Confidentiality vs. Privacy

In order to approve research, the IRB must determine that very specific requirements are satisfied.
One important requirement is appropriate, adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

  • What’s the difference between privacy and confidentiality?




    Confidentiality pertains to data.

    Confidentiality means making sure others don’t have more access to information about you than you want them to have.

    Privacy pertains to people.

    Privacy means making sure others don’t have more access to you than you want them to have.



  • Methods for maintaining CONFIDENTIALITY in research
    • Provide accurate information in the consent process about who will have access to the records. 
    • If appropriate, substitute codes for identifiers and keep the key code in a secure, separate location. For example, a participant number or some other type of code could be used instead of using identifiers such as names or social security numbers. 
    • Keep data in locked files.
    • Ensure that all involved staff know the importance of confidentiality. 
    • Ensure that any electronic storage is secure. 
    • When planning the research study, consider using collection or analysis procedures that provide anonymity. 
    • Prevent the possibility of deductive identification by using broader categories or other data presentation methods. Be careful that it is not possible to make someone identifiable by the information you ask. For example, if race, gender, and age are asked in a small group, some members would be identifiable even if no names were collected. To prevent this, use broader categories (i.e., age ranges rather than birthdate) or ask fewer questions. 
  • Methods for maintaining PRIVACY in research
    • Ensure that the informed consent provides potential participants adequate information about what they will be asked and what they may experience.
    • Consider the ages of participants. Expectations of privacy vary with age. For example, a young child will want the presence of his/her parents. A teenager would be embarrassed to be asked personal questions in the presence of his/her parents.
    • Consider a participant’s culture and its impact on their expectations of privacy. Community consultations, focus groups, etc. may provide insight into cultural perspectives.
    • Include ways to protect privacy in a participant’s environment. For example, provide a private environment for a participant to read the informed consent.
    • Explain the study to a participant in a private setting.
    • Provide a private setting for a participant to complete study related procedures.

Remember, the IRB cannot approve a study unless there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

Sources: 45 CFR 46.111, Sieber J., Procedures to Protect Privacy and Maintain Confidentiality, California State University