Consent Flow

Governance responsibilities

The Consent Flow establishes clear governance responsibilities whenever patient information crosses organisational boundaries.

This includes:

• responsibility for evaluating consent at the point of exchange
• visibility of lawful basis and patient preferences to receiving parties
• explicit handling of consent constraints, restrictions, or withdrawals

Consent governance ensures that information sharing decisions are contextual, auditable, and defensible — not assumed from prior encounters or inferred from system access.

Common failure modes

When consent governance is implicit or assumed, predictable failure modes emerge:

• Information is shared beyond its original purpose. Data moves lawfully, but not appropriately.
• Patient preferences are not visible to receiving clinicians. Decisions are made without knowing what the patient actually agreed to.
• Clinicians hesitate to share — or over-share to stay safe. Uncertainty drives both under-care and unnecessary disclosure.
• Organisations absorb compliance risk without realising. Risk transfers silently across boundaries, unowned and unmeasured.
• Consent status cannot be reconstructed after the fact. When questions are asked, there is no reliable evidence trail.

These failures rarely cause immediate, visible harm. Instead, they accumulate as latent risk — surfacing later when patients raise concerns, incidents are reviewed, or regulators ask how a decision was justified.

Clinical safety implications

Data Coordination Board (DCB) 0129 / 0160 framing

From a clinical safety perspective, the Consent Flow mitigates systemic hazard classes associated with inappropriate disclosure, unsafe restriction of information, and loss of accountability at handover points.

In DCB 0129 / 0160 terms, these hazards include:

• Information shared without an appropriate basis. Disclosure occurs lawfully but outside the intended purpose or patient expectation.
• Patient preferences not respected at the point of care. Decisions are made without visibility of consent constraints or withdrawals.
• Care withheld due to uncertainty about sharing permissions. Clinicians delay or avoid action because consent status is unclear.

By making consent explicit, contextual, and evaluable at runtime, the Consent Flow supports safety arguments that address both over-sharing and under-sharing risks — and extends accountability across organisational boundaries.

Consent failures often cascade into Provenance and Responsibility failures — when information is shared without appropriate basis, downstream teams inherit both the data and the compliance risk, without visibility of either.