Chapter 5: Ensuring Voluntary Informed Consent and Protecting Privacy and Confidentiality (Research Involving Human Participants V1)
Introduction
Two analyses that are central to the ethical review
conducted by Institutional Review Boards (IRBs) are an
appraisal of the informed consent process to be used in a
proposed research study and a determination of the extent to
which the privacy and confidentiality of the potential
participants will be protected. The current regulatory
requirements relating to these ethical issues reflect the
concept of respect for persons, as espoused in the
Belmont Report: Ethical Principles and Guidelines for the
Protection of Human Subjects of Research (Belmont
Report)
(National Commission 1979). Informed consent becomes an
essential protection, however, only after research has been
determined to be ethically justifiable in terms of beneficence
and justice. Adherence to these principles in the review of
research serves a gatekeeper function, permitting only
ethically acceptable research involving human participants to
proceed.1
Back to Top
Voluntary
Informed Consent
The principle of respect for persons requires that 1)
individuals are treated as autonomous agents and 2) that
persons with diminished autonomy are protected (National
Commission 1979). (This report addresses informed consent only
in the context of research involving competent adults.) An
autonomous agent is ‘an individual capable of
deliberation about personal goals and of acting under the
direction of such deliberation’ (National Commission
1979, 5). Respect for persons requires that prospective
research participants ‘be given the opportunity to choose
what shall or shall not happen to them’ and thus
necessitates adequate standards for informed consent (National
Commission 1979, 10). As Vanderpool notes, the Belmont
Report’s insistence on informed consent ‘accords
with the fundamental moral values of a free and democratic
society.’2 The informed consent process involves three
elements: 1) disclosing information to potential research
participants, 2) ascertaining that they understand what has
been disclosed, and 3) ensuring their voluntariness in agreeing
to participate in research (Faden and Beauchamp 1986). The
disclosure of information should be sufficient ‘such that
persons can decide whether they wish to participate in the
furthering of knowledge’ (National Commission 1979, 11).
Even when some direct benefit to participants may be
anticipated, this high standard for disclosure should be met,
because research inherently involves uncertainty and is always
designed to acquire knowledge. To ensure comprehension, the
presentation of information must be adapted to the potential
participant’s capacities and characteristics, and great
care must be taken to ascertain that the prospective
participant understands the information. Extra efforts may be
warranted to verify comprehension when risks are especially
high or there is uncertainty whether the prospective
participants are capable of understanding the risks. For
consent to be voluntarily given, the process must be free of
coercion and undue influence.
In previous reports, NBAC has focused much of its attention
on addressing specific issues related to informed consent that
arise from the interpretation of existing regulations. (See
Exhibit 5.1.) This chapter looks beyond current regulations to
focus on the overall scope and structure of the requirements
for informed consent and focuses specifically on four
issues:
- emphasis on disclosure;
- appropriateness of informed consent processes for
different types of research;
- waiver of the informed consent process; and
- documentation of the informed consent process.
Deficiencies with the Current Regulations
Federal regulations permit IRBs to approve research when
informed consent is sought and documented from each prospective
participant (45 CFR 46.111(a)(4)-(5); 21 CFR 56.111(a)(4)-(5)).
Requirements for informed consent are further described in two
sets of federal regulations in 45 CFR 46.116 and 45 CFR 46.117,
and 21 CFR 50.20, 50.25, 50.27 and 56.109. There are
substantial differences between the two sets of requirements;
the most notable being that the FDA regulations do not contain
the criteria for waiver or alteration of informed consent as
described in 45 CFR 46.116(d). The current regulatory system
specifies eight basic elements of information disclosure that
must be provided to prospective participants during the
informed consent process, except in cases of an approved waiver
or alteration of the consent process by the IRB. (See Exhibit
5.2.) Also specified are six additional elements of disclosure
that must be included when appropriate (46 CFR 46.116(b); 21
CFR 50.25(b)). The regulations for documentation require that,
except in specified circumstances, ‘informed consent
shall be documented by the use of a written consent form
approved by the IRB and signed by the subject or the
subject’s legally authorized representative’ (45
CFR 46.117(a); 21 CFR 50.27(a) [FDA regulations differ in
requiring that the form be dated at the time the consent form
is signed]).
