Privacy Consent on FHIR (PCF)
1.1.1-current - ci-build

Privacy Consent on FHIR (PCF), published by IHE IT Infrastructure Technical Committee. This guide is not an authorized publication; it is the continuous build for version 1.1.1-current built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/IHE/ITI.PCF/ and changes regularly. See the Directory of published versions

## Example Consent: Consent for purpose of treatment example

Profile: IHE PCF Explicit Basic Consent

Security Label: test health data (Details: ActReason code HTEST = 'test health data')

status: Active

scope: Privacy Consent

category: Consent

patient: Jack Smith Male, DoB: 1923-07-25

dateTime: 2022-06-13

performer: Jack Smith Male, DoB: 1923-07-25

organization: Organization somewhere org

source: DocumentReference: status = current; type = Release of information consent; description = The captured signed document

### Policies

- | Uri
* | http://example.org/policies/basePrivacyConsentPolicy.txt

> provision

> type: Opt In

> purpose: ActReason TREAT: treatment, ActReason HPAYMT: healthcare payment, ActReason HOPERAT: healthcare operations

### Notes:

#### IUA Access Token

Provided an ITI-71 results in a PERMIT access token issued. That token would have the following PCF specific element to inform the Consent Enforcement Point.

In this case there is no residual, as the Consent expresses that authorization be given for a given purpose of use. Possibly with scope restrictions based on other business rules, such as a subset of actions (CRUDE) and resources. No token would be issued by ITI-71 for users not authorized, or requests beyond the set of purpose of use.

- The restriction to the given purpose (FooBar) would be expressed in the `ihe_iua` extension
  - The other `ihe_iua` extension parameters are not shown below
- The consent is indicated in the `ihe_pcf`
  - no `residual` element is provided, indicating that no residual rules need be enforced

    "extensions" : {
      "ihe_iua" : {
        ...
        "purpose_of_use" : [{
            "system" : "http://terminology.hl7.org/CodeSystem/v3-ActReason",
            "code" : "TREAT"
          },{
            "system" : "http://terminology.hl7.org/CodeSystem/v3-ActReason",
            "code" : "HPAYMT"
          },{
            "system" : "http://terminology.hl7.org/CodeSystem/v3-ActReason",
            "code" : "HOPERAT"
        }]
      }
      "ihe_pcf" : {
        "patient_id" : "http://example.org/fhir/Patient/ex-patient",
        "doc_id" : ["http://example.org/fhir/Consent/ex-consent-basic-treat"]
      }
    }