Guidance From The Sequoia Project on Computable Consent and Privacy

Why It Matters

Standardizing computable consent bridges the gap between fragmented state privacy laws and national interoperability, enabling safer, more efficient health data exchange for patients and providers alike.

Key Takeaways

• State privacy laws are fragmented, creating compliance complexity.
• Computable consent aims to automate consent based on law and patient wishes.
• Data segmentation is essential to enforce granular privacy preferences.
• Sequoia Project’s work group releases guidance to standardize consent.
• Multistakeholder collaboration includes providers, vendors, advocates, and policymakers.

Summary

The Sequoia Project’s Privacy and Consent Work Group, co‑chaired by Kevin Day and Mel Sullies, is tackling the growing complexity of health‑data privacy. Their focus is on two pillars: computable consent—translating legal and patient‑specified permissions into machine‑readable rules—and data segmentation, which categorizes health information so that only authorized data is exchanged. The group highlights a stark divergence between federal interoperability goals and a patchwork of state privacy statutes. While the administration pushes for nationwide data flow, states are enacting granular protections for reproductive, behavioral, genetic, and other sensitive data, often with conflicting requirements. This creates overblocking, under‑sharing, and operational risk for organizations that must reconcile dozens of overlapping rules within legacy IT systems. Examples cited include a health system operating in California, Arizona, and Utah that must apply the most restrictive state law to all patients, preventing legitimate data exchange for Utah residents. The work group has already published a landscape‑review white paper and is preparing a guidance document that offers concrete technical standards for states to make their privacy laws enforceable in modern interoperable environments. The implications are significant: consistent, computable consent frameworks could unlock smoother data sharing, reduce legal risk, and restore patient trust. By uniting legal experts, technologists, operators, vendors, and patient advocates, the Sequoia Project aims to create a multistakeholder foundation that aligns policy with technology, paving the way for scalable, privacy‑preserving health information exchange.

Original Description

Clinicians, health IT professionals, and policy makers all want to protect patient privacy. This is a hard goal, made harder by the increasing pressures to open up data and share it for treatment and research purposes, and harder still by the proliferation of state laws on data privacy. These laws are only getting stricter and more detailed, and are fragmenting wildly even as the federal government tries to bring everyone together around standards.

The Sequoia Project, a nonprofit consortium, is dedicated to implementing data interoperability in health care, securely and respecting patient needs. In our recent interivew, we hear from two co-chairs of the Privacy and Consent Workgroup at The Sequoia Project: Mel Soliz and Kevin Day, where we learn more about these complex regulations and how their workgroup is providing guidance to make it simpler to navigate.

Learn more about The Sequoia Project: https://sequoiaproject.org/

Learn more about the Privacy and Consent Workgroup: https://sequoiaproject.org/interoperability-matters/privacy-and-consent-workgroup/

Healthcare IT Community: https://www.healthcareittoday.com/