Emphasis on Disclosure
Although the regulations pertaining to informed consent (45
CFR 46.116; 21 CFR 50.20) begin with a paragraph from the
Belmont Report related to the ‘three elements’ of
consent,information, comprehension, and voluntariness,the
actual procedures emphasize disclosure requirements, and in so
doing may distort the understanding of the ethical principle of
respect for persons.3 Especially in the context of requirements that
informed consent be documented using signed, written forms,
this exclusive emphasis on information leads investigators and
IRBs to equate informed consent with the information provided
in a consent form and to focus mostly on disclosures to
participants.4 Thus, these regulations fail to emphasize the
informed consent process and to attend to the importance of
comprehension and voluntariness, a failure the implications of
which have been described in previous NBAC reports (NBAC 1998;
NBAC 2001). Moreover, others have noted that the particular
emphasis on disclosure in informed consent is a product of
legal and regulatory thinking that equates informed consent
solely with the requirements to disclose information (Beauchamp
and Childress 1994, 145). This emphasis is not, however, fully
conducive to the more comprehensive view of informed consent,
which emphasizes the aspects of understanding, capacity to
consent, voluntariness, and features of decisionmaking,
including who may authorize consent (Beauchamp and Childress
1994; Faden and Beauchamp 1986).
Empirical evidence suggests that these regulatory
shortcomings all too frequently result in failures to achieve
voluntary informed consent (Verheggen et al. 1996; Waggoner and
Mayo 1995). For example, a study by the Advisory Committee on
Human Radiation Experiments (ACHRE) reviewed materials
submitted to and approved by IRBs from a sample of federally
funded studies. Generally, consent forms were difficult to
understand, requiring an advanced reading level and including
technical language and overwhelming level of detail (ACHRE
1995, 707). Difficulty in understanding consent forms has been
reported in many research studies (Blenkinsop 1997; Hochhauser
1997; Waggoner and Mayo 1995; Young et al. 1990). Indeed,
another study by ACHRE found that at least some individuals
failed even to understand whether they had participated in
research at all. At least 5 percent of patients who reported
they were not research subjects actually were, and at least 6
percent of patients who reported they were in research actually
were not (ACHRE 1995, 736). In general, these studies reveal
the deficiencies in the standard practice of seeking informed
consent. Anecdotal evidence in support of these findings was
provided at each of the five town meetings held by NBAC. For
example, IRBs are concerned that there is too much emphasis on
consent forms, that forms are too long and written at a reading
level that is too advanced, and most important, that
participants often do not understand to what they are giving
their consent.5 Rather than focusing on the ethical standard of
informed consent and what that entails for the process of
obtaining informed consent, IRBs and investigators have
followed the lead of the regulations and tended to focus on
disclosures found in the consent form. However, from an ethics
perspective, the informed consent process is the critical
communication link between the prospective participant and the
investigator, beginning with the initial approach of the
investigator to the participant (e.g., via a flyer, brochure,
or any advertisement regarding the research study) and
continuing until the end of the project. It should be an active
process of sharing information by both parties throughout which
the participant at any time is able to freely decide whether to
withdraw or continue participating in the research. The consent
form, if there is one, is intended only to document the
interaction between the participant and the investigator, and
it is only one part of the informed consent process. It is time
to emphasize the process of informed consent, with the goals of
ensuring that information is fully disclosed, that competent
participants fully understand the research so that they can
make informed choices, and that their decisions whether to
participate are always made voluntarily.
Informed Consent Processes Appropriate for Various Research
Settings
Although placing greater emphasis on the informed consent
process is crucial, it is also important to tailor the process
to suit the type of research being proposed and the interests
and situations of the potential participants. The eight basic
elements of disclosure specified in 45 CFR 46.116(a) and 21 CFR
50.25(a) are appropriate for clinical research, but some of
them are inappropriate to the point of being nonsensical for
other types of research, especially behavioral and social
science or historical research. For example, the basic element
requiring ‘a disclosure of appropriate alternative
procedures or courses of treatment, if any, that might be
advantageous to the subject’ (45 CFR 46.116(a)(4); 21 CFR
50.25(a)(4)) makes little sense for research studies involving
no interventions. Because of this requirement, forms often
contain illogical statements that can confuse participants.
Some IRBs and the Office for Human Research Protections (OHRP)
require a statement in the consent form, for example, that the
advantageous alternative procedure or treatment is to not
participate in the research. Similarly, including a statement
that refusal to participate will involve no penalty or loss of
benefits (45 CFR 46.116(a)(8); 21 CFR 5025(a)(8)) raises
concerns in some survey research in which there are no benefits
to be lost; in such cases, participants may become unduly
alarmed (McQuillan et al. 2000).
Although any of these basic elements of consent can be
altered or waived, the current criteria for doing so are often
difficult to meet. One of the criteria for alteration or waiver
is that the research could not practicably be carried out
without the waiver or alteration (45 CFR 46.116(d)(3)). Because
IRBs often interpret ‘could not practicably be carried
out’ to mean impossible to carry out, they require the
element of disclosure to be included, often in a less than
meaningful way (NBAC 1999b). In other cases, investigators and
IRBs spend much time documenting alteration or waiver
justifications in order to meet the stringent standards set in
the criteria, even though those criteria are not relevant
within the context of the research.
