Confidentiality

Confidentiality is a crucial topic in human subjects research. However, this is an area where some IRBs have gone overboard in applying the principle. Confidentiality is not some absolute principle that must be guaranteed in all research. Rather, confidentiality protection is based on risk. The degree of confidentiality protection is directly related to the harm that could befall subjects if the information is inappropriately divulged. The regulations make this clear when they say, in the criteria for IRB approval (Section 111, #7), that "When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data." Also, in the required elements of informed consent (#5) the regulations say that researchers must include "A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained," So, the regulations don't require confidentiality for all information in all research, only when it is appropriate. When is it appropriate? When the information, if it became know to others outside the research, could put the subjects at risk of harm. IRBs need to weigh the risk of harm from the information when deciding on appropriate confidentiality.

For some research there is no way that any of the information from could possible harm the subjects, even if it were to be divulged (such as innocuous surveys). For other research, the subjects expect or give permission for their identities to be divulged (such as some oral history research). In these cases, it is inappropriate for the IRB to require extensive confidentiality procedures. Some IRBs have even required anonymizing oral history narratives where the subjects want to have their story identified.

In other research, especially much biomedical research and some sensitive social science research, the information “could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation” as the regulations state in the exemption categories. In these cases, the IRB must carefully weigh appropriate confidentiality procedures to protect subjects. Here too, however, if subjects fully understand the consequences and agree to have their information identified, then IRBs should not impose severe confidentiality requirements.

On a related note, the risk when investigators gather sensitive information is not that the investigators have the information (the subjects have agreed to that), but that the information is inappropriately divulged. Therefore, even when extremely sensitive information is gathered in a study, if the confidentiality procedures are adequate to reasonably ensure that the information will not be inappropriately divulged, the research may still be no more than minimal risk. Some IRBs, when they see sensitive information gathered in study, immediately classify the research as more than minimal risk. This is inappropriate.