health-cloud-consent-management

Health Cloud Consent Management

Use this skill when configuring Health Cloud patient consent management: setting up HIPAA authorization forms, creating consent templates, tracking consent status per patient, and handling withdrawal. This skill covers the clinical consent form lifecycle — template creation, enrollment-linked consent capture, and status management. It does NOT cover marketing consent objects (ContactPointTypeConsent, ContactPointConsent for GDPR/CCPA opt-out), general Experience Cloud consent flows, or consent for non-clinical purposes.

---

Before Starting

Gather this context before working on anything in this domain:

• Confirm Health Cloud is enabled and Consent Management is configured in Setup. Verify that the DataUsePurpose standard object is available — this is the root of the consent hierarchy.
• Identify the clinical use cases that require HIPAA consent (e.g., treatment, payment, healthcare operations, research). Each becomes a separate DataUsePurpose record.
• Confirm that every AuthorizationForm has at least one AuthorizationFormText with the IsDefault flag set to true. A missing default text causes the consent form to silently fail to display during enrollment.
• Distinguish clinical consent (HIPAA Privacy Rule authorization) from marketing consent (GDPR/CCPA opt-out). These use completely different object families. Do not confuse AuthorizationFormConsent with ContactPointConsent.

---

Core Concepts

The Five-Object Consent Hierarchy

Health Cloud patient consent uses a five-object hierarchy:

1. DataUsePurpose — Defines the clinical reason PHI is being used (e.g., Treatment, Payment, Research). This is the root anchor of the consent model.
2. AuthorizationForm — The form template that describes what the patient is consenting to. One form per consent type (e.g., "HIPAA Authorization for Treatment").
3. AuthorizationFormText — The actual text/content of the form in a specific language/locale. Every AuthorizationForm must have exactly one default AuthorizationFormText (IsDefault = true). Missing this causes the form to fail to display.
4. AuthorizationFormDataUse — Junction object linking AuthorizationForm to DataUsePurpose. Establishes which clinical use purpose each form covers.
5. AuthorizationFormConsent — The per-patient consent record. One record per patient per form with fields: ConsentGiverId (Individual ID), AuthorizationFormTextId, ConsentCapturedSource (how consent was obtained), Status (Seen, Signed, Rejected), and timestamp.