Scalable Consent Management
1.0.0-preview - STU 1 PReview
Scalable Consent Management
1.0.0-preview - STU 1 PReview
Scalable Consent Management, published by HL7 International / Community Based Collaborative Care. This guide is not an authorized publication; it is the continuous build for version 1.0.0-preview built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/fhir-consent-management/ and changes regularly. See the Directory of published versions
| Page standards status: Trial-use | Maturity Level: 1 |
<Requirements xmlns="http://hl7.org/fhir">
<id value="technical-specification-client"/>
<text>
<status value="generated"/>
<div xmlns="http://www.w3.org/1999/xhtml"><p class="res-header-id"><b>Generated Narrative: Requirements technical-specification-client</b></p><a name="technical-specification-client"> </a><a name="hctechnical-specification-client"> </a><p>These requirements apply to the actor <a href="ActorDefinition-client.html">Client</a></p><table class="grid"><tr><td><b><a name="67"> </a></b>requirement-67</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHALL">SHALL</a></td><td><div><p>Consent Client SHALL query the consent administration service for the identifiers of the involved patients, practitioners, organizations, and related persons<br/><br/>Not testable yet - need lots more details about the lifecycle of relates resource instances.
Query or match?
Implies CAS is an MPI and similar for other resources?
Doesn’t say what triggers these queries to occur, or what effect it has on workflows, or whether discovered identifiers are used in resources...</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=client%20systems%20SHALL%20query%20the%20consent%20administration%20service%20for%20the%20identifiers%20of%20the%20involved%20patients%2C%20practitioners%2C%20organizations%2C%20and%20related%20persons">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="1168"> </a></b>requirement-1168</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHOULD">SHOULD</a></td><td><div><p>To search for consents by organization identifier, implementers SHOULD use the controller:identifier chained search parameter (e.g., GET [base]/Consent?controller:identifier=|1234567890) rather than a custom organization ID search parameter<br/><br/>Because it's a SHOULD, assumes other ways; for now this is the only way we'll test.</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=to%20search%20for%20consents%20by%20organization%20identifier%2C%20implementers%20should%20use%20the%20controller%3Aidentifier%20chained%20search%20parameter%20%28e.g.%2C%20get%20%5Bbase%5D/consent%3Fcontroller%3Aidentifier%3D%7C1234567890%29%20rather%20than%20a%20custom%20organization%20id%20search%20parameter">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="1169"> </a></b>requirement-1169</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHOULD">SHOULD</a></td><td><div><p>To search for consents by patient identifier, implementers SHOULD use the patient:identifier chained search parameter (e.g., GET [base]/Consent?patient:identifier=http://example.org/mrn|M1230041)<br/><br/>Because it's a SHOULD, assumes other ways; for now this is the only way we'll test.</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=to%20search%20for%20consents%20by%20patient%20identifier%2C%20implementers%20should%20use%20the%20patient%3Aidentifier%20chained%20search%20parameter%20%28e.g.%2C%20get%20%5Bbase%5D/consent%3Fpatient%3Aidentifier%3Dhttp%3A//example.org/mrn%7Cm1230041%29">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="265"> </a></b>requirement-265</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHALL">SHALL</a></td><td><div><p>This guide mandates that Subscriptions be used<br/><br/>Need conformance words - who does this apply to? Assuming clients, but which ones? What triggering actions? Are clients required to support only, or that they positively subscribe to specific other systems? Suggest referencing section with normative workflows.</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=this%20guide%20mandates%20that%20Subscriptions%20be%20used">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="202"> </a></b>requirement-202</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-MAY">MAY</a></td><td><div><p>Consent Client MAY subscribe to Consent topics as defined by the FAST Subscription Topic<br/><br/>- No conformance words "client will...", so not clear which actors SHALL or MAY support. For now, treating as MAY for both clients and servers - tests can be conditional.</p>
<ul>
<li>Nature of topic is it allows combinations of criteria. I'll call out each criterion below for traceability.</li>
<li>TBD whether there need to be requirements for CAS to detect and fire Consent events or if implied by subs framework.</li>
