ISO/TS 17975:2022
(Main)Health informatics — Principles and data requirements for consent in the collection, use or disclosure of personal health information
Health informatics — Principles and data requirements for consent in the collection, use or disclosure of personal health information
This document defines the set of frameworks of consent for the collection, use and/or disclosure of personal information by healthcare practitioners or organizations that are frequently used to obtain agreement to process the personal health information of subjects of care. This is in order to provide an informational consent framework which can be specified and used by individual policy domains (e.g. healthcare organizations, regional health authorities, jurisdictions, countries) as an aid to the consistent management of information in the delivery of healthcare services and the communication of electronic health records across organizational and jurisdictional boundaries. This document is applicable to Personal Health Information (PHI). Good practice requirements are specified for each framework of informational consent. Adherence to these requirements is intended to ensure any subject of care and any parties that process personal health information that their agreement to do so has been properly obtained and correctly specified. The document is intended to be used to inform: — discussion of national or jurisdictional informational consent policies; — ways in which individuals and the public are informed about how personal health information is processed within organizations providing health services and health systems; — how to judge the adequacy of the information provided when seeking informational consent; — design of both paper and electronic informational consent declaration forms; — design of those portions of electronic privacy policy services and security services that regulate access to personal health data; — working practices of organizations and personnel who obtain or comply with consent for processing personal health information. The document does not: — address the granting of consent to the delivery of healthcare-related treatment and care. Consent to the delivery of care or treatment has its own specific requirements, and is distinct from informational consent. — specify what consent framework is applicable to a data classification or data purpose as this can vary according to law or policy, although an examples of implementation profile is provided in Annex B; — specify the data format used when consent status is communicated. The focus is on the information characteristics of consent, and not the technology or medium in which the characteristics are instantiated; — specify how individuals giving Informed Consent come to be informed of the responsibilities, obligations and consequences related to granting consent; — specify requirements on how individuals are informed of the specifics of the data, data sharing or data processing concerned; — specify requirements on how consent itself or the specific activities of the consent process are recorded. Specific requirements on recording consent in EHR systems are given in ISO/TS 14441:2013, 5.3.2; — specify any information security requirements, e.g. the use of encryption or specific forms of user authentication (see e.g. ISO 27799).
Informatique de santé — Principes et exigences des données pour le consentement dans la collecte, l'utilisation ou la divulgation d'informations de santé personnelles
General Information
Relations
Standards Content (Sample)
TECHNICAL ISO/TS
SPECIFICATION 17975
Second edition
2022-11
Health informatics — Principles and
data requirements for consent in
the collection, use or disclosure of
personal health information
Informatique de santé — Principes et exigences des données pour
le consentement dans la collecte, l'utilisation ou la divulgation
d'informations de santé personnelles
Reference number
© ISO 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 2
3 Terms and definitions . 2
4 Abbreviated terms . 6
5 Consent requirements.6
5.1 General . 6
5.2 Informational consent . . 7
5.3 Consent to treatment versus informational consent . 7
5.4 How consent relates to privacy, duty of confidence and to authorization . 7
5.5 Relationship of consent to OECD guidelines . 8
5.6 Relationship of consent to legislation . 8
5.7 Expectations and rights of the individual . 9
5.8 Consent directives . 9
5.9 Consent is related strongly to purpose of use . 9
5.10 Consent to collect and use versus consent to disclose . 10
5.11 Consent is applicable to specified data . 11
5.12 Consent related to disclosure . 11
5.13 Exceptional access . 11
5.14 Challenges associated with obtaining consent .12
6 Consent frameworks .12
6.1 Giving consent . .12
6.2 Types of consent sta . 14
6.3 Detailed requirements .15
6.3.1 Express or expressed (informed) consent . 15
6.3.2 Implied (informed) consent . . 17
6.3.3 No consent sought . 18
6.3.4 Assumed consent (deemed consent) . 19
7 Mechanisms and process: denial, opt-in and opt-out, and override .20
7.1 Express or expressed (and informed) denial . 20
7.2 Opt-in and opt-out . 21
7.2.1 General . 21
7.2.2 Opt-in . 21
7.2.3 Opt-out . 21
7.3 Override . 21
8 Minimum data requirements .21
Annex A (informative) Consent framework diagrams .23
Annex B (informative) Jurisdictional implementation examples .29
Bibliography .33
iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 215, Health informatics.
This second edition cancels and replaces the first edition (ISO/TS 17975:2015), which has been
technically revised.
The main changes are as follows:
— editorial revision;
— Clause 2 and the bibliography have been updated.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
iv
Introduction
This document defines several frameworks for informational consent in healthcare. These are
frequently used by organizations who wish to obtain agreement from individuals in order to process
their personal health information.
NOTE Various terms are used to refer to the recipients of healthcare services. The terms patients, subjects
of care, data subjects, persons or clients are all used, depending upon the relationship of the individual with the
data collector and the circumstances or setting of the transaction.
Requirements arising from good practices are specified for each framework. Adherence to these
requirements will ensure the individual, as well as the parties who process personal health
information, that consent to do so has been properly obtained and correctly specified. This document
covers situations involving informational consent in routine healthcare service delivery. There can be
situations involving new and possibly difficult circumstances which are not covered in detail, but even
in these situations the principles herein can still form the basis for potential resolution.
In order to align with internationally accepted privacy principles, this document is based on two
international agreements. The first is the set of privacy principles specified by the Organization for
Economic Co-operation and Development and known as the OECD Guidelines on the Protection of
Privacy and Transborder Flows of Personal Data. These principles form the basis for legislation in many
jurisdictions, and for policies addressing privacy and data protection. International policy convergence
around these privacy principles has continued since they were first devised. The principles require the
consent of the individual for data processing activities.
The second international agreement used is the Declaration of Helsinki, which is used to define essential
characteristics of best practices in informational consent management. The Declaration of Helsinki is a
set of ethical principles regarding human experimentation. It was developed for the medical community
by the World Medical Association (WMA) and is widely regarded as a cornerstone document of human
research ethics. While this agreement applies directly to research on human subjects, it is intimately
related to data processing, and can therefore be readily applied to the detailed requirements for
informational consent management. In the context of the Declaration of Helsinki, the characteristics
of informational consent were defined and developed over a number of revisions in order to remain
relevant to contemporary society.
This document specifies that a record be retained of the set of agreements and constraints granted
via an informational consent process, and that the results of that process be made available to other
parties to whom the corresponding personal health information is subsequently disclosed (see 5.10).
It also defines a list of essential characteristics that the informational consent record should possess.
These characteristics can be represented within information handling policies and used as part of an
automated negotiation between healthcare information systems to regulate processing and exchange
of personal health information.
Interoperability standards and their progressive adoption by e-health programmes expand the
capacity for information systems to capture, use and exchange clinical data. For this to occur on a wide
scale, the majority of decisions regarding the processing of data will need to take place computationally
and automatically. This will in turn require privacy policies to be defined in ways that
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.