Moreover, when considering what information should be
provided to prospective participants, IRBs and investigators
should strive to ascertain what would be important to the
prospective participants from the participants’
perspectives. For example, before initiating research on
genetic screening for breast cancer, investigators held focus
groups with prospective participants to ask them what they were
interested in knowing about the proposed research. Rather than
being solely interested in the type of information required
under the regulations for disclosure, prospective participants
were interested in knowing about options to reduce the risk of
developing cancer, the cost of testing, and insurance coverage
for the test. This information would not have been included in
the informed consent process without input from prospective
participants (Bernhardt et al. 1997). Moreover, this
information was as relevant to their decisionmaking as the
information required under the regulations. Elsewhere, NBAC has
recommended that prospective participants can provide valuable
input into the type of information other prospective
participants might want to learn by involving them in the
design of studies and the informed consent process (NBAC 1998;
NBAC 1999b; NBAC 2001).
One specific type of research worthy of mention is deception
research. Methods related to deception are sometimes the only
valid ones for addressing an issue or question (e.g., study of
prejudice). There has been longstanding debate among
psychologists and ethicists about the merits of this research
(Nicks et al. 1997). In all imaginable cases, deception
research involves interaction with participants and thus the
opportunity for an informed consent process. In all cases, the
informed consent process must be tailored so that the research
study can be carried out. Participants cannot be told the true
purpose of the research until after the study is over, or
participants can be told some, but not all, purposes of the
research until the end of the study. When IRBs approve research
studies that involve deception, an informed consent process
should be designed that is appropriate to the purpose of the
study and that provides adequate protection for the
participants. For example, in a study designed to determine
whether the stereotypical belief that women are not as
proficient as men in mathematics adversely affects
women’s test scores, two groups of participants were
asked to take the same math test, but were given opposite
information about whether the test had been shown to produce
gender differences. Some or all of this information was false.
The study was not intended to reveal whether the test itself
produced gender differences in test scores, but rather whether
the threat of stereotyping led to gender difference in test
scores. Participants were told the true purpose of the study
when the study was completed (Spencer et al. 1999).
Although it is tempting to require a set of basic elements
of disclosure to be used during the informed consent process,
it is unlikely that any single set of basic elements can be
applied feasibly and credibly to all types of research. Whether
an investigator has included the eight basic elements of
disclosure is often open to interpretation. Further guidance is
needed not only to describe required elements for different
types of research, but also to describe procedures for
ascertaining what information should be included in a
particular research study.
In certain circumstances, monitoring the informed consent
process could increase participant protection, and monitoring
procedures could be used to measure participants’
understanding of the nature of the research and the risks
involved. Such circumstances might include research involving
significant risk, research enrolling participants who might
have difficulty in understanding the risks associated with the
study, or research for which the IRB is concerned about whether
the informed consent is being carried out according to the
stipulations in the approved protocol. In these cases, IRBs
should require some type of monitoring of the informed consent
process, although it need not perform the monitoring itself.
These mechanisms could be either temporary, lasting until the
concerns of the IRB are satisfied, or permanent, for the
duration of the research study.
Prospective Participants Who Cannot Give Voluntary Informed
Consent
The discussion thus far has focused on obtaining informed
consent from competent adults.6 When individuals who do not have the
capacity or who have lost the capacity to provide voluntary
informed consent are enrolled in research, other mechanisms
must be used to satisfy the ethical requirement of informed
consent. A previous NBAC report has addressed this issue with
respect to research involving individuals who have a mental
disorder that may affect decisionmaking capacity (NBAC 1998).
Other situations in which adults are unable to give voluntary
informed consent also should be examined.
Recommendation 5.1:
Federal policy should emphasize the process of informed
consent rather than the form of its documentation and should
ensure that competent participants have given their voluntary
informed consent. Guidance should be issued about how to
provide appropriate information to prospective research
participants, how to promote prospective participants’
comprehension of such information, and how to ensure that
participants continue to make informed and voluntary decisions
throughout their involvement in the research.
Waiver of Informed Consent
Although NBAC supports the ethical standard of informed
consent in research, circumstances arise in which the
requirement of seeking informed consent from competent
participants may be waived (NBAC 1998; NBAC 1999a; NBAC 1999b;
NBAC 2001).7
One circumstance involves the use of existing identifiable
data. As noted in an earlier NBAC report on research involving
the use of human biological materials, when the study offers
the potential to gain important knowledge, poses little or no
risk to participants, and consent would be difficult or
impossible to obtain, it is appropriate to waive the informed
consent requirement (NBAC 1999b).
