Consent management

Consent management is a system, process or set of policies for allowing consumers to determine information they are willing to permit their various providers to access. This allows individuals to control their own information privacy and how that information is collected and used, often within the context of digital platforms and data privacy regulations.^[1]

It was originally related specifically to health care but has expanded to include consent about all electronic information about individuals that include what data is collected, how it is used and provide them the ability to manage their consent choices.^[2]

History

Originally consent management was related to health care as medical records started to become stored and shared electronically. It was to enable patients and consumers to affirm their participation in e-health initiatives and to establish consent directives to determine who will have access to their protected health information (PHI), for what purpose and under what circumstances.

After GDPR was established in Europe after 2016, consent management became more widely used and started to include managing of private information and their access by any provider (like online advertisers). Consent management should supports the dynamic creation, management and enforcement of consumer, organizational and jurisdictional privacy policies.

Standards

The need to accommodate and automate consumer privacy preferences in health information exchange was recognized by the healthcare industry through various standards activities and consent discussions:

• American Medical Informatics Association (AMIA)^[3]
• Canada Health Infoway^[4]
• Information Security and Privacy Collaboration^[5]
• Health information technology Standards Panel (HITSP)^[6]
• Health Level 7^[7]
• Basic Patient Privacy Consents (Integrating the Healthcare Enterprise)^[8]
• Advanced Patient Privacy Consents (Integrating the Healthcare Enterprise)^[9]
• Organization for the Advancement of Structured Information Standards (OASIS)^[10]
• Interactive Advertising Bureau (IAB) Europe: List of Consent Management Provider^[11]