The glossary · 50 terms
Every field guards itself with vocabulary. Here is the working language of patient-mediated research — consent, privacy machinery, standards, and law — defined the way we'd explain them across a table. Each term links to the field notes that go deeper.
A database question that returns summary statistics — counts, averages, distributions — rather than individual records. Because no record-level data leaves the system, aggregate queries are a core tool of privacy-preserving research. They are usually paired with safeguards such as small-cell suppression or a k-anonymity floor, since even summary numbers can point to individuals when groups are very small.
The process of altering personal data so that individuals can no longer be identified by any means reasonably likely to be used. Under the GDPR, truly anonymized data falls outside data-protection law entirely, which is why the bar is set deliberately high. In practice anonymization is hard to achieve and harder to prove, because auxiliary datasets can enable re-identification. It is a stronger claim than de-identification or pseudonymization, both of which leave some path back to the person.
A record-keeping structure in which entries can be added but never edited or deleted. Corrections are made by appending new entries rather than rewriting history, so the full sequence of events is preserved. Append-only design is the foundation of tamper-evident audit trails in health systems, where what happened must remain verifiable after the fact.
A chronological record of who did what, to which data, and when, inside a system. In US healthcare, the HIPAA Security Rule requires audit controls, and compliance documentation is generally retained for six years. A trustworthy audit trail is append-only and tamper-evident, so it can support investigations and patient questions rather than simply asserting good behavior.
A 1979 report by the US National Commission for the Protection of Human Subjects that set out three principles for ethical research: respect for persons, beneficence, and justice. It was written in the aftermath of the Tuskegee syphilis study and remains the ethical foundation of US human-subjects regulation. Its principles are put into practice through the Common Rule and the work of institutional review boards.
A consent model in which a person agrees once to a wide range of unspecified future research uses of their data or specimens. It is common in biobanking and was given a formal pathway in the 2018 revision of the US Common Rule. Critics note that people cannot meaningfully weigh studies that do not yet exist, which is why per-study and dynamic consent models exist as alternatives.
An organized system that collects standardized data over time about people who share a diagnosis, such as diabetes or interstitial cystitis. Registries support natural-history research, quality measurement, and trial recruitment, and are often the only longitudinal evidence base for underfunded conditions. They range from clinician-run databases to registries built and sustained by patient communities.
A defined group of people who share characteristics specified by a researcher — a diagnosis, an age range, an exposure — and whose data is studied together. In observational research, a cohort is built by applying inclusion and exclusion criteria to existing records. The quality of a study depends heavily on how precisely the cohort is defined, which is the problem computable phenotypes exist to solve.
The Federal Policy for the Protection of Human Subjects, the US regulation (45 CFR part 46) that governs most federally supported research on people. It requires review by an institutional review board, informed consent, and ongoing oversight, and was substantially revised in 2018. Its ethical roots are in the Belmont Report.
An algorithm that identifies patients with a given condition from electronic health record data, expressed as executable logic over diagnosis codes, medications, lab values, and other structured fields. A good phenotype is validated against chart review, versioned, and reusable across sites. It turns a phrase like patients with bladder pain syndrome into a definition a machine can apply consistently.
A person's voluntary agreement to participate in research or share data, given after they genuinely understand the purpose, the risks, the benefits, and their right to withdraw. It is the central requirement of research ethics, anchored in the Belmont Report's principle of respect for persons. Valid consent requires comprehension, not just a signature — a standard many real-world consent forms fail to meet.
A technique for making logs tamper-evident by computing cryptographic hashes of entries and linking or publishing those hashes so that any later alteration becomes detectable. Each entry can be chained to its predecessor, and periodic digests can be anchored to an external reference point. The result is mathematical evidence that a record has not been rewritten — no blockchain required.
A company that aggregates personal data from many sources and sells or licenses it to others. In health, brokers trade in claims data, pharmacy records, and app-collected data, much of it de-identified in order to fall outside HIPAA's reach. The people the data describes are typically neither asked nor paid.