The current federal regulations stipulate four criteria that
must all be met to waive informed consent:
- The research involves no more than minimal risk to the
participants.
- The waiver will not adversely affect the rights and
welfare of the participants.
- The research could not practicably be carried out without
the waiver.
- Whenever appropriate, the participants will be provided
with additional pertinent information after participating (45
CFR 46.116(d); 21 CFR 50.23, 50.24) [FDA regulations only
provide for waiver of informed consent in limited emergency
situations]).
At the time these requirements were written, one set of
criteria was wanted that would address waivers and alterations
for both biomedical and behavioral research. Although the third
and fourth criteria appear to apply primarily to deception
research (Dresser 1981) and are useful in an IRB’s
deliberation about altering the informed consent process in
deception research, they are not readily applied to other types
of research in which an alteration is requested or even when a
waiver of the entire informed consent process is requested. As
mentioned earlier, one of the most poorly understood terms by
IRBs and investigators is practicably.8 Only in a few research studies
would it be impossible to obtain informed consent; however, in
many studies the financial cost and time required to obtain
informed consent would be prohibitive and a potentially poor
use of limited research resources.
Indeed, four recommendations in NBAC’s report on the
use of human biological materials address the interpretation of
these waiver criteria when conducting research with stored
biological material (NBAC 1999b). These recommendations,
displayed in Exhibit 5.3, were intended to add clarity to the
regulations, not to change them.
As a matter of policy, two options are available. The first,
which NBAC recommended in previous reports, is to specify the
clarifications necessary to existing regulations for granting
waivers (NBAC 1999b; NBAC 2001). The second is to revise the
regulations, given a broader understanding of the ethical
standards of informed consent. With this second approach,
criteria for altering the consent process would no longer be
needed if Recommendation 5.1 of this report were adopted.
However, criteria for waiving the informed consent process
altogether would still be required.
Waiver of the informed consent process is justifiable in
research studies when there is no interaction between
investigators and participants, such as in studies using
existing identifiable data (e.g., studies of records). In a
previous report, NBAC discussed risks associated with research
involving the use of existing data (NBAC 1999b), noting that in
such studies, risks will usually not be physical and instead
are likely to arise from the acquisition, use, or dissemination
of information from the research study and thus are likely to
involve threats to privacy and breaches in confidentiality. As
discussed in the following section, many steps can be taken to
protect both privacy and confidentiality, and with such
protections in place, IRBs may waive the requirement for
informed consent. The criteria for waiving informed consent in
such instances should be revised.
Recommendation 5.2:
Federal policy should permit Institutional Review Boards in
certain, limited situations (e.g., some studies using existing
identifiable data or some observational studies) to waive
informed consent requirements if all of the following criteria
are met:
- all components of the study involve minimal risk or any
component involving more than minimal risk must also offer
the prospect of direct benefit to participants;
- the waiver is not otherwise prohibited by state, federal,
or international law;
- there is an adequate plan to protect the confidentiality
of the data;
- there is an adequate plan for contacting participants
with information derived from the research, should the need
arise; and
- in analyzing risks and potential benefits, the
Institutional Review Board specifically determines that the
benefits from the knowledge to be gained from the research
study outweigh any dignitary harm associated with not seeking
informed consent.
The first criterion is intended to limit exposure to riskier
research when informed consent is not obtained, except in
circumstances in which a component involving more than minimal
risk also offers the prospect of direct benefit. The second
criterion is intended to protect participants’ rights
existing under federal, state, or international statute.
Protecting welfare is removed from the text of the criterion
because welfare is protected through criterion a, c, or e in
Recommendation 5.2. The third and fourth criteria are
recommended on the assumption that strong confidentiality
protections can reduce violations of privacy (see discussion
below). The fifth criterion is recommended based on the
discussion above regarding the justification of research
through risk/potential benefit analysis. A criterion related to
practicability is not included, because it would not add to the
protection of participants if the other criteria are met.
Documentation of Informed Consent
A similar sort of flexibility is needed for the
documentation of informed consent. Current regulations require,
with limited exception, that informed consent be documented
using a written consent form approved by the IRB and signed by
the participant (45 CFR 46.117(a); 21 CFR 40.27(a), 56.109(c),
(d)). As NBAC noted previously, this requirement could pose
inappropriate barriers to conducting useful and ethically sound
research that otherwise conforms to regulatory requirements
related to informed consent (NBAC 2001), an observation that is
made elsewhere as well (Singer 1978).9 A signed, written consent form may be
problematic in at least two ways: it must be signed, and it is
in writing. In some cultures, both in the United States and in
other countries, requesting a signature raises issues of trust
and might suggest inappropriate gravity regarding the research.
