States and community HIEs, where empowered to do so, are adopting varying approaches to patient consent to participate in HIE. "Opt-in consent" usually requires affirmative authorization from the patient, often through signing a standardized consent form, before a patient's health information may be exchanged through the network. "Opt-out consent" may include, but does not require, that an organization gives notice, via a mailing, brochures or posted notice, at which point the patient can object to having the patient's health information exchanged through the network. Hybrid models of consent are available as well, such as allowing patients to opt-out of health information flowing to the HIO, but opt-in consent being required to take health information out of the HIO.

The decision about which consent model to adopt is complicated and involves several factors, including²:

• The education and outreach to patients about their options for consent, to facilitate informed decision making
• The irrevocability of the consent selected by a patient
• The granularity of the consent, in terms of whether a patient can consent by the type of data or the role of the user
• The ability to "break the glass" in the event of an emergency
• The consistency with other HIE efforts, particularly those crossing state lines due to practice patterns.

Opt-in:

Example from the field: Utah Health Information Network, Rhode Island, MedVirginia, Louisiana

Opt-out:

Example from the field: Nebraska Health Information Initiative, Idaho Health Data Exchange

Hybrid:

Example from the field: HealtheLink, Greater Rochester RHIO, Bronx RHIO