Existing Wording: Consent.recipient Definition: Actor whose access is controlled by this consent under the terms of the policy and exceptions. Comments: The Consent recipient is the person/organization who is being granted or denied permission according to the stated policy.

Consent.except.securityLabel Definition: A set of security labels that define which resources are controlled by this exception. If more than one label is specified, all resources must have all the specified labels.

*Meaning if Missing: There is no specific actor who is the focus of the consent.

Proposed Wording: Needs to be remodeled. Rename Consent.recipient to Consent.actor because this actor is not limited to being a recipient.

Comment:

The Consent.recipient definition and comment fail to clarify that Consent.recipient is a type of Consent.except.actor outside of a Consent.except structure because of FHIR Consent modeling, such that it has:

*No explicit permissible privacy actions - i.e., is the recipient a courier, a collector, such as a repository, an entity that collects, accesses, uses, and discloses Consent Directives or Consent Metadata indexing information;

*No specified information that it is permitted to perform these operations on;

*A role that limits it to receiving information only, i.e., a role that is not permitted to do any other privacy action;

*Is governed under no consent policy as there is no Consent.securityLabel.

*"Meaning if Missing: There is no specific actor who is the focus of the consent" makes no sense. There must be at least one consent grantee even if its everyone in the universe. What this likely is intended to mean is that if no Consent.recipient is valued, then there is no actor outside of an "except". However, that can only be true if there is at least one "except", and the Consent.except.actor is a grantee to the Consent Directive rather than a downstream user to which a Consent.recipient may disclose.

Summary:

Rename Consent.recipient to Consent.actor