HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - Normative

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/ehrsfm-ig/ and changes regularly. See the Directory of published versions

## : AS.2.6 Manage Patient Privacy Consent Directives (Function)

Page standards status: Normative

Raw json | Download

    {
      "resourceType" : "Requirements",
      "id" : "EHRSFMR2-AS.2.6",
      "meta" : {
        "profile" : [
          🔗 "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction"
        ]
      },
      "language" : "en",
      "text" : {
        "status" : "extensions",
        "div" : "<div xml:lang=\"en\" xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"en\">\n    \n    \n    <div id=\"description\"><b>Description <a href=\"https://hl7.org/fhir/versions.html#std-process\" title=\"Informative Content\" class=\"informative-flag\">I</a>:</b> <div><p>The system enables the management of information access to support privacy policies. These policies allow patients to stipulate specific privacy preferences as a privacy consent directive. The consent may be issued for a specific disclosure, for a period of time, or until it is explicitly revoked. This function depends on infrastructure to enforce the privacy consent and any associated privacy policies using a combination of access control, secure messaging, secure data routing, and data segmentation.</p>\n</div></div>\n    \n    \n    \n    <div id=\"requirements\"><b>Criteria <a href=\"https://hl7.org/fhir/versions.html#std-process\" title=\"Normative Content\" class=\"normative-flag\">N</a>:</b></div>\n    \n    <table id=\"statements\" class=\"grid dict\">\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#01\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to manage the privacy preferences of patients (e.g., opt-in with exceptions, opt-out with exceptions, opt-in, opt-out) in their privacy consent directive.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#02\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to capture the patient's preferences regarding providers who are permitted to access, or explicitly excluded from accessing, the patient's information.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#03\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to render disclosure events.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#04\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to render an accounting of any patient identifiable information disclosed to other providers.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#05\n            </td>\n            <td style=\"padding-left: 4px;\">\n            MAY\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system MAY provide the ability to enter, import or receive information that documents the patient's expressed selection of privacy preferences related to the disclosure of information identified by its content type (e.g., related diagnosis or payment method), and a specific purpose.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#06\n            </td>\n            <td style=\"padding-left: 4px;\">\n            SHOULD\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system SHOULD provide the ability to manage data visibility based on both privacy policy, and patient's privacy consent.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n        <tr>\n            <td style=\"padding-left: 4px;\">\n            AS.2.6#07\n            </td>\n            <td style=\"padding-left: 4px;\">\n            MAY\n            \n                \n            \n            \n            \n            </td>\n            <td style=\"padding-left: 4px;\" class=\"requirement\">\n                <div><p>The system MAY provide the ability to link to privacy consent management systems to access patients' privacy consent directives and digital certificates.</p>\n</div>\n                \n            </td>\n        </tr>\n        \n    </table>\n</div>"
      },
      "extension" : [
        {
          "url" : "http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status",
          "valueCode" : "normative"
        },
        {
          "url" : "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
          "valueCode" : "ehr"
        }
      ],
      "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-AS.2.6",
      "version" : "2.1.1",
      "name" : "AS_2_6_Manage_Patient_Privacy_Consent_Directives",
      "title" : "AS.2.6 Manage Patient Privacy Consent Directives (Function)",
      "status" : "active",
      "date" : "2025-12-13T09:06:06+00:00",
      "publisher" : "HL7 International / Electronic Health Records",
      "contact" : [
        {
          "telecom" : [
            {
              "system" : "url",
              "value" : "http://www.hl7.org/Special/committees/ehr"
            }
          ]
        }
      ],
      "description" : "Provide the ability to record and manage patient-specific privacy consent directive consistent with privacy policies.",
      "jurisdiction" : [
        {
          "coding" : [
            {
              "system" : "http://unstats.un.org/unsd/methods/m49/m49.htm",
              "code" : "001",
              "display" : "World"
            }
          ]
        }
      ],
      "purpose" : "The system enables the management of information access to support privacy policies. These policies allow patients to stipulate specific privacy preferences as a privacy consent directive. The consent may be issued for a specific disclosure, for a period of time, or until it is explicitly revoked. This function depends on infrastructure to enforce the privacy consent and any associated privacy policies using a combination of access control, secure messaging, secure data routing, and data segmentation.",
      "statement" : [
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-01",
          "label" : "AS.2.6#01",
          "conformance" : [
            "SHOULD"
          ],
          "conditionality" : false,
          "requirement" : "The system SHOULD provide the ability to manage the privacy preferences of patients (e.g., opt-in with exceptions, opt-out with exceptions, opt-in, opt-out) in their privacy consent directive."
        },
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-02",
          "label" : "AS.2.6#02",
          "conformance" : [
            "SHOULD"
          ],
          "conditionality" : false,
          "requirement" : "The system SHOULD provide the ability to capture the patient's preferences regarding providers who are permitted to access, or explicitly excluded from accessing, the patient's information."
        },
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-03",
          "label" : "AS.2.6#03",
          "conformance" : [
            "SHOULD"
          ],
          "conditionality" : false,
          "requirement" : "The system SHOULD provide the ability to render disclosure events."
        },
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-04",
          "label" : "AS.2.6#04",
          "conformance" : [
            "SHOULD"
          ],
          "conditionality" : false,
          "requirement" : "The system SHOULD provide the ability to render an accounting of any patient identifiable information disclosed to other providers."
        },
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-05",
          "label" : "AS.2.6#05",
          "conformance" : [
            "MAY"
          ],
          "conditionality" : false,
          "requirement" : "The system MAY provide the ability to enter, import or receive information that documents the patient's expressed selection of privacy preferences related to the disclosure of information identified by its content type (e.g., related diagnosis or payment method), and a specific purpose."
        },
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-06",
          "label" : "AS.2.6#06",
          "conformance" : [
            "SHOULD"
          ],
          "conditionality" : false,
          "requirement" : "The system SHOULD provide the ability to manage data visibility based on both privacy policy, and patient's privacy consent."
        },
        {
          "extension" : [
            {
              "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
              "valueBoolean" : false
            }
          ],
          "key" : "EHRSFMR2-AS.2.6-07",
          "label" : "AS.2.6#07",
          "conformance" : [
            "MAY"
          ],
          "conditionality" : false,
          "requirement" : "The system MAY provide the ability to link to privacy consent management systems to access patients' privacy consent directives and digital certificates."
        }
      ]
    }