Who is allowed to say “release it” when the patient cannot speak?
Consent frameworks define what happens once break-glass is declared. They do not define how it is declared, or by whom. IHE’s Privacy Consent on FHIR profile carries this as an open issue, and every candidate mechanism in that discussion assumes the declaring party is the requesting user, inside an organisation that can already vouch for them.
At a roadside, none of that holds. There is no prior relationship, no client registration, and in India no registry against which a first responder can be checked, although clinicians can be verified through the national professional registry.
The patient names delegates in advance. A minimal public tier is always readable without anyone’s approval. Anything beyond it is released only when a delegate declares the emergency from their own authenticated device, which produces a short-lived signed grant that the requester presents. Every release is written to an append-only log that the patient and every delegate can read.
When nobody answers, the requester gets the public tier and nothing more. That is the specified behaviour, not a failure state. It is also the current state of the world, which means the design cannot be worse than what exists today.
Timed automatic release is not a default. It may exist only where a deploying organisation’s clinical governance sets it, and where every delegate is told the moment it fires.
Open an issue. Corrections are more useful than agreement, and anyone who corrects something here is credited in the change.
Draft for comment, first published September 2026. Text under CC BY 4.0. By Anand Rajan (Anubis Lab) – repository.