Privacy and Confidentiality

1. Privacy and Confidentiality

2. Definitions • Privacy - having control over the extent, timing, and circumstances of sharing oneself (physically, behaviorally, or intellectually) with others. • Confidentiality - methods used to ensure that information obtained by researchers about their subjects is not improperly divulged.

3. Regulations 46.102(f) Human subject means a living individual about whom an investigator… conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information.

4. Regulations • Private information - information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record). • Identifiable information – information where the identity of the subject is or may readily be ascertained by the investigator or associated with the information.

5. Privacy Concerns about privacy may arise in several different contexts: • Observation of behavior • Obtaining identifiable private information from: • Records • Other individuals

6. Observational Studies • Most observational research, except that involving children and minors, is exempt from federal regulations unless the information is identified and sensitive • Not all behavior in public is public behavior if subjects have a reasonable expectation of privacy

7. Use of Records • The use of unidentifiable data is not human subjects research and does not usually require IRB approval. • Unidentifiable means that the investigator has no access to identifiers • Adequate procedures must be in place to protect access to identifiers at the source • Name and SS numbers are not the only identifiers • Accessing data may still be considered an invasion of privacy since subjects do not expect their data to be used for research purposes

8. Use of Records • Delinked data, where the investigator removes the identifiers, is human subjects research but may exempt from the requirements of 45 CFR 46. • Investigator does not determine whether research is eligible for exemption • In order to be eligible, the procedures for delinking must be sufficient to prevent identification of subjects

9. Use of Records • Research utilizing records that is not exempt, not more than minimal risk and is included in the list of eligible categories of research may be eligible for expedited review.

10. Use of Records • IRBs may waive some or all of the requirements for informed consent if: • The research is no more than minimal risk • The waiver does not adversely affect the rights and welfare of subjects • It is impracticable to carry out the research without the waiver • Where appropriate, subjects will be debriefed

11. Use of Records • The IRB may waive the requirement for written documentation of consent in cases where the research presents • no more than minimal risk; and • involves procedures that do not require written consent when performed outside of a research setting.

12. Use of Records Data repository • Under oversight of an IRB • IRB approves protocol specifying conditions under which data is accepted and released • Repository should have a Certificate of Confidentiality if the data presents legal liabilities

13. Use of Records • All data should be collected under an IRB approved protocol • Subjects must be informed that the data will be submitted to the repository, the types of research the data will be used for, the conditions under which it will be released, and procedures for protecting their privacy and confidentiality.

14. Information Obtained from Others • Anyone about whom an investigator obtains identifiable private information is a human subject, regardless of how the information is obtained

15. Confidentiality • Confidentiality and anonymity are not the same • Anonymous means no one, anywhere, ever can identify individual subjects • Names are not the only identifiers • Subjects’ participation in the research may need to be kept confidential as well as their data

16. Confidentiality • Methods to protect confidentiality: • substituting codes for identifiers • removing face sheets • properly disposing of papers with identifying data • limiting access to identified data • impressing on the research staff the importance of confidentiality • storing research records in locked cabinets.

17. Confidentiality • More elaborate procedures may be necessary for studies in which data are collected on sensitive matters such as sexual behavior or criminal activities. • Any written record linking subjects to the study can create a threat to confidentiality, including consent forms

18. Confidentiality • The IRB may waive the requirement for written documentation of consent in cases where: • The principle risks are those associated with a breach of confidentiality concerning the subject’s participation in the research; and • the consent document is the only record linking the subject with the research;

19. Confidentiality Certificates of Confidentiality • Provides protection against a subpoena for research data • Granted by DHHS but not limited to Federally funded research • Usually requires IRB determination that certificate is necessary

20. Privacy of Medical Records Standards for Privacy of Individually Identifiable Health Information 45 CFR Parts 160 - 164 Published in the Federal Register: December 28, 2000 Compliance Date: February 26, 2003 (2004 for small health plans) http://aspe.hhs.gov/admnsimp/

21. Privacy of Medical Records • Covered entities: health plans, health care clearing houses, and health care providers who transmit any health information in electronic form. • All medical records and other individually identifiable health information held by a covered entity is covered by the regulations.

22. Privacy of Medical Records • Entities may release records for research if: • Individual authorization is obtained from patients • An IRB or a “privacy board” waives the requirement for individual authorization (the regulations detail the criteria for a waiver)

23. Privacy of Medical Records • Entities may release records for research without authorization or a waiver if: • Record review is for research preparation and no information is removed from the entity • Research on information about deceased individuals