The principle that a system should collect and use only the personal data genuinely needed for a stated purpose. It is a binding requirement under GDPR Article 5(1)(c) and a recurring theme in modern privacy law. In research, minimization shows up as scope-limited access: a study receives the fields its protocol requires, not the whole record.
The removal or transformation of identifying information from health data so that it no longer identifies an individual. The HIPAA Privacy Rule recognizes two methods: Safe Harbor, which removes 18 listed categories of identifiers, and Expert Determination, in which a qualified expert certifies that the risk of re-identification is very small. De-identified data falls outside HIPAA, which is exactly why the strength of the de-identification matters.
A mathematical framework that protects individuals by adding calibrated statistical noise to query results, with a provable bound — the privacy budget, epsilon — on how much any one person's data can influence what is released. Unlike ad hoc anonymization, the guarantee holds no matter what auxiliary data an attacker has. The US Census Bureau used it for the 2020 census; in health it fits aggregate releases and federated counts rather than individual care.
A consent model in which people make ongoing, granular choices about each use of their data through a digital interface, rather than signing one broad permission up front. Participants can grant, refine, or revoke permissions over time as new studies appear. It trades the administrative simplicity of broad consent for a relationship in which every research use is an explicit decision.
An EU framework, Regulation (EU) 2025/327, that entered into force in March 2025 with staged application beginning in 2027. It creates rights and infrastructure for primary use of health data (care across borders) and a permit system for secondary use (research and policy), administered by national health data access bodies, with opt-out provisions for individuals. It is the most ambitious attempt yet to standardize health-data access across an entire region.
One of HIPAA's two recognized de-identification methods, defined at §164.514(b)(1). A person with appropriate statistical or scientific expertise applies accepted methods and documents that the risk of re-identifying individuals is very small. Compared with Safe Harbor, it can preserve more research utility — dates, geography — because risk is measured rather than handled by deleting whole categories of fields.
An approach in which the analysis travels to the data instead of the data traveling to the analyst. A query runs locally where the records are held — a hospital, a region, a country — and only aggregate results return, so record-level data never moves. OHDSI network studies established the pattern in health research, and it largely dissolves cross-border transfer problems because the records stay in place.
Fast Healthcare Interoperability Resources, the HL7 standard for exchanging health data over modern web APIs using structured resources, REST, and JSON. Begun in 2011, it succeeded where earlier HL7 standards struggled because it borrowed patterns every web developer already knew. Release 4 (R4) is the workhorse version, and US regulation now requires FHIR-based patient-access APIs from certified EHR systems.
The basic unit of data in the FHIR standard: a small, structured package representing one clinical or administrative concept, such as Patient, Observation, Condition, or MedicationRequest. Each resource has defined fields, can reference other resources, and is exchanged individually or in bundles over a REST API. Release 4 defines about 145 resource types, covering most of what health systems record.
The GDPR provision governing special categories of personal data, including health data, which it prohibits processing except under listed conditions. The most relevant gateways for research are Article 9(2)(a), explicit consent, and Article 9(2)(j), processing necessary for scientific research subject to safeguards. Health data therefore needs both a lawful basis under Article 6 and an Article 9 condition before processing is legal.
The Health Insurance Portability and Accountability Act of 1996, the US federal law whose Privacy and Security Rules govern how covered entities — providers, health plans, clearinghouses — and their business associates handle protected health information. It gives patients rights, including access to their own records, and sets conditions for use and disclosure. Data held by organizations outside this scope, such as most wellness apps, is not protected by HIPAA at all.
The signed, written permission HIPAA requires before protected health information can be used or disclosed for purposes such as research. A valid authorization must describe the information, who may use and disclose it, who receives it, the purpose, an expiration date or event, and the person's right to revoke. It is study-specific by design, which makes it a natural template for per-study research consent.
The tenth revision of the International Classification of Diseases, the World Health Organization's system for coding diagnoses. The United States uses a clinical modification, ICD-10-CM, for diagnosis coding in care and billing. Because ICD codes are tied to reimbursement, they are abundant in health data but imperfect as clinical truth — a coded diagnosis reflects billing practice as well as biology.
