To the Editor: Coiera accurately described some lessons from the United Kingdom’s experience with health information technology1 that should be noted by potential “fast followers”, such as Australia’s National E-Health Transition Authority (http://www.nehta.gov.au).

The debate about the merits of the “opt-in” versus the “opt-out” approach highlights a need for further discussion about the optimum consent model to achieve the aims of a shared electronic health record (EHR), combining patient-controlled health records with a tool for clinical decision making, and research and planning.2

Informed consent and ethical approval are vital for publication of evaluation findings. The 2007 National statement on ethical conduct in human research3 recognises that consent processes do vary, depending on the context and type of research.

Opt-in is an active process and is believed to build consumer confidence and reinforce a strong privacy message.2 Opt-out is more passive, assuming that most people are willing to share their health information for clinical and/or research purposes.

Our own experience with opt-in is that less than 0.4% of patients approached decline to participate in data extraction projects.4 With opt-out, there is little evidence to show that it is in any way harmful for initial patient contact. On the other hand, opt-in has been associated with a poor response rate and a biased study population in medical record research,5 in research in screening clinics,6 and in a pilot study of patients with angina.7 Because recruiting unbiased patient samples with high response rates is essential for scientific rigour, opt-out should be the default recruitment strategy for studies with a low risk for participants.

The most appropriate consent model for all situations, in an ethical and secure electronic environment, is one that allows patients and providers to make their own decisions about giving expressed or implied consent within an opt-in or opt-out approach. The participants in the process must be sure that consent has in fact been granted. The health record (paper or electronic) must demonstrate that the consent process has taken place and document the outcome.

We have developed software to enable use of this flexible consent protocol, permitting context-sensitive and ethical access to personal health information if patients, clinicians and researchers have given their consent.

The literature and our experience suggest that this flexible approach, based on the choices of patients and providers, should lead to good participation rates and allow the objectives of a shared EHR to be achieved in a cost-efficient manner.