In addition, a written form has little utility with illiterate
populations. In certain types of research, such as survey
research, signed, written consent forms are not considered part
of the standard methodology. For example, telephone surveys
(such as those used by telemarketers) and face-to-face
interviews are often encountered as part of daily living, and
individuals either freely participate or refuse, for example,
by hanging up the telephone. For these reasons, NBAC has
distinguished between the substantive ethical standard of
informed consent and the procedures by which consent is
obtained and has recommended that investigators should not
deviate from the substantive ethical standards, although the
procedures by which informed consent is obtained could vary if
approved by the IRB (NBAC 2001).
Although the federal regulations may have been attempting to
reflect a legal standard for documentation of informed consent,
NBAC is aware of no case law in which a signed, written consent
form is required.10 To fulfill the substantive ethical standard of
informed consent, depending upon the sort of research being
proposed, it may be more appropriate to use other forms of
documentation, such as audiotape, videotape, witnesses, or
telephone calls to participants to verify informed consent and
participation in the research study.
Recommendation 5.3:
Federal policy should require investigators to document that
they have obtained voluntary informed consent, but should be
flexible with respect to the form of such documentation.
Especially when individuals can easily refuse or discontinue
participation, or when signed forms might threaten
confidentiality, Institutional Review Boards should permit
investigators to use other means of verifying that informed
consent has been obtained.
Back to Top
Exhibit 5.1:
Previous NBAC Recommendations Regarding Informed Consent
NBAC has addressed the issue of informed consent in four
previous reports (NBAC 1998; NBAC 1999a; NBAC 1999b; NBAC
2001), and, because the topic is central to the protections
offered to research participants, recommendations regarding
informed consent have played a key role in each of these
reports. NBAC, for example:
- fully supports the principle of voluntary informed
consent as an essential safeguard to protect
participants’ rights and welfare (NBAC 1998; NBAC
1999a; NBAC 1999b; NBAC 2001);
- has acknowledged that certain research contexts may
require greater flexibility in procedures used to obtain
consent, for example, where cultural or language differences
exist (NBAC 1999b; NBAC 2001);
- recognizes the importance of appropriate limitations
regarding the use of substitute or third-party consent (NBAC
1998);
- recommends that individuals be provided with certain
options for providing informed consent regarding future
research studies (NBAC 1998; NBAC 1999b);
- acknowledges that it is sometimes difficult to
distinguish between research and treatment and has suggested
that the distinction needs to be clear to participants (NBAC
1998; NBAC 1999b; NBAC 2001);
- recognizes the importance of limiting coercion or undue
influence in obtaining voluntary informed consent (NBAC
1999b; NBAC 2001);
- recognizes that informed consent should be sought from
donors who are contributing biological materials to research
(NBAC 1999b); and
- emphasizes that informed consent is a process and not
merely a form to be signed in a routine manner (NBAC 1998;
NBAC 1999b; NBAC 2001).
Back to Top
Exhibit 5.2:
Required Elements of Disclosure
- A statement that the study involves research, an
explanation of the purposes of the research and the expected
duration of the subject’s participation, a description
of the procedures to be followed, and identification of any
procedures which are experimental.
- A description of any reasonably foreseeable risks or
discomforts to the subject.
- A description of any benefits to the subject or to others
which may reasonably be expected from the research.
- A disclosure of appropriate alternative procedures or
courses of treatment, if any, that might be advantageous to
the subject.
- A statement describing the extent, if any, to which
confidentiality of records identifying the subject will be
maintained.
- For research involving more than minimal risk, an
explanation as to whether any compensation and an explanation
as to whether any medical treatments are available if injury
occurs, and, if so, what they consist of or where further
information may be obtained.
- An explanation of whom to contact for answers to
pertinent questions about research and research
subjects’ rights, and whom to contact in the event of a
research-related injury to the subject.
- A statement that participation is voluntary, refusal to
participate will involve no penalty or loss of benefits to
which the subject is otherwise entitled, and the subject may
discontinue participation at any time without penalty or loss
of benefits to which the subject is otherwise entitled (45
CFR 46.116(a); 21 CFR 50.25(a) [FDA regulations differ in
requiring an additional statement that FDA may inspect
records]).
Back to Top
Exhibit 5.3:
Previous NBAC Recommendations Regarding Waiver of Informed
Consent
Recommendation 10:
IRBs should operate on the presumption that research on
coded samples is of minimal risk to the human subject if the
study adequately protects the confidentiality of personally
identifiable information obtained in the course of research,
the study does not involve the inappropriate release of
information to third parties, and the study design incorporates
an appropriate plan for whether and how to reveal findings to
the sources or their physicians should the findings merit such
disclosure.
