HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - Normative

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/ehrsfm-ig/ and changes regularly. See the Directory of published versions

## : AS.2.6 Manage Patient Privacy Consent Directives (Function)

Page standards status: Normative

Raw xml | Download

    <Requirements xmlns="http://hl7.org/fhir">
      <id value="EHRSFMR2-AS.2.6"/>
      <meta>
        <profile
                 value="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction"/>
      </meta>
      <language value="en"/>
      <text>
        <status value="extensions"/>
        <div xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" lang="en">

        <div id="description"><b>Description <a href="https://hl7.org/fhir/versions.html#std-process" title="Informative Content" class="informative-flag">I</a>:</b> <div><p>The system enables the management of information access to support privacy policies. These policies allow patients to stipulate specific privacy preferences as a privacy consent directive. The consent may be issued for a specific disclosure, for a period of time, or until it is explicitly revoked. This function depends on infrastructure to enforce the privacy consent and any associated privacy policies using a combination of access control, secure messaging, secure data routing, and data segmentation.</p>
    </div></div>

        <div id="requirements"><b>Criteria <a href="https://hl7.org/fhir/versions.html#std-process" title="Normative Content" class="normative-flag">N</a>:</b></div>

        <table id="statements" class="grid dict">

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#01
                </td>
                <td style="padding-left: 4px;">
                SHOULD

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHOULD provide the ability to manage the privacy preferences of patients (e.g., opt-in with exceptions, opt-out with exceptions, opt-in, opt-out) in their privacy consent directive.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#02
                </td>
                <td style="padding-left: 4px;">
                SHOULD

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHOULD provide the ability to capture the patient's preferences regarding providers who are permitted to access, or explicitly excluded from accessing, the patient's information.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#03
                </td>
                <td style="padding-left: 4px;">
                SHOULD

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHOULD provide the ability to render disclosure events.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#04
                </td>
                <td style="padding-left: 4px;">
                SHOULD

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHOULD provide the ability to render an accounting of any patient identifiable information disclosed to other providers.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#05
                </td>
                <td style="padding-left: 4px;">
                MAY

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system MAY provide the ability to enter, import or receive information that documents the patient's expressed selection of privacy preferences related to the disclosure of information identified by its content type (e.g., related diagnosis or payment method), and a specific purpose.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#06
                </td>
                <td style="padding-left: 4px;">
                SHOULD

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system SHOULD provide the ability to manage data visibility based on both privacy policy, and patient's privacy consent.</p>
    </div>

                </td>
            </tr>

            <tr>
                <td style="padding-left: 4px;">
                AS.2.6#07
                </td>
                <td style="padding-left: 4px;">
                MAY

                </td>
                <td style="padding-left: 4px;" class="requirement">
                    <div><p>The system MAY provide the ability to link to privacy consent management systems to access patients' privacy consent directives and digital certificates.</p>
    </div>

                </td>
            </tr>

        </table>
    </div>
      </text>
      <extension
                 url="http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status">
        <valueCode value="normative"/>
      </extension>
      <extension
                 url="http://hl7.org/fhir/StructureDefinition/structuredefinition-wg">
        <valueCode value="ehr"/>
      </extension>
      <url value="http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-AS.2.6"/>
      <version value="2.1.1"/>
      <name value="AS_2_6_Manage_Patient_Privacy_Consent_Directives"/>
      <title value="AS.2.6 Manage Patient Privacy Consent Directives (Function)"/>
      <status value="active"/>
      <date value="2025-12-13T09:06:06+00:00"/>
      <publisher value="HL7 International / Electronic Health Records"/>
      <contact>
        <telecom>
          <system value="url"/>
          <value value="http://www.hl7.org/Special/committees/ehr"/>
        </telecom>
      </contact>
      <description
                   value="Provide the ability to record and manage patient-specific privacy consent directive consistent with privacy policies."/>
      <jurisdiction>
        <coding>
          <system value="http://unstats.un.org/unsd/methods/m49/m49.htm"/>
          <code value="001"/>
          <display value="World"/>
        </coding>
      </jurisdiction>
      <purpose
               value="The system enables the management of information access to support privacy policies. These policies allow patients to stipulate specific privacy preferences as a privacy consent directive. The consent may be issued for a specific disclosure, for a period of time, or until it is explicitly revoked. This function depends on infrastructure to enforce the privacy consent and any associated privacy policies using a combination of access control, secure messaging, secure data routing, and data segmentation."/>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-01"/>
        <label value="AS.2.6#01"/>
        <conformance value="SHOULD"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHOULD provide the ability to manage the privacy preferences of patients (e.g., opt-in with exceptions, opt-out with exceptions, opt-in, opt-out) in their privacy consent directive."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-02"/>
        <label value="AS.2.6#02"/>
        <conformance value="SHOULD"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHOULD provide the ability to capture the patient's preferences regarding providers who are permitted to access, or explicitly excluded from accessing, the patient's information."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-03"/>
        <label value="AS.2.6#03"/>
        <conformance value="SHOULD"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHOULD provide the ability to render disclosure events."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-04"/>
        <label value="AS.2.6#04"/>
        <conformance value="SHOULD"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHOULD provide the ability to render an accounting of any patient identifiable information disclosed to other providers."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-05"/>
        <label value="AS.2.6#05"/>
        <conformance value="MAY"/>
        <conditionality value="false"/>
        <requirement
                     value="The system MAY provide the ability to enter, import or receive information that documents the patient's expressed selection of privacy preferences related to the disclosure of information identified by its content type (e.g., related diagnosis or payment method), and a specific purpose."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-06"/>
        <label value="AS.2.6#06"/>
        <conformance value="SHOULD"/>
        <conditionality value="false"/>
        <requirement
                     value="The system SHOULD provide the ability to manage data visibility based on both privacy policy, and patient's privacy consent."/>
      </statement>
      <statement>
        <extension
                   url="http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent">
          <valueBoolean value="false"/>
        </extension>
        <key value="EHRSFMR2-AS.2.6-07"/>
        <label value="AS.2.6#07"/>
        <conformance value="MAY"/>
        <conditionality value="false"/>
        <requirement
                     value="The system MAY provide the ability to link to privacy consent management systems to access patients' privacy consent directives and digital certificates."/>
      </statement>
    </Requirements>