Privacy vs. Confidentiality

IRB review of privacy and confidentiality protections is required under the Common Rule and the FDA regulations, as well as state and local statutes.

Protections to be reviewed by the IRB include:

• promises to subjects on informed consents,

• protections during recruitment and follow-up, and

• methods to be employed to protect data and samples during storage, and use, and eventual data destruction (if promised).

The IRB must receive this information with the protocol submission documents.

Sponsor access and any legally authorized access to subject information must be divulged in the consent form.

Overview

Privacy

Privacy can be defined in terms of having control over the extent, timing, and circumstances of sharing oneself (physically, behaviorally, or intellectually) with others.

MMC’s SOP PP 901

PRIVACYApplies to the Person

Privacy refers to an individual’s right to control access to him/herself. This includes access to the individual’s personal information as well as access to their body or their biological specimens.

The federal regulations define “private information” as “information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (e.g. a medical or education record.

Privacy

Confidentiality

Confidentiality pertains to the treatment of information that an individual has disclosed in a relationship of trust and with the expectation that it will not be divulged to others in ways that are inconsistent with the understanding of the original disclosure, without permission.

MMC’s SOP IC 704

CONFIDENTIALITYApplies to the “data”

Confidentiality refers to how private information provided by individuals will be protected by researcher from release. Describing just how the confidentiality of research information will be maintained is an important element of the consent process.

While the term “Confidentiality” is not formally defined in the federal regulations, the regulations make it clear that investigators have an obligation to informed research subjects:

• How their data will be used,• Who will have access to it,• What procedures will be put in place to ensure only authorized individuals will have access to the information, and•The limitations (if any) to these confidential procedures.

These “confidentiality” requirements are part of the informed consent process, usually as part of the consent document, and thereby become part of the agreement between the researcher and the research subject.

Confidentiality

The investigator must describe sound plans to protect the subject's identity, as well as the confidentiality of the research records. Care should be taken to explain the mechanisms that have been devised; for example, the use of numbering or code systems or safely locked files in private offices. Furthermore, the investigator should describe who has access to the data and under what circumstances a code system may be broken.

Plans to Protect Privacy & Confidentiality