Member States and implementers shall take measures to: where appropriate, involve the patient while confirming authorisation to access and use health data (e.g. Patient Information Notice, Consent) in accordance with data protection law.