Recommendation 11:
In determining whether a waiver of consent would adversely
affect subjects’ rights and welfare, IRBs should be
certain to consider whether the waiver would violate any state
or federal statute or customary practice regarding entitlement
to privacy or confidentiality, whether the study will examine
traits commonly considered to have political, cultural, or
economic significance to the study subjects, and whether the
study’s results might adversely affect the welfare of the
subject’s community.
Recommendation 12:
If research using existing coded or identified human
biological materials is determined to present minimal risk,
IRBs may presume that it would be impracticable to meet the
consent requirement (45 CFR 46.116(d)(3)). This interpretation
of the regulations applies only to the use of human biological
materials collected before the adoption of the recommendations
contained in this report (specifically Recommendations 6
through 9 regarding informed consent). Materials collected
after that point must be obtained according to the recommended
informed consent process and, therefore, IRBs should apply
their usual standard for the practicability requirement.
Recommendation 13:
OPRR [now OHRP] should make clear to investigators and IRBs
that the fourth criterion for waiver, that ‘whenever
appropriate, the subjects will be provided with additional
pertinent information after participation’ (45 CFR
46.116(d)(4)), usually does not apply to research using human
biological materials.
Privacy and
Confidentiality
All research, whether clinical, epidemiological, health
services, or social science, involves issues related to
protecting privacy and confidentiality. In fact, in some
research the invasion of privacy or breaches in confidentiality
are the only research-related risks to which participants might
be exposed (e.g., some anthropological, psychological, and
historical research studies; records review studies; and
secondary analysis of existing data). Privacy and
confidentiality, however, tend to be poorly understood
concepts, often mistakenly used interchangeably, and either
ignored or inappropriately handled by investigators and
IRBs.11
Privacy refers to persons and to their interests in controlling
access of others to themselves (Boruch and Cecil 1979). In the
research context, privacy refers to how investigators collect
or access identifiable data from participants. Protection of
privacy naturally follows as an application of the ethical
principle of respect for persons, because in respecting the
personhood and autonomy of individuals, investigators must be
sensitive in the ways in which they interact with participants
who are deciding whether to reveal or withhold information.
Americans value their privacy and are concerned about the
circumstances under which they share information about
themselves and, once shared, how the information will be
handled (IOM 2000).
Confidentiality, on the other hand, refers to identifiable
data and relates to agreements between the participant and the
investigator about how the participant’s data will be
handled and to whom it will be disclosed. It is an extension of
the concept of privacy.12 Participants are concerned about unauthorized
or inadvertent disclosures of their data, and although
participants and the public are generally supportive of
research, they often want to be assured that they are in
control of access to their information and that potential
breaches in confidentiality are minimized.13 Current federal
regulations incompletely address privacy and confidentiality
issues in research. IRBs may only approve a research study when
the research study is judged to have adequate provisions to
protect the privacy of participants and to maintain the
confidentiality of data (45 CFR 46.111(a)(7); 21 CFR
56.111(a)(7)). Federal regulations do not provide any
additional requirements, stipulate acceptable protection
provisions, or define the terms.
Some federal departments have established additional
protections relating to privacy and confidentiality that are
applicable to research. The Department of Education complies
with the Family Education Rights and Privacy Act of 1974, which
is designed to protect student records from disclosure without
consent from parents or students over 18 years of age. In
addition, the Protection of Pupil Rights Amendment gives
parents the right to consent for their children to participate
in sensitive research. The Department of Justice provides
additional regulatory protections for prisoners (28 CFR 512)
that give prisoners control over their data, require at least
one prisoner and a majority who are not prison personnel to be
members of the IRB reviewing the research, and prohibit prison
administrators from accessing research data.
Additional confidentiality protections are provided in the
National Center for Educational Statistics Confidentiality
Statute and the Public Health Service Act for the Centers for
Disease Control and Prevention’s (CDC’s) assurance
of confidentiality. These statutes limit the use of research
data to those purposes for which the participants consent and
prohibit the disclosure of identifiable data to anyone without
the consent of participants.
The Health Insurance Portability and Accountability Act of
199614
required that legislation regarding standards for the privacy
of individually identifiable health information be enacted by
August 21, 1999, or DHHS would be required to issue
regulations. Because Congress did not pass such legislation, on
December 20, 2000, DHHS announced regulations entitled
‘Standards for Privacy of Individually Identifiable
Health Information,’ which became effective April 14,
2001. Although these regulations provide some confidentiality
protections for individually identifiable health information,
their application in the research context is limited because
the regulations apply only to health plans, health care
clear-inghouses, and health care providers. The regulations
outline conditions under which individually identifiable health
information held by any of the three entities may be disclosed
without the individual’s authorization to investigators.
