Cross-clinic consent
How cross-clinic consent works
Patients can authorise one clinic to read records held by another clinic. flows.care models that authorisation as a pairwise consent grant: explicit source, explicit recipient, explicit data scopes, optional expiry. This article explains the model.
Grants are pairwise
A grant binds (recipient, source). To let Clinic A read records that Clinic B holds, the patient issues a single grant from B to A. If the patient is also a patient at Clinic C and wants A to see those records too, that's a second grant — from C to A. Adding a future Clinic D never silently widens an existing grant; the patient must opt in explicitly.
Data scopes
Each grant carries one or more scope codes that control what the recipient can read: records.read (basic identity, MRN, DOB), medical_history.read (blood type, allergies, conditions, emergency contact), appointments.read (appointment history at the source clinic), and progress_notes.read (clinical visit notes). The recipient sees only the scopes the patient picked.
Platform identity vs consent — two separate gates
Linking a tenant patient to a platform identity lets the patient see all their own records aggregated in their portal. It does NOT give any clinic access to records held elsewhere. Cross-clinic clinic-staff access stays gated by ConsentGrant. Two independent gates, intentionally so.