Managing patient privacy is increasingly complex. Secure sharing of health information among health care providers and for other legally permitted purposes can be delayed or complicated. These difficulties include overlapping and conflicting state and federal requirements for sensitive information, manual consent-verification processes, and the lack of standardized methods for recording and communicating patient preferences.
To bridge this operational gap, The Sequoia Project’s Interoperability Matters Privacy & Consent Workgroup (PCWG) convened experts to assess this landscape and develop initial informational guidance and example resources for organizations exploring automated, computable consent processes. The guidance focuses on the use case of sharing sensitive information related to substance use disorder (SUD) treatment, including records subject to 42 C.F.R. Part 2. The materials are intended to help organizations evaluate issues, design workflows, and identify consent elements that may need to be captured in structured form. They are not legal advice and do not guarantee compliance, interoperability, technical performance, implementation success, or any particular operational result.
Community feedback may inform whether and how additional use cases, examples, or refinements are developed over time.
Organizations considering automated or computable consent generally need to evaluate three (3) foundational areas with their internal teams and electronic health information exchange (EHI) partners:
Assessing whether and how data-segmentation technology (including HL7® FHIR® and other data-tagging approaches) can represent consent-related parameters and metadata in way that support authorized sharing of EHI.
Translating complex legal, policy, and operational requirements into automated consent-management workflows, and, where appropriate, rules engines or other technology-enabled processes within Electronic Health Records (EHRs), health information networks, or related systems. Such approaches may reduce the administrative and legal evaluation burden on frontline organizations.
Presenting consent options to individuals in clear, understandable ways and supporting processes that help organizations consider and apply documented patient choices clearly while protecting sensitive information supports patients.
The PCWG has augmented the core guidance with five (5) distinct appendices with example resources that organizations may review and adapt based on their own legal obligations, technical environment, governance processes, and risk tolerance. These appendices address federal and state-law analysis, consent data elements, organizational roles and responsibilities, workflows, and a sample policy document.
This matrix crosswalks consent components required under HIPAA and 42 CFR Part 2 (“Part 2”), and distinguishes among standard Part 2 consents, treatment, payment, and health care operations (TPO) consents, and intermediary consents. Each element, such as patient identification, purpose, expiration, and redisclosure notice, is assigned a unique Consent Element ID. These IDs serve as a reusable reference point for policy review, workflow design, and potential translation into data fields or system logic.
The State Law Template is intended to help organizations evaluate how state laws governing SUD treatment information and other sensitive health information may overlap with, or add to, federal requirements under Part 2 and HIPAA. For each consent element (e.g., who may disclose, who may receive, description of the information, purpose, expiration, signature, and requirement statements) and for each category of sensitive information, organizations can use the template to document relevant statutes, regulations, and additional steps. The template does not determine whether state law applies or whether a proposed consent process is sufficient but offers an approach for organizing and evaluating such standards.
This appendix provides a modular example Part 2 patient consent form for disclosures of Part 2 records for Treatment, Payment and Health Care Operations (TPO) purposes. It organizes each required consent element into labeled fields that may be used for paper-based processes or adapted into electronic or computable consent formats. The appendix may also help organizations identify whether a proposed automated consent approach can capture, store, and transmit relevant elements in a structured way, and in accordance with applicable law.
This appendix outlines individual tasks and suggested role assignments for operationalizing a computable consent workflow for the defined scenario: a Part 2 Program disclosing Part 2-protected information for treatment purposes to a non-Part 2 HIPAA-covered entity provider through a health information network (HIN). Organizations may use the workflow and RACI as a planning aid and adapt it to their governance, contracting, technical, and operational environment.
This appendix offers a sample structured framework that Part 2 Programs may consider when formalizing their internal governance for automated consent. It includes sample policy language, procedures for validating electronic consent forms, qualified services organization agreement (QSOA) alignment considerations, and key decision points for integrating automated consent into existing privacy and security programs.