A practice by a healthcare provider, health IT developer, or health information network that is likely to interfere with the access, exchange, or use of electronic health information, prohibited under the 21st Century Cures Act. The rules define a narrow set of exceptions; outside them, refusing to share data that a patient or another provider is entitled to can bring federal penalties. For patients, this rule is the legal backbone of the right to connect an app and download their own records.
A committee that reviews research involving people before it begins and while it runs, weighing risks against benefits and checking that consent is informed and voluntary. IRBs are required under the US Common Rule and FDA regulations and operate under the ethical principles of the Belmont Report. Approval is study-specific and time-limited, with continuing review for ongoing research.
A privacy property stating that every record in a released dataset is indistinguishable from at least k minus 1 other records on its quasi-identifiers, such as age, sex, and ZIP code. Introduced by Latanya Sweeney and Pierangela Samarati in the late 1990s, it defends against linkage attacks by guaranteeing that any combination of identifying traits points to a group, never to one person. Larger k means stronger protection; health-data releases commonly require k of 5 or more.
One of the six legal grounds in GDPR Article 6 that must apply before any processing of personal data is lawful, among them consent, contract, legal obligation, and legitimate interests. For health data, a lawful basis alone is not enough: an additional condition under Article 9 is required because health data is a special category. Choosing the basis is a foundational design decision, since each carries different obligations and gives people different rights.
Logical Observation Identifiers Names and Codes, the standard vocabulary for identifying laboratory tests and clinical observations, maintained by the Regenstrief Institute. It answers the question of what was measured — hemoglobin A1c, blood pressure, a PHQ-9 score — so results from different labs and systems can be compared. LOINC works alongside SNOMED CT, ICD-10, and RxNorm, each covering a different slice of medicine.
Washington State's 2023 health-privacy law, widely considered the strictest in the United States. It covers consumer health data that falls outside HIPAA — app data, fitness data, inferences about health — requires separate consent to collect and to share it, demands a signed authorization before any sale, bans geofencing around health facilities, and gives consumers a private right of action. Its reach extends to any business handling the health data of Washington consumers.
Observational Health Data Sciences and Informatics (pronounced odyssey), an open international research community that stewards the OMOP Common Data Model and builds open-source tools for analyzing observational health data. OHDSI coordinates network studies in which the same analysis runs at many institutions without patient-level data changing hands. Hundreds of millions of patient records worldwide have been mapped to its model.
A standard structure for observational health data, created by the Observational Medical Outcomes Partnership and now maintained by the OHDSI community. Source data from EHRs and claims is transformed into common tables and standard vocabularies, so an analysis written once can run identically at any site using the model. It is the de facto standard for multi-site observational research — research-shaped, where FHIR is exchange-shaped.
A payment to a patient for the research use of their data. In the Mithras model, patients are paid fair-market participation fees that post only when an IRB-approved research-use event occurs — not for signing up, and never as a purchase of their data, because the platform never buys or sells data. The fee answers a simple observation: everyone else in the research-data chain is paid, and the person the data describes should be too.
A model in which research reaches health data through the patient rather than around them. Patients gather their own records — a right backed by HIPAA, the Cures Act, and the GDPR — and decide which studies may use them, on what terms. Mithras is built this way: patients own their records and grant each study a revocable, scope-limited consent, so access is a decision the patient makes, not one made about them.
Individually identifiable health information that is created, held, or transmitted by a HIPAA covered entity or its business associates. It spans diagnoses, treatments, billing records, and even the fact that someone is a patient at all. The same data outside HIPAA's boundary — in a consumer app, for example — is not PHI, a gap that newer state laws like Washington's My Health My Data Act were written to close.
The replacement of directly identifying fields with a code or token, while a separate key that can restore identities is kept elsewhere. The GDPR defines it at Article 4(5) and treats pseudonymized data as still personal — the link back exists — while encouraging the technique as a safeguard. It is weaker than anonymization and routinely confused with it.