</ul>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=to%20register%20a%20subscription%2C%20consent%20client%20systems%20will%20post%20to%20a%20consent%20server%20system%27s%20subscription%20endpoint">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="1170"> </a></b>requirement-1170</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHOULD">SHOULD</a></td><td><div><p>Systems conforming to this guide SHOULD NOT update an existing Consent resource in place using RESTful PUT or PATCH<br/><br/>Capturing because conformance verb, but can't test a negative.</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=systems%20conforming%20to%20this%20guide%20should%20not%20update%20an%20existing%20consent%20resource%20in%20place%20using%20restful%20put%20or%20patch">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="1165"> </a></b>requirement-1165</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHALL">SHALL</a></td><td><div><p>Consent Client SHALL support AuditEvent search by Consent (entity)</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=systems%20shall%20support%20searching%20for%20fast%20consent%20audit%20events%C2%A7op9%20using%20the%20following%20search%20parameters&text=entity%20%E2%80%94%20use%20entity%3DConsent/%5Bid%5D%20to%20search%20for%20all%20authorization%20decisions%20made%20against%20a%20specific%20Consent%20instance">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="299"> </a></b>requirement-299</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHALL">SHALL</a></td><td><div><p>Consent Client SHALL support AuditEvent search by patient<br/><br/>Implied - need requirement</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=systems%20shall%20support%20searching%20for%20fast%20consent%20audit%20events%C2%A7op9%20using%20the%20following%20search%20parameters&text=patient%20%E2%80%94%20use%20patient%3D%5Bref%5D%20to%20search%20for%20all%20authorization%20decisions%20involving%20any%20consent%20for%20a%20specific%20patient">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr><tr><td><b><a name="1167"> </a></b>requirement-1167</td><td><a href="http://hl7.org/fhir/uv/xver-r5.r4/0.1.0/CodeSystem-conformance-expectation.html#conformance-expectation-SHOULD">SHOULD</a></td><td><div><p>For disclosure events (cases where health information was actually shared following a permit decision), implementers SHOULD follow IHE-BALP patterns and the ITI-81 Retrieve ATNA Audit Event transaction for querying those events</p>
</div><p>Links: </p><ul><li>Derived From: <code>HL7 FAST Consent IG</code></li><li>Satisfied By: <a href="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=for%20disclosure%20events%20%28cases%20where%20health%20information%20was%20actually%20shared%20following%20a%20permit%20decision%29%2C%20implementers%20should%20follow%20ihe%2Dbalp%20patterns%20and%20the%20iti%2D81%20retrieve%20atna%20audit%20event%20transaction%20for%20querying%20those%20events">https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html</a></li></ul></td></tr></table></div>
</text>
<extension
url="http://hl7.org/fhir/StructureDefinition/structuredefinition-wg">
<valueCode value="cbcc"/>
</extension>
<extension
url="http://hl7.org/fhir/StructureDefinition/structuredefinition-fmm">
<valueInteger value="1">
<extension
url="http://hl7.org/fhir/StructureDefinition/structuredefinition-conformance-derivedFrom">
<valueCanonical
value="http://hl7.org/fhir/us/consent-management/ImplementationGuide/hl7.fhir.us.consent-management"/>
</extension>
</valueInteger>
</extension>
<extension
url="http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status">
<valueCode value="trial-use">
<extension
url="http://hl7.org/fhir/StructureDefinition/structuredefinition-conformance-derivedFrom">
<valueCanonical
value="http://hl7.org/fhir/us/consent-management/ImplementationGuide/hl7.fhir.us.consent-management"/>
</extension>
</valueCode>
</extension>
<url
value="http://hl7.org/fhir/us/consent-management/Requirements/technical-specification-client"/>
<version value="1.0.0-preview"/>
<name value="TechnicalSpecificationClient"/>
<title value="Technical Specification Client"/>
<status value="active"/>
<experimental value="false"/>
<date value="2026-09-02T22:40:54-04:00"/>
<publisher value="HL7 International / Community Based Collaborative Care"/>
<contact>
<name value="HL7 International / Community Based Collaborative Care"/>
<telecom>
<system value="url"/>
<value value="http://www.hl7.org/Special/committees/homehealth"/>
</telecom>
</contact>
<description value="Technical Specification Requirements for Client"/>
<jurisdiction>
<coding>
<system value="urn:iso:std:iso:3166"/>
<code value="US"/>
<display value="United States of America"/>
</coding>
</jurisdiction>
<actor
value="http://hl7.org/fhir/us/consent-management/ActorDefinition/client"/>
<statement>
<key value="67"/>
<label value="requirement-67"/>
<conformance value="SHALL"/>
<conditionality value="false"/>
<requirement
value="Consent Client SHALL query the consent administration service for the identifiers of the involved patients, practitioners, organizations, and related persons<br/><br/>Not testable yet - need lots more details about the lifecycle of relates resource instances.
Query or match?
Implies CAS is an MPI and similar for other resources?