This guidance is intended to provide a practical starting point for organizations evaluating how to operationalize automated or computable consent in the Part 2 context. The appendices offer sample approaches and reference materials that may support internal planning, policy development, workflow design, and technical requirement gathering.
As organizations adopt and adapt these tools to their own computable, automated consent processes, the PCWG hopes to collect feedback. Case studies from real-world implementation could be used to iterate on these tools, as well as informing the development of future guidance and tools. The entire community is encouraged to share feedback with The Sequoia Project and the PCWG. Real-world lessons may inform future refinements or additional guidance. The community is invited to participate in the ongoing dialogue to support responsible, privacy-preserving health information exchange and better serve patients.
This summary and the accompanying paper are provided for informational purposes only. Organizations should consult their own legal, compliance, privacy, security, and technical teams before using, adapting, or implementing any approach described in the materials. No warranty, guarantee, endorsement, certification, or promise of specific functionality, interoperability, compliance, or implementation outcome is made or implied.
Interoperability Matters a public-private cooperative solving discrete health information exchange challenges through a variety of workgroups and initiatives. Learn More
Workgroup organized to assist understanding the barriers consumers face in accessing health information.
Workgroup organized to help propose and develop strategies to meet consumer healthcare needs.
Workgroup that targets improvements necessary to enable semantic interoperability of health information.
Workgroup focused on the on-the-ground approaches to facilitate information sharing.
Workgroup Inactive Workgroup that explores and recommends methods to improve interoperability amongst payers.
Workgroup that is committed to improving pharmacy interoperability.
Workgroup focused on supporting proper information exchange that protects consumers privacy.
Community of Practice focused on providing participants with best practices at the intersection of public health.
Committee is focused on facilitating and prioritizing the work of the Interoperability Matters Workgroups.
Learn about our history and meet the team that makes The Sequoia Project unique in the healthcare industry
Meet the members that help to make up The Sequoia Project community.
Learn more about the events available to The Sequoia Project members throughout the year.
Learn more about the benefits and resources available to The Sequoia Project members.
Visit The Sequoia Project swag store to purchase branded merchandise and apparel.
Learn more about sponsorship opportunities to help advance The Sequoia Project's mission.
Help us solve healthcare interoperability by become a member of The Sequoia Project.
(Members Only Access)
Access The Sequoia Project members community area and Member Directory
TEFCA™, outlines a common set of principles, terms, and conditions to support the development of a Common Agreement that helps enable the nationwide exchange of electronic health information (EHI) across disparate health information networks (HINs).
Discover how The Sequoia Project’s Advisory Services can support your organization with tailored projects and provide expert guidance on interoperability initiatives.
Bring The Sequoia Project experts to your organization to deliver education on interoperability and Health IT, tailored to your team’s needs and goals.
Engage The Sequoia Project team to support interoperability and health IT testing initiatives.
Learn how the Data Usability Taking Root Movement is advancing healthcare interoperability by improving the quality, consistency, and usability of shared health data across the industry.
The Sequoia Project is convening privacy & consent advocates in recognition of various initiatives underway to ensure health data is exchanged with proper patient consent.
Role-based education that helps healthcare organizations understand and comply with the Information Blocking Rule established under the 21st Century Cures Act.
The Sequoia Project offers a variety of opportunities for you to promote and highlight your organization throughout the year with sponsorships. From programs to our yearly annual meeting, there are a variety of sponsorship opportunities to choose from.
Discover the latest resources for advancing interoperability in your organization
Explore our public comments on Health IT, interoperability, information sharing, TEFCA, and healthcare policy initiatives.
Share your comments on Interoperability Matters Workgroup draft publications and add your insights to open surveys.
Contact us to learn more about health data interoperability, membership, initiatives, and how to get involved.
The annual meeting is the premier gathering of healthcare leaders, policy experts, and technology innovators dedicated to advancing nationwide health data exchange.
Complete the form below to access the Privacy and Consent Workgroup’s new resource.
