Consent & Data-Sharing Models
Who decides whether a patient's record can travel across the exchange — and how that decision is enforced in software. A neutral look at opt-in versus opt-out, granular consent, and the special rules for sensitive records under 42 CFR Part 2.
Two foundational consent models
Opt-in and opt-out
In an opt-in model, a patient's information is shared through the exchange only after they affirmatively agree. In an opt-out model, information is available for permitted purposes such as treatment unless the patient chooses to exclude it. The opt-out approach tends to produce a more complete clinical record for the treating physician to view before care, while opt-in foregrounds explicit patient choice. Neither is universally "correct" — states and exchanges weigh completeness of the record against the strength of up-front consent. AzHeC's role is to explain the trade-offs, not to sell one model.
Beyond all-or-nothing
Basic models treat sharing as a single yes/no switch. Granular consent aims to let a patient permit some data while restricting other categories. In practice this is hard: a widely noted technical barrier is the "all-or-nothing" consent format in many systems, which lack the ability to automatically segment sensitive records. That limitation directly affects whether certain specialty programs can participate in exchange at all.
Sensitive records and 42 CFR Part 2
Substance use disorder confidentiality
42 CFR Part 2 gives heightened federal confidentiality protection to substance use disorder (SUD) treatment records from Part 2 programs. As a general rule, Part 2-protected records may be disclosed only with the patient's written consent, with limited exceptions. The Part 2 Final Rule aligned several provisions more closely with HIPAA — for example, it permits a patient to give a single consent covering future uses and disclosures for treatment, payment, and health care operations (TPO) — and it clarified that segregating or segmenting Part 2 records is not required. Where segmentation is desired, data segmentation is the practice of sequestering specific data elements from capture, access or view.
These rules matter for exchange design because behavioral-health and primary-care integration depends on whether a system can honor consent at the level the law and the patient expect.
Frequently asked questions
01Is opt-in safer than opt-out?
It depends on what you optimize for. Opt-in maximizes explicit patient choice; opt-out maximizes record completeness for the treating clinician. Both are used across U.S. exchanges, and the right fit depends on state policy and stakeholder agreement.
02Does 42 CFR Part 2 require records to be segmented?
No. The Part 2 Final Rule clarifies that segregating or segmenting Part 2 records is not required. However, Part 2 records generally may be disclosed only with patient written consent, subject to limited exceptions.
03Why is granular consent technically difficult?
Many systems use an all-or-nothing consent format and cannot automatically segment sensitive elements. Without that capability, a program subject to stricter confidentiality rules may be unable to participate fully in exchange.
04How is consent enforced in the exchange?
Consent directives are recorded and checked before data is released, working alongside identity matching and audit logging. The technical enforcement is only as good as the system's ability to represent the patient's actual choice.
Privacy is a standards question too
Consent sits on top of HIPAA's Privacy and Security Rules. See how those rules apply to exchange.