Purpose and boundary
This guide explains how a patient can describe the scope, duration and purpose of permission used in a cross-border coordination request. It covers communication, document handling, representatives and closure; it does not give legal advice or consent to a diagnosis, procedure, payment or travel decision.
ChinaCareAccess can help organise a consent note and route a process question, while the patient, provider and data custodian remain responsible for decisions within their own roles. The applicable law, signed form and institution rule determine whether a permission is valid, how it can be withdrawn and what must be retained.
Define the scope
Write one purpose per permission whenever practical: for example, translating a short summary, asking a named institution for an administrative reply, or sending a specific document for review. State what is not allowed, such as onward sharing, marketing, research, unrelated services or use after the request closes.
Identify the information category and minimum set rather than authorising an entire history by default. WHO describes rights to information, supported decision-making, privacy and access to records, while WMA materials emphasise understandable information and patient self-determination; these are reference principles, not a universal contract.
Name time and representatives
Add a start date, an end date or review point, the permitted channel, and the event that closes the permission. A representative should be named by role and contact route, with the exact actions they may take, the information they may receive, and any requirement to verify their authority under local rules.
Do not assume that a family relationship automatically authorises access or decisions. Ask the receiving institution what proof it requires, whether the patient must sign its own form, and how it records a representative. In an emergency, local law and clinical policy may create a different process, so seek the responsible team’s written explanation.
Withdraw or narrow permission
Send a dated withdrawal or narrowing request through the channel named in the original note, identify the affected purpose and recipients, and say whether open communication should stop, be limited to a new purpose, or be transferred to another representative. Ask for a receipt and the effective time under the institution’s procedure.
The GDPR is one example of a jurisdiction-specific rule: where processing relies on consent, Article 7 says withdrawal must be possible at any time and as easy as giving consent, while earlier lawful processing is not retroactively invalidated. Do not generalise that result to every country; ask the relevant controller or institution what it will stop, retain or disclose.
Keep an audit trail
Keep the original permission, later amendments, withdrawal request, delivery evidence, acknowledgements and a list of open tasks in a restricted folder. Use version names and timestamps, and record who made each change, which purpose it affected, and whether a copy was forwarded before the change took effect.
An audit record is a trace of events, not proof that every underlying action was appropriate. NIST SP 800-53 describes selecting event types, generating records and retaining them for defined organisational and regulatory needs; the institution’s retention schedule and applicable privacy law control the real period and access rights.
Close and follow up safely
When the request ends, ask the responsible holder to confirm which tasks are closed, which documents remain in a required record, which working copies are deleted or restricted, and whether another provider or representative received material. A closure note should distinguish completed action from a request that is still awaiting confirmation.
If consent, identity, access or deletion questions remain disputed, ask the institution’s privacy or records contact for its written route and consult an independent adviser qualified in the applicable jurisdiction. ChinaCareAccess can help prepare a neutral, minimum-data follow-up; it cannot order deletion, decide a legal entitlement or override a provider rule.