An attribute that does not identify a person on its own but can when combined with others — birth date, ZIP code, sex, admission date. Linkage attacks work by matching quasi-identifiers across datasets; Latanya Sweeney showed that birth date, five-digit ZIP code, and sex alone uniquely identified 87 percent of the US population. Privacy protections such as k-anonymity are defined directly in terms of quasi-identifiers.
The act of matching records in a de-identified or anonymized dataset back to the individuals they describe, usually by linking quasi-identifiers to an outside data source. Well-known demonstrations include the re-identification of a Massachusetts governor's hospital record from voter rolls and the unmasking of users in the Netflix Prize dataset. The lesson is that anonymity claims must be tested against the auxiliary data an attacker could plausibly hold.
Health data collected outside conventional clinical trials, in the course of routine life and care: electronic health records, insurance claims, registries, wearables, and patient-reported outcomes. The term comes from the FDA's framework under the 21st Century Cures Act. Real-world data is the raw material; analyzed with sound methods, it becomes real-world evidence.
Clinical evidence about the use, benefits, or risks of a medical product, derived from analyzing real-world data rather than from a conventional randomized trial. The FDA accepts real-world evidence in defined regulatory contexts, including label expansions supported by registry data. Its strengths are scale and generalizability; its standing limitation is confounding, since treatment was never randomly assigned.
A standardized vocabulary for medications, produced by the US National Library of Medicine, that gives normalized names and codes to drugs and links the proprietary codes used by different drug databases. It lets systems recognize that two differently labeled products are the same clinical drug at the same strength and form. In research data models, medication records are commonly normalized to RxNorm.
One of HIPAA's two de-identification methods, defined at §164.514(b)(2). Data qualifies by removing 18 specified categories of identifiers — names, geographic units smaller than a state (with a limited ZIP-code exception), all date elements except year, contact details, identifying numbers, and more — provided the data holder has no actual knowledge that what remains could identify someone. It is simple and auditable, but stripping dates and geography costs research utility, which is what the Expert Determination path preserves.
Any use of health data beyond the purpose for which it was originally collected — most often, using care records for research, quality measurement, or public-health analysis. Secondary use is where most privacy law concentrates, because the patient agreed to treatment, not to everything that happens afterward. Frameworks such as the European Health Data Space exist precisely to give secondary use a regulated, permit-based structure.
The statistical-disclosure practice of withholding table cells whose counts fall below a threshold, because very small numbers can identify individuals. Health agencies commonly suppress counts below 10 or 11, and complementary cells must often be suppressed too so the hidden value cannot be recovered by subtraction. A minimum cohort size in a query system is the same idea, generalized from published tables to live queries.
An open standard that lets third-party applications plug into electronic health record systems, combining FHIR data access with OAuth 2.0 authorization and defined permission scopes. A patient or clinician launches an app, approves exactly what it may read, and the EHR enforces those scopes. It is the app-store model applied to health records, and the technical basis for many patient-facing data tools.
The most comprehensive clinical terminology in wide use, covering diseases, findings, procedures, organisms, and more, maintained by SNOMED International. Where ICD-10 codes diagnoses for classification and billing, SNOMED CT is built for recording clinical meaning, with concepts linked in formal hierarchies a computer can reason over. US interoperability rules require it for problem lists, and research models such as OMOP use it as a standard vocabulary for conditions.
The Mithras consent model: every research authorization consists of a plain-language summary and a formal authorization document, read together and signed as one decision. The summary exists so the person genuinely understands what they are agreeing to; the formal document carries the legal weight. Each consent is scoped to a single study and revocable at any time.
A pair of US standards that make FHIR data consistent nationwide. USCDI, the United States Core Data for Interoperability, is the federally defined list of data classes and elements that certified health IT must be able to exchange; US Core is the HL7 FHIR implementation guide that specifies exactly how those elements are represented as FHIR resources. Together they are the reason a Patient or Observation looks the same coming from different US systems.
Mithras