Consent management
{{Short description |Process of allowing user to control how their data is used}}
Consent management is a system, process or set of policies for allowing consumers to determine information they are willing to permit their various providers to access. This allows individuals to control their own information privacy and how that information is collected and used, often within the context of digital platforms and data privacy regulations.{{cite news |url=https://www.forbes.com/councils/forbestechcouncil/2024/11/22/most-websites-get-consent-management-wrong-is-yours-one-of-them/ |title=Most Websites Get Consent Management Wrong—Is Yours One Of Them? |date=November 22, 2024 |publisher=Forbes }}
It was originally related specifically to health care but has expanded to include consent about all electronic information about individuals that include what data is collected, how it is used and provide them the ability to manage their consent choices.{{Cite web |last1=Anderson |first1=Max |title=The ins and outs of consent management platforms |url=https://www.ketch.com/blog/posts/consent-management-platforms |website=Ketch |date=May 13, 2025}}
History
Originally consent management was related to health care as medical records started to become stored and shared electronically. It was to enable patients and consumers to affirm their participation in e-health initiatives and to establish consent directives to determine who will have access to their protected health information (PHI), for what purpose and under what circumstances.
After GDPR was established in Europe after 2016, consent management became more widely used and started to include managing of private information and their access by any provider (like online advertisers). Consent management should supports the dynamic creation, management and enforcement of consumer, organizational and jurisdictional privacy policies.
Standards
The need to accommodate and automate consumer privacy preferences in health information exchange was recognized by the healthcare industry through various standards activities and consent discussions:
- American Medical Informatics Association (AMIA){{cite web |url=https://www.ncbi.nlm.nih.gov/pmc/articles/PMC353020/ |title=e-Consent: The Design and Implementation of Consumer Consent Mechanisms in an Electronic Environment |last1=Coiera |first1=Enrico |last2=Clarke |first2=Roger |publisher=American Medical Informatics Association |year=2004 |archive-url=https://web.archive.org/web/20170908100241/https://www.ncbi.nlm.nih.gov/pmc/articles/PMC353020/ |archive-date=September 8, 2017 }}
- Canada Health Infoway{{cite web |url=http://sl.infoway-inforoute.ca/downloads/04_2008-10-20%20iEHR%20Tech%202%20Overview.pdf |title=iEHR Tech II Project - Standards Collaborative Partnership |date=October 20, 2008 |publisher=Canada Health Infoway |archive-url=https://web.archive.org/web/20110706182916/http://sl.infoway-inforoute.ca/downloads/04_2008-10-20%20iEHR%20Tech%202%20Overview.pdf |archive-date=July 6, 2011 }}
- Information Security and Privacy Collaboration{{cite web |url=http://www.rti.org/page.cfm?objectid=09E8D494-C491-42FC-BA13EAD1217245C0 |title=Health Information Security and Privacy Collaboration (HISPC) - Impact Analysis Report |date=December 20, 2007 |publisher=RTI International |archive-url=https://web.archive.org/web/20090220125324/http://www.rti.org/page.cfm?objectid=09E8D494-C491-42FC-BA13EAD1217245C0 |archive-date=February 20, 2009 }}
- Health information technology Standards Panel (HITSP){{cite web |url=http://www.hitsp.org/ConstructSet_Details.aspx?&PrefixAlpha=2&PrefixNumeric=30 |title=TP 30 - HITSP Manage Consent Directives Transaction Package |date=October 15, 2007 |publisher=American National Standards Institute |archive-url=https://web.archive.org/web/20090324075126/http://www.hitsp.org/ConstructSet_Details.aspx?&PrefixAlpha=2&PrefixNumeric=30 |archive-date=March 24, 2009 }}
- Health Level 7{{cite web |url=http://hl7projects.hl7.nscee.edu/projects/cbcc/ |title=Community-based Collaborative Care Project |date=March 23, 2009 |publisher=HL7 |archive-url=https://web.archive.org/web/20090509233552/http://hl7projects.hl7.nscee.edu/projects/cbcc/ |archive-date=May 9, 2009 }}
- Basic Patient Privacy Consents (Integrating the Healthcare Enterprise){{cite web |url=http://wiki.ihe.net/index.php?title=BPPC |title=Basic Patient Privacy Consents (BPPC) |date=November 19, 2021 |publisher=Integrating the Healthcare Enterprise (IHE) wiki }}
- Advanced Patient Privacy Consents (Integrating the Healthcare Enterprise){{cite web |url=http://wiki.ihe.net/index.php?title=APPC |title=Advanced Patient Privacy Consents (APPC) |date=November 29, 2021 |publisher=Integrating the Healthcare Enterprise (IHE) wiki }}
- Organization for the Advancement of Structured Information Standards (OASIS){{cite web |url=https://docs.oasis-open.org/xacml/xspa/v1.0/saml-xspa-1.0-pr01.html |title=Cross-Enterprise Security and Privacy Authorization (XSPA) Profile of XACML v2.0 for Healthcare Version 1.0 |date=November 5, 2008 |publisher=OASIS }}
- Interactive Advertising Bureau (IAB) Europe: List of Consent Management Provider{{cite web |url=https://advertisingconsent.eu/cmp-list/ |title=Transparency & Consent Framework - List of registered CMPs |year=2018 |archive-url=https://web.archive.org/web/20180625125539/https://advertisingconsent.eu/cmp-list/ |archive-date=June 25, 2018 |publisher=IAB Europe }}