In modern health data governance frameworks, which requirement best ensures that patient data used for secondary research remains ethical and auditable?

### Why this is right The paper describes permissions for a defined research study, requires data use to be purpose-specific, and says permissions are logged and revocable. Academic status alone is not described as an exemption from patient consent. ### The concept A **purpose-specific permission** names the intended use rather than granting broad, indefinite access. A permission record helps show what was authorized and when. Revocability lets the patient withdraw authorization. The paper also says that consent controls should operate at the infrastructure level, so applications cannot simply ignore them. ### The other options - **B. Automatic access because the study is academic**: The paper describes approved research access but does not exempt researchers from consent requirements. - **C. Permanent access once the patient joins the network**: Joining the network is not blanket authorization for every future use. - **D. Access decided only by the software developer**: The design assigns control to patient permissions and platform rules, not unilateral developer choice. ### Terms - **Anonymized data**: Data processed to reduce the ability to identify the person it describes. - **Purpose-specific permission**: Authorization limited to a stated use of information. ### Remember Research access is tied to the stated purpose and patient authorization, not simply the researcher's identity.