Consent

A member's data-sharing decisions are FHIR Consent resources in Payerbox's Aidbox, under two Da Vinci profiles:

The records arrive in three ways:

• members record them on the member portal (Consent Capture);
• the plan's data feed delivers them (Member Consent);
• a system writes them through the FHIR API, as described on this page.

Provider Access checks the opt-outs in $provider-member-match and in every $davinci-data-export. The Payer-to-Payer opt-ins say which other plans the plan may ask for the member's history.

Endpoints

The general behavior of these interactions, including conditional requests and If-Match, is in FHIR RESTful API.

Auth

A SMART Backend Services or Client Credentials client whose access policy allows the interaction on Consent. Members reach their own records only through the member portal. See Authentication and Access policies.

Search parameters

The base R4 parameters action, consentor, data, identifier, purpose and security-label are available too.

GET /fhir/Consent?patient=Patient/example-member&category=http://hl7.org/fhir/us/davinci-pdex/CodeSystem/pdex-consent-api-purpose|provider-access&status=active&provision-type=deny
Authorization: Bearer <token>

GET /fhir/Consent?patient=Patient/example-member&category=http://hl7.org/fhir/us/davinci-pdex/CodeSystem/pdex-consent-api-purpose|payer-to-payer&status=active&period=le2027-06-01&period=ge2027-06-01
Authorization: Bearer <token>

{
  "resourceType": "Bundle",
  "type": "searchset",
  "total": 1,
  "entry": [
    {
      "resource": {
        "resourceType": "Consent",
        "id": "67d8623c-9af9-4dac-a40d-f5f30bb856ea",
        "meta": { "profile": ["http://hl7.org/fhir/us/davinci-pdex/StructureDefinition/pdex-provider-consent"] },
        "status": "active",
        "provision": { "type": "deny", "period": { "start": "2026-10-06" } }
      }
    }
  ]
}

Provider Access opt-out

PUT /fhir/Consent/67d8623c-9af9-4dac-a40d-f5f30bb856ea
Authorization: Bearer <token>
Content-Type: application/fhir+json

{
  "resourceType": "Consent",
  "id": "67d8623c-9af9-4dac-a40d-f5f30bb856ea",
  "meta": {
    "profile": ["http://hl7.org/fhir/us/davinci-pdex/StructureDefinition/pdex-provider-consent"],
    "lastUpdated": "2026-10-06T14:22:00Z"
  },
  "status": "active",
  "scope": { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/consentscope", "code": "patient-privacy" }] },
  "category": [
    { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode", "code": "IDSCL" }] },
    { "coding": [{ "system": "http://hl7.org/fhir/us/davinci-pdex/CodeSystem/pdex-consent-api-purpose", "code": "provider-access" }] }
  ],
  "patient": { "reference": "Patient/example-member" },
  "dateTime": "2026-10-06T14:22:00Z",
  "performer": [{ "reference": "Patient/example-member" }],
  "organization": [{ "reference": "Organization/example-health-plan" }],
  "policyRule": { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/consentpolicycodes", "code": "cric", "display": "Common Rule Informed Consent" }] },
  "provision": {
    "type": "deny",
    "period": { "start": "2026-10-06" },
    "actor": [{
      "role": { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/provenance-participant-type", "code": "performer" }] },
      "reference": { "reference": "Organization/example-health-plan" }
    }],
    "action": [{ "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/consentaction", "code": "disclose" }] }]
  }
}

{
  "resourceType": "Consent",
  "id": "67d8623c-9af9-4dac-a40d-f5f30bb856ea",
  "meta": {
    "profile": ["http://hl7.org/fhir/us/davinci-pdex/StructureDefinition/pdex-provider-consent"],
    "versionId": "3927",
    "lastUpdated": "2026-10-06T14:22:00.112Z"
  },
  "status": "active",
  "...": "..."
}

Payer-to-Payer opt-in

{
  "meta": { "profile": ["http://hl7.org/fhir/us/davinci-hrex/StructureDefinition/hrex-consent"], "lastUpdated": "2026-10-06T14:22:00Z" },
  "category": [
    { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode", "code": "IDSCL" }] },
    { "coding": [{ "system": "http://hl7.org/fhir/us/davinci-pdex/CodeSystem/pdex-consent-api-purpose", "code": "payer-to-payer" }] }
  ],
  "policy": [{ "uri": "http://hl7.org/fhir/us/davinci-hrex/StructureDefinition-hrex-consent.html#sensitive" }],
  "sourceReference": { "reference": "DocumentReference/3f534529-49b7-4de8-b51c-e9f0d6831242" },
  "provision": {
    "type": "permit",
    "period": { "start": "2026-10-06", "end": "2027-12-31" },
    "actor": [
      { "role": { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/provenance-participant-type", "code": "performer" }] },
        "reference": { "reference": "Organization/lakeside-health-plan" } },
      { "role": { "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/v3-ParticipationType", "code": "IRCP" }] },
        "reference": { "reference": "Organization/example-health-plan" } }
    ],
    "action": [{ "coding": [{ "system": "http://terminology.hl7.org/CodeSystem/consentaction", "code": "disclose" }] }]
  }
}

Retire a record

A decision is never edited in place. A new decision is a new Consent, and the one it replaces is retired. A Payer-to-Payer withdrawal only retires the opt-in. Both profiles fix status to active, so a retirement sets status to inactive and removes the profile in the same JSON merge patch. A patch that changes only the status is refused.

PATCH /fhir/Consent/67d8623c-9af9-4dac-a40d-f5f30bb856ea
Authorization: Bearer <token>
Content-Type: application/merge-patch+json
If-Match: W/"3927"

{ "status": "inactive", "meta": { "profile": null } }

{
  "resourceType": "Consent",
  "id": "67d8623c-9af9-4dac-a40d-f5f30bb856ea",
  "meta": { "versionId": "3931", "lastUpdated": "2026-10-07T09:10:00.204Z" },
  "status": "inactive",
  "...": "..."
}

{
  "resourceType": "OperationOutcome",
  "issue": [{ "severity": "error", "code": "invalid", "diagnostics": "The value 'inactive' does not match the expected pattern 'active'" }]
}

Send profile: null; an empty array is refused.

Referenced records

Aidbox checks every reference a profile constrains. The referenced record must exist, be of the right type, and declare the profile the target names in its meta.profile, without a version:

Aidbox checks only the declaration, not the record's content. A declaration with a version (us-core-patient|6.1.0) matches only when that is the version the plain URL resolves to on the deployment.

Records written alongside

Records captured on the member portal come with:

Errors

{
  "resourceType": "OperationOutcome",
  "issue": [
    {
      "severity": "error",
      "code": "invalid",
      "diagnostics": "Referenced resource Patient/example-member content doesn't conform to any of target profiles: http://hl7.org/fhir/us/core/StructureDefinition/us-core-patient"
    }
  ]
}

Current limitations

• The profile canonicals carry no version. Aidbox validates against the versions the deployment has loaded: PDex 2.1.0 and its HRex dependencies.
• A record carries its PDex or HRex profile only while active. A representative's draft has none until it is approved, and retired or rejected records lose it.
• The member portal shows only Consents with scope patient-privacy that are either profiled or carry one of the two PDex API purposes, for the plan organization set in Consent Settings or for none.
• period=<day> without a prefix matches only periods that fit inside that day; use le and ge as above.
• An opt-in for non-sensitive information only moves no data until sensitive data is labeled: other payers return the member as consent-constrained.

Related