Privacy/Confidentiality – Principles and Regulations

1. Privacy/Confidentiality – Principles and Regulations Carol Siegel, MA, CIP University of Minnesota October 31, 2005

2. Potential breach of confidentiality common risk in : • those chances that specific individuals are willing to undertake for some desired goal; or • the conditions that make a situation dangerous per se. • The IRB is responsible for evaluating risk only in the second sense. • It must then judge whether the anticipated benefit, either of new knowledge or of improved health for the research subjects, justifies inviting any person to undertake the risks. http://ohrp.osophs.dhhs.gov/irb/irb_chapter3.htm#e1

3. Modern technology allows for greater protection and also greater access to information Computer technology allows for encryption and sophisticated methods for securing information CONVERSELY: Loopholes abound for potential breach of privacy • Hacking/cracking • Theft

4. IRB standard setting is insufficient to the task of protection • “Locked file” as standard is antiquated • Encryption and coding formula are unintelligible to most IRB members • Technology outpaces standards for security • Reliance on vendor assurances is inadequate

5. IRBs and Researchers should consider confidentiality protection issues as continuous and necessary at all phases of research: • Planning • Implementation • Storage of data • Publication • Data sharing

6. Privacy Privacy refers to persons and to their interest in controlling access of others to themselves. An adequate informed consent and initial relationship with researcher settles matters about what’s private.

7. What is Confidentiality? • Confidentiality is about data (not people) and about agreements and procedures for limiting the access of others to data. • There are ever-increasing methods of assuring confidentiality, along with ever increasing high-tech methods of breaching confidentiality.

8. The Privacy & Confidentiality Test • Privacy test: Does the subject think the information sought is any of the researcher’s business? Is the subject comfortable in the research setting? • Confidentiality test: Is the subject satisfied with the methods that will be used to control who can have access to the data?

9. Elements in detail: h) Assure confidentiality, and explain any limits: —Who can audit? —Who has access? —Is there a durable confidentiality risk, and how is it being addressed (e.g. DNA studies, tissue banks, data banks)? —If so, when will identifiers be destroyed? —Will any research information return tosubject?

10. Suggested Definition Confidentiality is an extension of the concept of privacy; it refers to data (identifiable information about a person) and to agreements about how data are to be handled in keeping with subjects’ interest in controlling the access of others to information about themselves. Joan Sieber, PhD, California State Univ, Hayward