Privacy

My last post was on confidentiality so I thought I’d write about privacy in this post. First of all, “privacyandconfidentiality” are not one word. Privacy and confidentiality are two different things. Unfortunately, most IRBs and investigators treat it as one thing and, when they address it at all, usually only address how data is being protected from disclosure. Also, because HIPPA is called the “Privacy Rule”, many IRBs and investigators feel that they are addressing privacy if they are complying with HIPPA.

Privacy means having control over the extent, timing, and circumstances of sharing oneself (physically, behaviorally, or intellectually) with others, while confidentiality refers to the methods used to ensure that information obtained by researchers about their subjects is not improperly divulged. So, we invade someone’s privacy when we access them or their information without appropriate authorization. The problem is that privacy is a very ambiguous term, so it is often hard to determine when we’ve invaded privacy. The federal regulations [45 CFR 46.102(f)] give us some guidance on this. They define “private information” as “…behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).” Based on this, it is the context and the person’s reasonable expectation that determines privacy.

Some examples might help clarify when privacy might be considered to be invaded. One common procedure for recruiting subjects that meet certain enrollment criteria is for the investigator to access records, such as medical records or school records), select individuals who meet the criteria and contact them to recruit them for the research. Often subjects, when contacted in this manner, ask “How did you get my name?” indicating that the investigator has invaded their privacy. They provided the information in the record with a reasonable expectation that the information would be used for the purposes for which it had been given and not for research purposes. If, however, they had been informed when they gave the information that it might be used for research purposes, then they would not have a reasonable expectation of privacy.

Another recruitment procedure is to go up to people in a certain location and ask them to participate. Whether this constitutes an invasion of privacy depends on the circumstances. Going up to people in a mall or on the street is not a problem because their presence in that setting is not private. However, going up to people in an emergency room waiting area, at their hospital bed or in a public restroom would be an invasion of privacy. In these contexts, people have a reasonable expectation of privacy.

This brings up another issue related to privacy. When is behavior “public behavior”? In our society, not all behavior which occurs in public is “public behavior” and we can invade people’s privacy even when they are in public. For example, if you were walking down a street talking with a friend, you would naturally assume that the people around you could overhear your conversation. The fact that they overhear your conversation is not an invasion of privacy. However, if you turned around and a researcher was following you and writing down everything you said, you would feel that your privacy was invaded. While we expect people to casually overhear us, we don’t expect to be systematically recorded. This is similar to investigators studying online chatroom behavior who say that it is public behavior since anyone can access the chatroom. However, participants in a chatroom don’t reasonably expect that their conversations are going to be systematically recorded and analyzed. I would say that such research could be considered an invasion of privacy.

Of course, all of this depends on the nature of the research and the sensitivity of the information. There are many innocuous research studies where most people could care less whether the investigator has appropriate authorization to access them or their information.

So, protection of privacy is an important ethical issue in human subjects research, but privacy issues are more complicated than they seem. Investigators need to carefully consider the privacy interests of their subjects and IRBs need to ensure that the research adequately protects those privacy issues.