Creating and managing Consent Directives on FHIR
summary
Shows how a computable policy is encoded using the FHIR R4 Consent resource (provision.actor, purpose, environment, class, period, actions, status) and demos a web UI plus Google Healthcare FHIR API integration that stores JSON consents and uses identity-provider tokens for actor/group resolution. Suggests using meta.tag for sensitive resources, requires consent resolution and auditing, and warns about performance — recommend limit actors to a few hundred because enforcement at scale is still being engineered.
AI-written summary · about
chapters (14)
- 0:00Introduction to session
- 1:04What is a FHIR consent resource
- 3:13Key fields in consent creation
- 6:04Deep dive into consent JSON
- 9:32Who why where in consent
- 12:44When and actions in consent
- 13:50Consent status and enforcement
- 14:32Next steps in consent management
- 15:58Q&A on user groups
- 16:38Identity provider tokens
- 18:27Google Cloud integration
- 19:10Consent enforcement at scale
- 20:56Default consent policies
- 22:00Session wrap-up
related talks
31mFHIR & access control, deep dive into consent services
21mManaging dynamic study participation consents with FHIR
15mDeveloping Patient Access APIs at scale
43mConsent Based Access Control and Healthcare Data
23mImplementing Provider Directory APIs
45mApisecure, 14 & 15 March 2023 - John Moehrke, Co-Chair at Security Working Group.
20mSecuring and Standardizing Data Rights Requests with a Data Rights Protocol
01h 01mSharing Health Information Through APIs