Digital consent — direct care, research, genomics and proxy access, one lifecycle

One lifecycle for every kind of consent an organisation holds: consent to treatment taken on a tablet, in the portal or spoken and witnessed; capacity assessed the way the Mental Capacity Act sets it out; research opt-out study by study; genomic consent answered element by element and withdrawn in one tap; and the list of people a person has said may see their record. Withdrawal is as easy as giving, because Article 7 says it has to be. Staff side at /consent-hub, patient side at /portal.

1 Consent turns up in four different forms

Most organisations hold consent in four places. A paper form in a folder. A research opt-out in a governance spreadsheet. A genomic form scanned into a shared drive. A note saying a daughter can be told things. Four owners, and no way to answer the question that matters: what has this person agreed to today, and what have they taken back?

Consent Hub is one lifecycle over all four: ask, record, evidence, withdraw. Staff side at /consent-hub, the person’s own side in the portal at /portal, both writing to the same record. Build them as four modules and you get four different answers to “has this been withdrawn?”, which is how organisations end up using data somebody objected to two years ago and hearing about it in a complaint.

2 Asking: the queue, the tablet, the portal, the spoken word

A consent request is a job of work. It sits in a queue with the patient, the template, the method and how long it has waited, and turns red past a day. From there you hand the device over, send it to the portal, record a verbal consent, or mark it declined.

Two things then happen with no extra work: the decision joins the patient’s communications timeline, and the consent is registered in the central signature registry with a content hash and the patient it belongs to, so every signature the organisation holds is countable in one place.

3 Capacity, done as the Act sets it out

A consent from somebody who lacks capacity for that decision isn’t a consent. The Mental Capacity Act 2005 sets a two-stage test, decision by decision and moment by moment, starting from the presumption of capacity.

The form follows the statute. Stage one asks whether there’s an impairment of, or disturbance in the functioning of, the mind or brain. If not, capacity is presumed and the assessment stops. If there is, stage two asks the four functional questions and the outcome is computed, not typed in. Where capacity is absent, a best interests panel opens under Section 4: who decides, who was consulted, what was decided, and why.

4 Templates, and the conversation before the signature

A template is versioned, categorised and made of elements, each marked required or optional. It carries a minimum age, the jurisdiction it was written for, and whether a capacity check is needed. Deactivating one stops it being used from now on, without touching consents already taken under it.

Montgomery changed what informed consent means here: the test is no longer what a body of doctors would disclose, it’s what this person would want to know before deciding. So the module carries decision aids — options side by side with benefits and harms, the material risk in plain words, and the questions that help somebody work out what matters to them. Six are seeded, following NICE guidance on anticoagulation, knee osteoarthritis, statins, prostate cancer, type 2 diabetes and depression.

5 Withdrawal, and what the record keeps

Article 7(3) of the UK GDPR says withdrawing consent must be as easy as giving it. That’s a design instruction and the module treats it as one. If giving takes one tap and withdrawing takes a phone call, a form and a fortnight, the organisation has failed the test while looking careful.

Every record carries a Withdraw action. It asks for a reason, takes effect immediately, and updates the row instead of deleting it, so the withdrawal sits on the record showing consent was given. That pair is what an audit needs; a deleted row reads as though the person never consented, which is untrue. The withdrawal lands on the communications timeline in the same breath, marked under Article 7.

Analytics answers the operational question beside it: requests by status, method and template, the consent rate, anything pending more than a day. An IG lead sees not that consent exists as a policy, but that a third of requests became a consent this month and two are overdue.

6 The person’s own side: research, study by study

Secondary use is where consent goes vague in most systems: one buried toggle labelled “research” with nothing behind it. The portal names the studies, says who runs each, and lets the person leave one without leaving the rest.

The middle card offers no way out, and that’s the honest answer instead of a missing button: a study on irreversibly anonymised data can’t link anything back to the person, so there’s nothing to remove, and accepting the request while doing nothing would be a lie told politely. The two either side are pseudonymised, so leaving takes one tap and so does rejoining.

Underneath sits the wider objection to secondary use, and this is where jurisdiction matters. The scheme is resolved from the person’s jurisdiction profile: in England the National Data Opt-out, cited to the Act and guidance that govern it. Where none is configured the platform names none and says the choice is recorded and honoured here but registered with no national service. Naming England’s scheme to somebody it doesn’t govern is a false statement about their rights. The screen states three limits unprompted: it doesn’t affect direct care, it doesn’t withdraw somebody from a study they agreed to join, and it can’t recall data already shared.

7 Genomic consent: six questions, six answers, six withdrawals

Genomic consent is where a single yes does the most damage. Agreeing to a test isn’t agreeing to be told about unexpected findings, nor that relatives may be approached, nor that the sample is kept for research. So they’re separate questions.

The asymmetry is the design. Giving consent in the portal runs a signature ceremony: a one-time code is sent, the person enters it, and the signature is bound to that consent and nothing else. Withdrawing needs no code, no reason and no signature, just one button. An element nobody answered stays unanswered instead of defaulting to no, because “declined” and “not asked” are different findings. A withdrawn consent stays visible, since hiding it would leave somebody unable to see that they once consented and no longer do.

The same register carries consents obtained in conversation and attested by the clinician’s own signature, and consents held on paper — recorded by form reference and who holds the original, because the platform has no document store and won’t pretend to. It shows which route each consent came by, so nobody mistakes an attestation for the patient’s own signature. The workflow won’t offer to submit a referral while consent is anything other than obtained.

8 Proxy and record access — and the honest limit

The portal holds the list of people a person has said may see their record: a GP practice with contribute rights, a community nurse with view rights expiring after a year, a pharmacy. Grants carry an expiry, can be revoked at any time, and each grant or revocation writes an audit entry naming the patient as the actor.

Here is the limit, which I would rather write than have a Caldicott Guardian find in a demonstration: the list doesn’t gate what staff can see. Clinical access is decided by role-based access control and organisation scope. It’s a demonstrated surface: it shows a person what has been granted and lets them revoke it, with the enforcement path still to be joined. Where consent does gate something today it gates it end to end: an objection to secondary use is checked before a row of a research extract is built, and a genomic referral won’t move without a live consent.

Where it lives in commvita