• Should protection of health information in medical research require affirmative action by patients? if so, what shold be the roles of the HIPAA Privacy Rule and the Common Rule in medical research?