Methods and apparatus, including computer program products, related to managing specification, enforcement, or auditing of electronic health information use. In general, data characterizing a request to modify access rights to health information is received and the access rights are modified in accordance with the request, where the modifying includes modifying a property characterizing access rights of a relationship between a first user and second users, or an organization of the second users. The access rights may be independent of the health information and modification of access rights may be independent of a security of the health information.