The Privacy & Consent Workgroup of the Sequoia Project, an advocacy group for nationwide health information exchange, recently hosted a webinar titled “Operationalizing Automated Consent: Actionable Guidance for Health Care Providers, Payers, and Technology Vendors.”

Earlier in the year, the non-profit announced it published “Guidance to States: Legislating Technical Standard Definitions for Existing State-Sensitive Health Data Laws” and “Operationalizing Automated Consent: Actionable Guidance for Health Care Providers, Payers, and Other Health Care Organizations.” The guides for industry and government follow the non-profit’s “Moving Toward Computable Consent: A Landscape Review,” a whitepaper published in April 2025 that identifies challenges to collecting, managing, and honoring patient consent in electronic health information exchange.

During the webinar, Kevin Day, co-chair of the work group and principal business advisor at Cotivity, and Helen Oscislawski, managing partner at Attorneys Oscislawski LLC, discussed how to understand and prepare for automated consent.

Today, many organizations still rely on paper forms, scanned documents, and manual consent verification. At the same time, federal, state, tribal, and local requirements can vary depending on the type of information shared, who receives it, and the purpose of the disclosure. The result can be an overly cautious approach in which organizations withhold information rather than risk violating privacy rules, potentially creating gaps in care.

Computable consent captures a patient’s choices in a structured electronic format that systems can interpret and act on. Instead of treating consent as a static document, organizations can encode rules specifying what information can be shared, with whom, and for what purpose.

For example, a patient might authorize sharing substance use disorder treatment information with a primary care provider for treatment but not with another organization, Day explained. A computable consent framework could help enforce that distinction automatically.

“Not all consent is equal,” said Helen Oscislawski, managing partner at Attorneys Oscislawski LLC. Consent requirements can range from relatively straightforward yes-or-no choices to highly specific requirements governing what information can be shared, with whom, and under what circumstances.

The webinar emphasized the need for legal, privacy, technical, clinical, and operational teams to work together. As Day put it, “Not anyone can solve the problem.” A technically sound standard is of little use without legal and privacy agreement on the underlying rules, while a legally sound policy has limited value if it cannot be implemented in clinical workflows.

The Sequoia Project's guidance uses 42 CFR Part 2, which governs the confidentiality of substance use disorder records, as a practical example. Part 2 illustrates why automated consent is challenging: sensitive information may be subject to requirements that differ from HIPAA and state laws. Organizations therefore need to understand the specific consent elements required before attempting to automate the process.

The guidance provides practical tools, including a comparison of HIPAA and Part 2 requirements, a framework for mapping state laws, a model for modular consent, a RACI framework (a project management tool that maps project tasks against team roles) for assigning responsibilities, and a sample organizational policy.

Technology alone, however, won't make consent meaningful. Patients need to understand what they are agreeing to and have an appropriate level of control over their information. Oscislawski noted that many traditional consent forms are difficult for patients to understand, but said computable consent could create an opportunity for greater clarity by presenting choices in simpler ways.

Ultimately, the move toward automated consent is about more than replacing paper with technology. It is about creating a system where patient preferences, legal requirements, and information exchange can work together.

As interoperability advances, organizations will increasingly need to answer not only “Can we exchange this information?” but also “Should we?” Computable consent could become an important part of answering that question.