Such disclosures may be made if an IRB or ‘privacy
board’ (as defined in the rule) approves a waiver of
authorization based on certain criteria, if the information is
sought solely for review preparatory to research, or if the
research is on a decedent’s information. Notwithstanding
these additional federal protections of privacy and
confidentiality, there is little federal guidance for IRBs and
investigators regarding the protection of privacy and
confidentiality.
Privacy
Respecting privacy involves more than seeking informed
consent from participants to access their data. Obtaining
informed consent serves a vital role in providing participants
with control over whether they will allow investigators to have
access to them and to data about them. Privacy is influenced by
the culture and individual circumstances of participants, the
nature and context of the research, and the particular social
and political environment in which the research and use of the
data will occur. Individuals have different views on what is
considered private. For example, telling an investigator about
one’s sexual practices is acceptable to some
participants, but highly offensive to others. It may be even
more difficult to respect a participant’s privacy when he
or she is different from the investigator in terms of age,
ethnicity, locale, socioeconomic status, or gender.15 Privacy refers
to the ways and circumstances in which investigators access
information about participants. Consent processes can protect
the aspect of privacy that deals with seeking permission to
access data, but other research procedures are needed to
protect the aspect of privacy related to the circumstances
surrounding the actual accessing of that data. Privacy can be
respected by using procedures such as written questionnaires
rather than face-to-face interviews, by using techniques in
which responses are signaled on the telephone touch pad rather
than verbally during telephone interviews, or by using private
rooms for disrobing for clinical examinations. To respect
privacy is to let participants control the access of others to
themselves, to provide conditions in which the
investigator’s inquiries are welcome, and to provide an
opportunity for participants to decline or restrict
access.16
To breach privacy is to violate participants’ space or to
intrude where one is not welcome or not trusted. In fact, the
mere act of contacting people about participating in a research
study may be a violation of their privacy, particularly when
the prospective participants are identified as having a
stigmatizing condition (e.g., HIV/AIDS, drug addiction).
Research in which management gives consent to conduct research
on employees, or deception research, in which participants are
led to behave in a way that they would not wish to be seen, are
examples of invasions of privacy.17 Although there are few publicized
cases of violations of privacy, the invasion of privacy may
cause any of the following harms: psychological (e.g., worry,
irritation, fear, embarrassment, self-doubt), legal (e.g.,
arrest), social (e.g., stigmatization), or economic (e.g.,
blackmail or unemployment).18 Because privacy concerns vary by type
and by context of research, as well as by the culture and
individual circumstances of participants, investigators should
be well informed and mindful of participants’ cultural
norms. Investigators also need to be aware of the various
research procedures and methods that can be used to respect
privacy. In addition, a clear, comprehensive regulatory
definition of privacy along with guidance for protecting
privacy in various types of research is needed.19 NBAC proposes the
following as a regulatory definition of privacy: Privacy
interests are persons’ interests in controlling access of
others to themselves and to information about them. Privacy and
confidentiality have long been concerns of social scientists
and oral historians, and many professional societies for these
disciplines have developed ethics codes and guidance describing
specific privacy and confidentiality issues and protections for
their disciplines (e.g., psychology, anthropology, and oral
history).20 In developing new guidance, policymakers should
consult existing codes and guidance.
Guidance can be instrumental in helping investigators and
IRBs raise concerns and issues about privacy, however it cannot
be expected to provide all of the solutions. It is incumbent on
investigators and IRBs, therefore, to tailor research
procedures to protect privacy as appropriate for each research
study. In addition, IRBs and investigators must be familiar
with a variety of procedures and methods that prevent
violations of privacy.
Confidentiality
Applied to research, confidentiality, like privacy, is a
complex, multifaceted issue. Privacy is an agreement between
the investigator and participant regarding disclosures of the
participant’s identifiable data and how that data will be
handled. Confidentiality involves informing the participant
about mandatory reporting requirements (e.g., reports of child
abuse), plans for sharing identifiable data with other
investigators or interested parties (e.g., FDA), and the extent
to which confidentiality can be protected by law,that is,
investigators could be subpoenaed to release identifiable data.
In addition, state law must be taken into account in describing
confidentiality protection. IRBs and investigators are expected
to be knowledgeable about applicable state laws involving
privacy and confidentiality, which vary in their coverage of
types of data and disclosure requirements.21 Confidentiality also
involves informing participants about how the data will be
managed. Inherent in this disclosure is review by the IRB of
the actual procedures used to ensure protection of
confidentiality, which include those used in handling and
transmitting data, eliminating linkages of data and
identifiers, storing raw data (e.g., questionnaires, records,
abstract forms) and data sets, and planning for long-term
storage and use, including sharing the data with other
investigators.
