Table 1.

Summary of Approaches to Permission for Research Use of EHR Data

General Notification	When you first visit a healthcare organization, you receive a notice that tells you about all the ways the organization uses your health information. Somewhere in the notice, there are a few sentences telling you that the organization sometimes shares information in EHRs with qualified researchers who are conducting approved research. So, with general notification, the organization is not asking you for permission, but rather just informing you about their policy.
Broad Permission	Just like general notification, you receive a notice that tells you how the organization uses and shares health information, including a few sentences telling you that the organization sometimes shares information in EHRs with qualified researchers who are conducting approved studies. However, unlike general notification, with broad permission you get a yes/no choice—a chance to say whether or not researchers can include information from your EHR in approved studies.
Opt-Out	Another way this yes/no choice could be presented would be for the notice to state that information in your EHR might be used for research unless you check a box saying you don’t want that to happen. In other words, if you do nothing, qualified researchers could access your information for approved studies. But if you check the box to “opt out”, researchers would not be able to access it.
Opt-In	Another way the yes/no choice could be presented would be for the notice to state that information in your EHR will not be used for research unless you check a box saying that it is okay. In other words, if you do nothing, researchers would not be able to access your information. But if you check the box to “opt in”, qualified researchers could access your information for approved studies.
Categorical Permission	The last approach would be to give you a “menu” of choices. Just like the other approaches, you would get information about how the organization uses and shares health information—including notice that the organization sometimes shares information in EHRs with qualified researchers who are conducting approved studies.
	What’s different here is that you would be asked to make detailed choices about whether and with whom your information could be shared for research. For example, you might be asked to choose which types of researchers could use your information. You might be asked to choose which kinds of information from your EHR researchers could access.
	Let’s say you could make these choices during the clinic visit or take it home to complete. The default would be that it is okay to share all information with all researchers. In other words, unless patients make other choices, the organization would assume it is okay to share information with qualified researchers for approved studies.