Use delegated login for authentication convenience, but record patient consent as a separate, versioned domain event inside the portal. The deciding constraint is auditability: an identity provider can establish who completed a login, while the portal must establish which data-use statement that...
Source: [Dev.to](https://dev.to/cianwinslow371/patient-portal-login-with-convenient-authorization-and-explicit-data-consent-3ggf)