With the ever increasing utilisation of Electronic Health Records, gaining a patient’s consent to share their information digitally has never been a greater challenge. Conveying the different kinds of data sharing for which a patient may consent will inevitably demand new levels of digital awareness from the patient. But conveying these complexities as simply as possible to patients is a particular challenge in a healthcare community that itself often does not understand consent complexities. As a still growing topic there is no established nomenclature for discussing digital record consent.
The following presents a straw man for comment which we created as part of some work we did for a client in the English NHS. It describes an ‘Implied, Supplied, Denied, Override’ consent framework against which to compare any consent solution. In theory it should be possible for every consent scenario to be mapped against the following consent framework. In other words for each permutation of the options below it would be possible for consent to be implied, explicitly supplied or denied by a patient. Furthermore in some scenarios it could be permissible for a care professional to override access to a record if accompanied by a suitable warning.
Figure 1: Consent permutations
Record accessor – lists the individuals who may be trying to access the record. Depending on the type of person viewing the record a patient may desire differing consent responses.
Record scope – record scope defines the portion of the patient record for which consent is being given. This may be the whole record or a single document – such as the Summary Care Record – or a collection of related records such as those relating to a single episode of care. Providing access to view only a document’s header may be a further elaboration of the model. This would allow the existence of some documents to be observed in patient queries while denying full access to the content of the document.
Geographic scope – in many scenarios patients will be comfortable sharing records with a regional interoperability initiative without wanting information to be shared nationally. Other information such as a summary care record is commonly deemed suitable for national sharing. Patients will want understand how widely they are granting access to their record.
Accessor purpose – The purpose for the record access may in many cases determine the consent status the patient would wish to convey. For example, urgent care scenarios are normally deemed sufficient for care professionals to be allowed to access a record. This list could be extended beyond the purposes shown here and is eventually likely to require a clear definition of each option. For example, we will need to be clear about what we consider direct care verses secondary uses.
Obfuscation level – Data that is being used for secondary uses or payment purposes may be obfuscated in a manner that enables patients to provide wider levels of consent. While there is much debate about how unidentifiable pseudonymised records are, anonymous records are usually not deemed to be patient identifiable.
Care setting – there is much evidence to suggest that patients will wish distinguish between care settings when providing consent preferences. For example, some regional initiatives are electing to imply consent for healthcare professionals while requiring patient presence and consent to allow social care professionals to access the record. This list is also likely to grow to encompass a larger number of settings.
Duration required – some accesses to a patient record is long term such as for a general practitioner. On other occasions single access may be required to triage a referral or in and urgent care scenario.
This model is patient centric. In other words it intends to express the potential differences between consent scenarios in a manner that would be of interest to a patient. Although more complex consent models could be designed, a patient must ultimately be able to understand the scenarios for which they are expressing consent. Thus we recommend that any consent model does not extend the approach described here without careful justification. Further it is worth noting that patients will not be required to understand, and express consent for every permutation of these variables; they won’t need to understand this model. This model includes the majority of possible variables but patients are only likely to need to express consent against a smaller subset of real life scenarios described in an easily readable and understandable manner. Indeed in many current initiatives a few or even just one permutation is offered to patients. A number of examples of scenarios expressing consent using the model are shown below.
I give my [consent expression] for [record accessor / care setting] to access my [record scope] to be shared with [geographic scope] for the purposes of [accessor purpose] for [duration].
Probably the most common permutation always implied during patient admission is:
“I give my implied consent for care professionals to access my whole record to be shared with this organisation for the purposes of direct care for a permanent duration”
The national Choose and Book system offers the following consent scenario:
“I give my implied consent for care professionals to access my whole record to be shared with the referred to organisation for the purposes of direct care during a single episode”
The following options are offered for the Summary Care Record from GP Practices:
- “I give my supplied consent for care professionals in my presence in primary and secondary care, nationally to access my Summary Care Record for the purposes of direct care during a single episode”
- “I deny consent for care professionals in my presence in primary and secondary care, nationally to access my Summary Care Record for the purposes of direct care during a single episode”
Prior to receiving explicit consent the SCR assumes:
- “I give my implied consent for care professionals in my presence in primary and secondary care, nationally to access my Summary Care Record for the purposes of direct care during a single episode”
The primary care provider EMIS provides the following consent scenarios to its customer’s patients:
- “I give my implied consent for care professionals in primary care at this organisation to access my whole record for the purposes of direct care, indirect care and secondary uses for a permanent duration”
- “I give my implied consent for care professionals in primary, secondary and community care in my region to access my whole record for the purposes of direct care during a single episode”
A regional research data warehousing initiative of the type that are currently being widely created might express their consent agreement in the following manner.
- “I give my implied consent for care professionals in my region to access my fully anonymised record for the purposes of secondary uses for a permanent duration”
 Note that patient is included as there is a subset of cases where access to the record by the patient should be denied.
 Where consent scope is episodic, records will need to be have been related via an episode ID.
 See document “EMIS Web and GPES frequently asked questions”, “EMIS Web streaming and GPES FAQs 080512.doc”. Although note that this is an interpretation of this GP suppliers consent agreement as an exemplar and not intended as a definitive statement of what they offer.