Concept explainer
Consent and directives
Describes how Pensieve records patient consent and directives, where they apply in the record, and how staff see them during care.
Pensieve records a patient's consent and directives as first-class entries on their record, alongside the clinical facts. Each directive names where it applies and takes effect at the read path, so staff see the patient's decisions as they give care.
Consent on the record
A directive is an instruction the patient gives about their own record, such as consent for a site to hold it or a rule about who may read a part of it.
Consent lives on the central record: patient-owned, one record per patient, carried across sites. A patient allows a site to hold their record, and withdraws that allowance, per site. The record holds both the clinical facts and the patient's own decisions about them, as entries of equal standing.
Where a directive applies
Directives apply at several grains. Each names the part of the record it governs and the readers it reaches.
| Directive | Where it applies |
|---|---|
| Site consent | Allows or withdraws a site's access to the record |
| Partition | Hides data authored at one site from readers at another |
| Category restriction | Restricts a sensitive category across sites |
| Field visibility | Governs a field by its sensitivity for a reader |
| Delegation | Grants a proxy or a time-limited share |
The sensitive categories a restriction covers are substance-use care, mental-health care, HIV care and reproductive care. A restriction on one of these travels with the record across every site.
Default and admission
Absence of an explicit withdrawal is an allowance, and access materialises on an active admission.
A site with a care relationship yet to open, or one the patient has withdrawn, sees basic information only: the public reference, a display name, a photograph, and coarse demographics. Clinical detail follows once an admission opens a care relationship. This is the shape of default consent: a patient allows care by default, and real access appears where an admission gives it a reason.
Care in progress keeps its access
While a patient is actively admitted at a site, a withdrawal or partition against that site is held until the admission closes. Care already under way keeps the access the admission established, so a directive takes full effect once the care relationship it would sever has ended.
A site's access state
A site's access to the record moves between three states, set by the patient's consent and the admission that gives it effect.
Formal sign-off
A consent document is captured through a Glyph form with a formal sign-off step.
The form locks the moment it is finished, so a completed consent stays as it was signed. A version history holds each design, so an old signed consent matches the form design used at the time. The document sits on the record as a durable entry and reads alongside the directive it records.
During care
Staff see a patient's directives on the record as they give care.
The record surfaces the patient's decisions beside the clinical facts, so a reader sees what the patient has allowed and restricted. A patient sees their own access history, which shows who read their record across every site. Emergency access can override a partition and a site's markings under a logged path, and it stays clear of the patient's own record and of an admission already in progress.
Proxy and delegation
A patient grants access to another person as a directive.
A proxy grant lets a guardian or legal representative act for the patient, with the grantor recorded. A share code grants a time-limited view that lapses at its expiry. For a minor, sensitive categories move from the guardian to the young person across defined ages, so an ageing minor holds their own sensitive record over time. A grant covering a sensitive category records a witness: a second credentialed clinician, identity-verified, distinct from the person making the grant.
Where does consent live, on the site or the record?
On the record. Consent is patient-owned and one per patient, held once outside the tenancy structure, and it applies per site through the site consent directive.
Can a patient hide data from one site while treated at another?
Yes, through a partition. It hides data authored at one site from readers at another, and a treating clinician may override it under a logged emergency path.
What happens to a withdrawal during an admission?
It is held until the admission closes, so care in progress keeps its access. The withdrawal takes full effect once the care relationship ends.
Read how the audit trail records each access and change to the record.