        "type" : "forbid",
        "data" : [{
            "meaning" : "related",
            "reference" : {
            "reference" : "http://example.org/fhir/Encounter/ex-encounter"
            }
        }]
      }
    ]
  }
}