Consent Experts Warn Paper-Era Workflows Push Health Systems Toward Over-Withholding
Helen Oscislawski, Esq. Founder & Managing Partner, Attorneys at OscislawskiHealth systems are withholding patient information they have every legal right to share. Consent verification still runs on. . .
Helen Oscislawski, Esq. Founder & Managing Partner, Attorneys at OscislawskiHealth systems are withholding patient information they have every legal right to share. Consent verification still runs on processes built for paper, and those cannot keep pace with networked electronic exchange. That gap sat at the center of arecent Sequoia Project webinaron newautomated consent guidance. Speakers described compliance caution displacing clinical need in decisions about what data moves. As a result, many organizations settle into a share-nothing posture that protects the institution, yet leaves treating clinicians without information that would improve care. The enforcement picture shifted in February, when the updated 42 CFR Part 2 final rule took effect and gave the HHS Office for Civil Rights authority to enforce noncompliance for the first time. Helen Oscislawski, founder and managing partner of Attorneys at Oscislawski, said the change removes the option of treating consent quality as a background concern. Organizations have accepted consent processes that fell short of the required legal elements, she noted. Vendors also need to be held accountable, because a consent missing an element is not a legally compliant consent. Kevin Day, principal business advisor at Cotiviti, co-leadsThe Sequoia Project Interoperability Matters Privacy and Consent Workgroup. The group’s landscape review found no single uniform federal or state law governing health data consent. Instead, organizations face overlapping and sometimes contradictory federal, state, tribal, and local rules. The same substance use disorder diagnosis can be regulated differently depending on who created it, who receives it, and why. Staff frequently misapply those rules, for example by treating Part 2 as covering all behavioral health data or assuming HIPAA requires authorization for every disclosure. Over-withholding follows. Consent standards also vary by jurisdiction, by category of information, and by provider or facility license. Some releases can be satisfied with a yes-or-no answer, Oscislawski said, while others demand specificity about which records are covered. State laws are where the variability runs widest, with separate rules often governing genetic information, HIV status, and reproductive health. What Computable Consent Actually RequiresComputable consent captures a patient’s choices in a structured electronic format. Systems can then interpret and act on those choices automatically when data is requested. A scanned PDF does not qualify, and free-text forms also leave every disclosure decision in the hands of a human reviewer. Day drew a distinction between binary consent covering an entire record (still handled as an opaque document at many organizations) and granular consent evaluated by machine. Specifically, the HL7 FHIR Consent resource lets a system encode what to share, with whom, and under what circumstances. A patient might agree to share substance use disorder records with a primary care physician while withholding them from a housing assistance program. Encoding and enforcing that distinction without human review is the capability most organizations lack today. Day cautioned that the R4 version of the Consent resource (the version currently adopted and regulated) falls short for demanding scenarios. He co-leads HL7 work to expand it. For teams evaluating vendor claims about FHIR-based consent, that limitation is worth confirming before a contract is signed. Day was also asked whether a receiving organization can independently verify that a consent was signed. In fact, several mechanisms apply. The Consent resource can carry the original signed form, including a digital signature, alongside the structured provisions. Trust network participation and TEFCA requirements add another layer, as do business associate agreements. Verification still remains a risk judgment each organization makes. No Single Team Can Deliver Consent AutomationConsent automation touches five functions, and Day said none of them can deliver it alone. Technical teams handle standards work, data tagging, and the APIs that capture and enforce preferences. Privacy teams determine which overlapping rules apply to a given data element, recipient, and purpose. Legal defines what the organization will actually do with what the law permits, including its risk tolerance for the edge cases that surface. Clinical teams, in particular, keep consent capture from disrupting care delivery or creating information gaps for treating clinicians. Operations covers vendor configuration, forms management, training, and exception handling. A technically sound standard is useless without legal sign-off on the underlying rules, Day said. Similarly, a legally sound policy is useless if clinical workflow cannot support it. Five Tools Organized by Who Uses ThemThe guidance includes five appendices arranged by stakeholder type. The first compares the legal consent elements required under HIPAA and Part 2 side by side, down to whether an expiration date can be left open. The second is a matrix organizations populate with their own state requirements. The third presents a modular consent broken into labeled elements with sample compliant language, structured to translate directly into a digital format. The fourth maps a disclosure workflow into a RACI chart assigning responsible, accountable, consulted, and informed roles across three organizations. The fifth supplies a sample policy template. Chantal Worzala, vice president of strategy and engagement at The Sequoia Project, said the coordination involved justifies assigning a project manager, a step some organizations would still consider excessive for consent work. Of course, the appendices carry limits worth naming. All of them are built on one scenario, a Part 2 program disclosing protected records for treatment to a non-Part 2 recipient through a health information network. The standards and tooling also remain in development, and the guidance is positioned as a starting point. Take It AwayConfirm your consent vehicle captures every legal element required under both HIPAA and Part 2, and hold vendors accountable for gaps. Ask FHIR-based consent vendors what the R4 Consent resource cannot do before signing. Assign one owner to coordinate privacy, legal, IT, clinical, and operations, and fund consent automation as a project. Map your state’s sensitive data rules against the federal baseline for every category you exchange. Document the risk position your organization takes on verifying consents received from outside parties. Oscislawski closed on the consumer side, saying the shift away from paper creates an opening for clarity. Consent forms today run dense and long, and patients sign them without understanding what they cover. Presenting those choices in a simplified, structured form makes genuine comprehension more achievable. That comprehension is also the purpose the legal elements were designed to serve. Related ArticlesHealth Systems Face USCDI v7 Planning Gap as v6 Certification Window Just Opens— July 24, 2026TEFCA Compliance Reviews Expand as ONC Signals DOJ Referrals for Bad Actors— June 26, 2026Dayton Children’s Whitlock Says TEFCA Trust Model Needs Stronger Guardrails to Stop Data Misuse— April 21, 2026Behavioral Health EHR Use Rises, Exchange Still Lags— April 20, 2026ONC’s Keane Says Government Will Strengthen TEFCA Onboarding to Address Provider Privacy Concerns— April 12, 2026