Abstract: A database contains confidential patient information. A researcher conducting a post-marketing study provides selection criteria to a maintainer of the database. The maintainer uses the selection criteria to select a cohort of potential post-marketing study subjects. The maintainer sends a questionnaire to each subject in the cohort. Optionally, the maintainer keeps a list of the identities of the subjects in the cohort. Subjects who choose to participate in the post-marketing study fill-in their questionnaires and return the questionnaires directly to the researcher. If the subjects choose to identify themselves to the researcher, the researcher can contact the subjects directly for follow-on research. Optionally, the researcher notifies the maintainer of the identities of subjects who return questionnaires, and the maintainer identifies subjects who do not return questionnaires and sends further questionnaires to these subjects.