Doesn’t say what triggers these queries to occur, or what effect it has on workflows, or whether discovered identifiers are used in resources..."/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=client%20systems%20SHALL%20query%20the%20consent%20administration%20service%20for%20the%20identifiers%20of%20the%20involved%20patients%2C%20practitioners%2C%20organizations%2C%20and%20related%20persons"/>
</statement>
<statement>
<key value="1168"/>
<label value="requirement-1168"/>
<conformance value="SHOULD"/>
<conditionality value="false"/>
<requirement
value="To search for consents by organization identifier, implementers SHOULD use the controller:identifier chained search parameter (e.g., GET [base]/Consent?controller:identifier=|1234567890) rather than a custom organization ID search parameter<br/><br/>Because it's a SHOULD, assumes other ways; for now this is the only way we'll test."/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=to%20search%20for%20consents%20by%20organization%20identifier%2C%20implementers%20should%20use%20the%20controller%3Aidentifier%20chained%20search%20parameter%20%28e.g.%2C%20get%20%5Bbase%5D/consent%3Fcontroller%3Aidentifier%3D%7C1234567890%29%20rather%20than%20a%20custom%20organization%20id%20search%20parameter"/>
</statement>
<statement>
<key value="1169"/>
<label value="requirement-1169"/>
<conformance value="SHOULD"/>
<conditionality value="false"/>
<requirement
value="To search for consents by patient identifier, implementers SHOULD use the patient:identifier chained search parameter (e.g., GET [base]/Consent?patient:identifier=http://example.org/mrn|M1230041)<br/><br/>Because it's a SHOULD, assumes other ways; for now this is the only way we'll test."/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=to%20search%20for%20consents%20by%20patient%20identifier%2C%20implementers%20should%20use%20the%20patient%3Aidentifier%20chained%20search%20parameter%20%28e.g.%2C%20get%20%5Bbase%5D/consent%3Fpatient%3Aidentifier%3Dhttp%3A//example.org/mrn%7Cm1230041%29"/>
</statement>
<statement>
<key value="265"/>
<label value="requirement-265"/>
<conformance value="SHALL"/>
<conditionality value="false"/>
<requirement
value="This guide mandates that Subscriptions be used<br/><br/>Need conformance words - who does this apply to? Assuming clients, but which ones? What triggering actions? Are clients required to support only, or that they positively subscribe to specific other systems? Suggest referencing section with normative workflows."/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=this%20guide%20mandates%20that%20Subscriptions%20be%20used"/>
</statement>
<statement>
<key value="202"/>
<label value="requirement-202"/>
<conformance value="MAY"/>
<conditionality value="false"/>
<requirement
value="Consent Client MAY subscribe to Consent topics as defined by the FAST Subscription Topic<br/><br/>- No conformance words "client will...", so not clear which actors SHALL or MAY support. For now, treating as MAY for both clients and servers - tests can be conditional.
- Nature of topic is it allows combinations of criteria. I'll call out each criterion below for traceability.
- TBD whether there need to be requirements for CAS to detect and fire Consent events or if implied by subs framework."/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=to%20register%20a%20subscription%2C%20consent%20client%20systems%20will%20post%20to%20a%20consent%20server%20system%27s%20subscription%20endpoint"/>
</statement>
<statement>
<key value="1170"/>
<label value="requirement-1170"/>
<conformance value="SHOULD"/>
<conditionality value="false"/>
<requirement
value="Systems conforming to this guide SHOULD NOT update an existing Consent resource in place using RESTful PUT or PATCH<br/><br/>Capturing because conformance verb, but can't test a negative."/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=systems%20conforming%20to%20this%20guide%20should%20not%20update%20an%20existing%20consent%20resource%20in%20place%20using%20restful%20put%20or%20patch"/>
</statement>
<statement>
<key value="1165"/>
<label value="requirement-1165"/>
<conformance value="SHALL"/>
<conditionality value="false"/>
<requirement
value="Consent Client SHALL support AuditEvent search by Consent (entity)"/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=systems%20shall%20support%20searching%20for%20fast%20consent%20audit%20events%C2%A7op9%20using%20the%20following%20search%20parameters&text=entity%20%E2%80%94%20use%20entity%3DConsent/%5Bid%5D%20to%20search%20for%20all%20authorization%20decisions%20made%20against%20a%20specific%20Consent%20instance"/>
</statement>
<statement>
<key value="299"/>
<label value="requirement-299"/>
<conformance value="SHALL"/>
<conditionality value="false"/>
<requirement
value="Consent Client SHALL support AuditEvent search by patient<br/><br/>Implied - need requirement"/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=systems%20shall%20support%20searching%20for%20fast%20consent%20audit%20events%C2%A7op9%20using%20the%20following%20search%20parameters&text=patient%20%E2%80%94%20use%20patient%3D%5Bref%5D%20to%20search%20for%20all%20authorization%20decisions%20involving%20any%20consent%20for%20a%20specific%20patient"/>
</statement>
<statement>
<key value="1167"/>
<label value="requirement-1167"/>
<conformance value="SHOULD"/>
<conditionality value="false"/>
<requirement
value="For disclosure events (cases where health information was actually shared following a permit decision), implementers SHOULD follow IHE-BALP patterns and the ITI-81 Retrieve ATNA Audit Event transaction for querying those events"/>
<derivedFrom value="HL7 FAST Consent IG"/>
<satisfiedBy
value="https://build.fhir.org/ig/HL7/fhir-consent-management/en/technical.html#:~:text=for%20disclosure%20events%20%28cases%20where%20health%20information%20was%20actually%20shared%20following%20a%20permit%20decision%29%2C%20implementers%20should%20follow%20ihe%2Dbalp%20patterns%20and%20the%20iti%2D81%20retrieve%20atna%20audit%20event%20transaction%20for%20querying%20those%20events"/>
</statement>
</Requirements>
IG © 2024+ HL7 International / Community Based Collaborative Care.
Package hl7.fhir.us.consent-management#1.0.0-preview based on FHIR 4.0.1.
Generated
2026-09-11
Links: Table of Contents |
QA Report
| Version History |
|
Propose a change