Concerns about privacy have led the US National Patient-Centered Clinical Research Network (PCORnet; see go.nature.com/d9eaee and Nature 508, 432; 2014) to adopt a slightly different approach from the UK National Health Service's care.data programme (see Nature 507, 7; 2014), which has similar goals.

Launched by the Patient-Centered Outcomes Research Institute, PCORnet aims to improve patient outcomes by connecting patients, clinicians, researchers and health systems.

PCORnet will not use a centralized database to pool information from multiple networks. Rather, it will leave identifiable patient data behind the firewalls of the 29 participating networks, and distribute programming code that allows the same analysis to be run within each network. In most cases, only aggregated results are transferred for pooling and reporting, which avoids privacy or security risks.

Each PCORnet partner network must engage all its stakeholders in governance. The authority to make final policy decisions on privacy and security and to participate in multi-network studies is vested locally. All research uses of data will be approved and overseen by institutional review boards.

In some cases, individual informed consent will be deemed necessary. In low-risk research, such as observational studies that do not alter treatment choices, networks can favour other forms of communication with patients, especially if obtaining individual consent would render the study unfeasible. Such decisions will also be made locally, and with patient participation.

These measures aim to ensure that PCORnet's 'big data' approach will answer patients' questions about their care while safeguarding the privacy of their personal health information.