Moving Toward Computable Consent: A Landscape Review

As the sharing of health information becomes more widespread and commonplace, the ability to manage privacy expectations and consent requirements becomes even more important. This is particularly true as state-level policies on reproductive health and other sensitive health care data diverge, and create increased sensitivity about what data are accessed or shared. However, the healthcare field currently lacks tools and local policies to: (1) efficiently support the collection and sharing of computable consent; (2) routinely act on individual data elements in accordance with individuals’ privacy preferences; or (3) effectively comply with complex and variable state and local privacy rules. Increasingly, it is policy requirements that are driving technical, operational, and business responses. In January 2024, The Sequoia Project established a Privacy and Consent Workgroup as a part of its Interoperability Matters Initiative to tackle these challenges.

The Workgroup draws on the expertise of dozens of subject matter experts (SMEs) from across the health community, including health care providers, health information exchange leaders, technology and standards specialists, consumer and patient advocates, privacy and other SMEs. It also includes representatives from three federal agencies: the Office for Civil Rights (OCR) and the Assistant Secretary for Technology Policy (ASTP) within the U.S. Department of Health and Human Services (HHS), and the U.S. Department of Veterans Affairs (VA). (See Attachment 4 for a list of Workgroup members.)

The Workgroup is chartered to catalog key impediments to operationalizing privacy and consent policies and describe whether and how standards-based, automated technical solutions can support health information exchange at a national scale that appropriately protects privacy and respects individual preferences. In doing this work, the group is focused on making progress at the implementation and operational level. While the Workgroup may also identify areas for federal and state policy attention, that is not its core focus.

This landscape review is a first step and reflects lessons learned from a series of presentations from those working to implement privacy and consent approaches at state, regional, and local levels (see section 6 below for a summary of the presentations). Building from this baseline knowledge, the Workgroup intends to launch and support a Community of Practice that will identify best practices and develop other practical guidance to further our collective ability to safely share health information to support better health and care, while also supporting the privacy and consent preferences of individuals.