Current laws, practices, and concerns about privacy inhibit access to health data for research. Barriers include inconsistent Institutional Review Board policies and complicated and costly procedures to obtain the consent of patients for release of their information. To realize the promise of comparative effectiveness research, it is essential to develop a new policy framework that will allow and encourage the use of health information in all forms--fully identifiable, partially anonymized, and deidentified. We propose that health data be made available for information-based research under a so-called research safe harbor. The arrangement would include strict data security controls, standards, and practices to be promulgated by the secretary of health and human services, and an annual third-party audit to ensure compliance.