Privacy Directive Profile

Canonical	../StructureDefinition/nexus-privacy-directive
Status	draft (experimental) · 1.26.0
Base	Consent (constraint)
Source	FSH · JSON

A patient's standing restriction on the collection, use or disclosure of their own personal health information -- the instruction PHIPA calls a lockbox.

TypedFhir API / Pydantic schema

The typed accessor surface Consent exposes for Consent — generated from this IG's compiled profile; each typed accessor has a validating raw-FHIR twin (xRaw) where marked. The three ports are parity-enforced.

The AI-facing shape: from typed_fhir.facade.generated.schemas import ConsentSchema — model_json_schema() is a structured-output / tool definition; instantiating validates an extraction. Generated source.

class ConsentSchema(BaseModel):
    """AI-facing shape of the Consent profile: the facade's typed accessor
    surface (curated + salient fields) as a pydantic model. `model_json_schema()` is a
    structured-output / tool schema; instantiating validates an extraction."""

    model_config = ConfigDict(extra="forbid")

    status: Literal[
        "active",
        "draft",
        "entered-in-error",
        "inactive",
        "proposed",
        "rejected",
    ] | None = Field(
        None,
        description=(
            "active | draft | inactive | entered-in-error. Required field in FHIR R4 Consent. "
            "Indicates the current state of this app consent. Note: This element is labeled as a "
            "modifier because the status contains the codes rejected and entered-in-error that "
            "mark the Consent as not currently valid. Consent.status — 1..1"
        ),
    )
    scope: Concept | None = Field(
        None,
        description=(
            "patient-privacy - Privacy consent. Required field in FHIR R4 Consent. For this app "
            "consent use case, always set to 'patient-privacy' as we're dealing with patient "
            "privacy consent for app data sharing. Consent.scope — 1..1. codes (required): adr | "
            "patient-privacy | research | treatment"
        ),
    )
    category: Concept | None = Field(
        None,
        description=(
            "Fixed: this Consent is an app consent. The family this Consent belongs to, fixed to "
            "`app`. It tells a consumer which interpretation contract governs the resource in its "
            "hand before the resource is interpreted, which is the point of carrying it on a "
            "searchable element: a mixed result can be partitioned in the search rather than "
            "after it. It says WHAT this decision governs and nothing about how to read it. The "
            "decision is `provision.type` in every family, so a reader never needs the family "
            "code to answer the dangerous question — it answers the cheap one. Note: The binding "
            "is required, not extensible: the value of this element is that a consumer can "
            "enumerate the families it knows how to interpret and refuse the ones it does not. A "
            "family minted under a deployment's own system would arrive looking like a known one, "
            "which is the failure the element exists to prevent. Consent.category — 1..1. codes "
            "(required): app | item | privacy-directive"
        ),
    )
    patient: Reference | None = Field(
        None,
        description=(
            "The patient (Patient X). The patient/healthcare consumer to whom this consent "
            "applies. Note: Commonly, the patient the consent pertains to is the author, but for "
            "young and old people, it may be some other person. Consent.patient — 1..1"
        ),
    )
    date_time: FuzzyDate | None = Field(
        None,
        description=(
            "When consent was given/withdrawn. When this Consent was issued / created / indexed. "
            "Note: This is not the time of the original consent, but the time that this statement "
            "was made or derived. Consent.dateTime — 1..1"
        ),
    )
    policy: dict | None = Field(
        None,
        description=(
            "The policy this consent is given under. A URI identifying the policy under which "
            "this consent is recorded -- the custodian's published privacy policy, or the "
            "statutory provision that governs the decision. R4's `ppc-1` invariant requires "
            "either `policy` or `policyRule`; this element satisfies it. **`policyRule` is not "
            "used, and the reason is a correction.** Earlier releases fixed `policyRule` to "
            "`consentpolicycodes#cric`. That code is 45 CFR 46 -- the United States Common Rule "
            "for informed consent in human-subjects research. It is not a "
            "communication-preference policy, not a data-sharing policy, and not Canadian. It was "
            "never the right value here, and the code system it comes from contains no Canadian "
            "concept at all: its 27 codes are US federal and state instruments plus three "
            "European ones. Rather than substitute another wrong code, this profile names the "
            "actual governing policy by URI, which is both truthful and machine-readable. "
            "Consent.policy — 1..*"
        ),
    )
    policy_rule: Concept | None = Field(
        None,
        description=(
            "Regulation that this consents to. A reference to the specific base computable "
            "regulation or policy. Note: If the policyRule is absent, computable consent would "
            "need to be constructed from the elements of the Consent resource. Consent.policyRule "
            "— 0..1. codes (extensible): at-elga | cric | dch-3927 | ga4gh | hipaa-auth | "
            "hipaa-npp | hipaa-research | hipaa-restrictions | …"
        ),
    )
    provision: dict | None = Field(
        None,
        description=(
            "The decision, and the app it is about. Carries whether the patient agreed to share "
            "with this application, and names the application. `provision.type = permit` is "
            "agreement; `deny` is refusal. A grant is now a positive statement rather than the "
            "absence of a nested denial. Consent.provision — 1..1"
        ),
    )