Short answer: keep login, consent grants, and data access as three separate decisions; evaluate a category-scoped grant on every protected read, and make revocation invalidate future reads without waiting for an identity-provider migration to finish.
That constraint changes the build. A managed authentication provider can prove who holds a session, but the session must not silently become permission to read every health category. For a small team shipping weekly, the highest-leverage move is a narrow authorization boundary that survives provider replacement. Outsource login if it saves time. Keep the consent record and access rule portable.
One warning up front: this is an engineering design, not a claim about which consent language or retention rule applies in a particular jurisdiction. I'm not sure any generic article can settle that; product counsel and the applicable policy have to define the categories, purposes, and required evidence.
Authentication is not consent.
How should health data consent category checks govern grants and revocation?
