Consent is scoped, timed, and revocable

Clinical software usually stores consent as a boolean on the patient record. It satisfies the form. It does not survive the first request to withdraw consent for research while keeping consent for treatment.

Consent has dimensions

Real consent answers four questions, and a boolean answers none of them: consent to what purpose, granted by whom, valid for how long, and still in force or withdrawn.

consents
  patient_id
  purpose            -- treatment | research | marketing
                     -- | third_party_share | record_transfer
  scope              -- which data categories
  granted_by         -- patient | guardian | authorised rep
  granted_at
  expires_at         -- null for open-ended
  withdrawn_at       -- null while active
  evidence_ref       -- signed form, recorded call, portal action

Active consent is a query with a date, not a flag lookup. That distinction is the entire point: consent is a statement about a moment, and every access happens at a different moment.

Withdrawal is a row, not a delete

Deleting the consent record destroys the evidence that it ever existed, which is exactly what you need when asked to justify an access from six months ago. Set withdrawn_at. The grant stays, the withdrawal stays, and the history reconstructs.

Check at access time, in one place

The failure mode is checking consent where the data is collected and never again. Data collected under research consent that was later withdrawn must stop appearing in research exports the day it is withdrawn.

One function, called at every read path:

may_access(patient, purpose, at = now)

If that is called in twelve places you will eventually find eleven that agree and one that does not, and the one will be an export script written in a hurry.

Guardianship changes and so does capacity

A parent consents for a child until the child reaches an age where they consent for themselves. Someone loses capacity and a representative takes over. Both are transitions in who may grant, not edits to an existing grant. Store granted_by as a role plus an identity, and record the transition when it changes — because an access authorised by a guardian after the patient turned eighteen is a finding.