Model and query FHIR Consent resources to enforce data sharing restrictions when responding to FHIR queries, applying patient consent to filter what data is returned

Steps

1. Create Consent resources with scope (patient-privacy, treatment, research), category codes, patient reference, dateTime, performer, organization, and provision elements that define permit or deny rules
2. Use provision.actor to specify which practitioners or organizations the consent applies to, provision.action to restrict specific activities (access, correct, disclose), and provision.purpose for treatment vs research
3. Implement a consent enforcement layer that intercepts FHIR queries, retrieves the requesting user's identity from the access token, and evaluates applicable Consent resources for the target patient
4. Apply consent-driven filtering by excluding resources whose data class or sensitivity label (e.g., 42 CFR Part 2 substance use, HIV, mental health) is covered by a deny provision for the requester
5. Return filtered bundles that omit restricted resources, and optionally include an OperationOutcome with an information-level issue explaining that results may be incomplete due to consent restrictions