Model and query FHIR Consent resources to enforce data sharing restrictions when responding to FHIR queries, applying patient consent to filter what data is returned
Create Consent resources with scope (patient-privacy, treatment, research), category codes, patient reference, dateTime, performer, organization, and provision elements that define permit or deny rules
Use provision.actor to specify which practitioners or organizations the consent applies to, provision.action to restrict specific activities (access, correct, disclose), and provision.purpose for treatment vs research
Implement a consent enforcement layer that intercepts FHIR queries, retrieves the requesting user's identity from the access token, and evaluates applicable Consent resources for the target patient
Apply consent-driven filtering by excluding resources whose data class or sensitivity label (e.g., 42 CFR Part 2 substance use, HIV, mental health) is covered by a deny provision for the requester
Return filtered bundles that omit restricted resources, and optionally include an OperationOutcome with an information-level issue explaining that results may be incomplete due to consent restrictions
Known gotchas
FHIR Consent resource modeling does not prescribe enforcement; the consent enforcement logic must be implemented by the server or a policy engine — storing a Consent resource does not automatically restrict data access
42 CFR Part 2 substance use records have stricter re-disclosure restrictions than standard HIPAA; they require specific patient consent for each disclosure and cannot be included in general health information exchange without explicit authorization
Consent provisions cascade: a top-level permit with a nested deny provision means everything is permitted except what is explicitly denied; parsing provision hierarchies incorrectly leads to over- or under-sharing
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp