<?xml version=“1.0” encoding=“UTF-8”?><Consent xmlns=“hl7.org/fhir”>

<id value="consent-example-smartonfhir"/>
<text><status value="generated"/><div xmlns="http://www.w3.org/1999/xhtml"><p><b>Generated Narrative with Details</b></p><p><b>id</b>: consent-example-smartonfhir</p><p><b>status</b>: active</p><p><b>patient</b>: <a>Patient/xcda</a></p><p><b>period</b>: Jun 23, 2016 5:02:33 PM --&gt; Jun 23, 2016 5:32:33 PM</p><p><b>dateTime</b>: Jun 23, 2016 5:02:33 PM</p><p><b>consentingParty</b>: <a>RelatedPerson/peter</a></p><p><b>organization</b>: <a>Organization/example</a></p><p><b>policyRule</b>: <a>http://hl7.org/fhir/ConsentPolicy/opt-in</a></p><h3>Excepts</h3><table><tr><td>-</td><td><b>Type</b></td><td><b>Action</b></td><td><b>Class</b></td></tr><tr><td>*</td><td>permit</td><td>Access <span>(Details : {http://hl7.org/fhir/consentaction code &#39;access&#39; = &#39;Access)</span></td><td>MedicationRequest (Details: http://hl7.org/fhir/resource-types code MedicationRequest = &#39;MedicationRequest&#39;, stated as &#39;null&#39;)</td></tr></table></div></text><status value="active"/>
<!--   
 In this SMART on FHIR login, the user consents for data sharing 
 for their elderly parent's record
  -->
<patient>
  <reference value="Patient/xcda"/>
</patient>
<period>
  <start value="2016-06-23T17:02:33+10:00"/>
  <end value="2016-06-23T17:32:33+10:00"/>
</period>
<dateTime value="2016-06-23T17:02:33+10:00"/>

<consentingParty>
  <!--   this is the patient record that matches the person
    making the decision. note: it's not always a related person
    -->
  <reference value="RelatedPerson/peter"/>
</consentingParty>
<organization>
  <!--   The organization running the Authentication server   -->
  <reference value="Organization/example"/>
</organization>

<!--   there's no source record for a Smart on FHIR consent   -->

<!--   now the consent details itself start   -->

<!--   smart on fhir is always the base opt-in policy   -->
<policyRule value="http://hl7.org/fhir/ConsentPolicy/opt-in"/>

<!--   each scope that relates to FHIR resource access is represented as an exception   -->
<except>  
  <!--   this except corresponds to MedicationRequest/read   -->
  <type value="permit"/>
  <!--   no actors here, or anything, just read/write and the resource type   -->
  <action> 
    <coding>
      <system value="http://hl7.org/fhir/consentaction"/>
      <code value="access"/>
    </coding>
  </action>
  <class>
    <system value="http://hl7.org/fhir/resource-types"/>
    <code value="MedicationRequest"/>
  </class>
</except>

</Consent>