Research procedures unrelated to data management but
generally related to research might compromise confidentiality.
For example, reimbursing participants by check or reporting
results back to participants could provide a link between the
research and the participants that would not otherwise exist.
In longitudinal studies, calling or mailing participants might
identify them with a research study. IRBs and investigators
should review all of the proposed research procedures for
possible compromises to confidentiality.
Making stronger legal protections available to all
investigators could enhance confidentiality protections. In
examining such options and designing such protections,
mandatory federal or state reporting requirements (e.g.,
mandatory child abuse disclosures) should be considered.
In addition to the federal statutes mentioned earlier,
another mechanism available to protect confidentiality is the
Certificate of Confidentiality. Under the Public Health Service
Act, DHHS agencies may issue Certificates of Confidentiality to
investigators authorizing them to withhold identifiable data
about research participants that may be summoned under federal,
state, or local civil, judicial, administrative, legislative,
or other proceedings. DHHS regards the certificate’s
protection as superceding state law, and some case law supports
this position.22 However, Certificates of Confidentiality do not
provide the same degree of protection as that provided under
CDC’s and the Department of Education’s National
Center for Educational Statistics Confidentiality Statutes,
because although certificates protect against compulsory
disclosures by the investigator, they do not prohibit
investigators from making disclosures unauthorized by the
participant.
In addition, certificates, which are specific to a research
study and not to an investigator or institution, are issued
sparingly and only when it is determined that the data are
sensitive and that issuance will increase study participation.
Stronger confidentiality protections are needed for all
research involving sensitive, identifiable data. At a minimum,
Certificates of Confidentiality should be issued on request to
investigators when it is determined that the research involves
sensitive, identifiable data and no other legal protections
apply. Much stronger protection of confidentiality would be
afforded if a mechanism such as a Certificate of
Confidentiality also prohibited investigators from making
unauthorized disclosures, however, such additional protection
should be imposed cautiously because it may entail serious
costs, as investigators would not be able to share data with
others without the participant’s permission. Like
privacy, confidentiality concerns vary by research type and
context, and no one set of procedures to protect
confidentiality can be developed that would cover all types of
research contexts. IRBs and investigators must tailor
confidentiality protections to the specific circumstances and
methods used in each specific research study. A recent
Institute of Medicine (IOM) report describes procedures
investigators can easily adopt to reduce the risks associated
with breaches of confidentiality (IOM 2000). This report
suggests that IRBs consider recommending or requiring such
procedures when appropriate and it encourages IRBs and
investigators to consider using strong confidentiality
protections to reduce some of the violations associated with
privacy. A clear, comprehensive definition of confidentiality
along with guidance for protecting confidentiality in various
types of research is needed. NBAC offers the following
definition of confidentiality: Confidentiality is the
protection of identifiable data through agreements between
participants and investigators about who may have access to the
data and how the data will be managed in order to control
access.
Recommendation 5.4:
Federal policy should be developed and mechanisms should be
provided to enable investigators and institutions to reduce
threats to privacy and breaches of confidentiality. The
feasibility of additional mechanisms should be examined to
strengthen confidentiality protections in research studies.
Back to Top
Summary
Once an IRB has determined that risks of a given protocol
are reasonable in relation to potential benefits, no person
should participate in that research without his or her
voluntary informed consent (or that of an appropriate
representative). However, for some studies that pose minimal
risk, it might be possible to waive this requirement. The
process of informed consent involves investigators making
appropriate disclosures about their research and participants
developing a good understanding of the information provided and
their choices regarding participation in a study. Participating
in the process of informed consent is one of the best ways
investigators can demonstrate their concern and respect for
those they wish to enroll in a study.
In this report, NBAC reinforces previous recommendations
from earlier reports by recommending that the process of
providing information and ensuring comprehension should be
emphasized, rather than the documentation of the decision to
give consent, and that both the information and the way it is
conveyed,while meeting full disclosure requirements,should be
tailored to meet the needs of the participants in a particular
research context. NBAC also recommends that documentation
requirements should be adapted for varying research settings
and that the criteria for deciding when informed consent is not
necessary should be clarified to better ensure that
participants are protected. Finally, because there are no clear
policies on protecting privacy interests and confidentiality in
the research context, the informed consent process alone is
sometimes insufficient for protecting the rights and welfare of
participants. Federal policy should be clarified and
strengthened in this area to assist investigators in ensuring
that the interests of participants are protected.
Back to Top
Footnotes