Confidentiality vs. Privacy

Privacy and confidentiality

Privacy and confidentiality are fundamental considerations in the ethical conduct of human subjects research. Investigators are responsible for identifying potential risks to participants’ privacy and for implementing appropriate safeguards to protect the confidentiality and security of information collected, accessed, or used for research. The level of protection should be proportionate to the sensitivity of the information, the identifiability of the data, the nature of the research activities, and the potential consequences of unauthorized access or disclosure. This guidance is intended to assist investigators in assessing privacy and confidentiality risks and developing appropriate safeguards throughout the research lifecycle, from data collection and storage through analysis, sharing, and destruction.

• What’s the difference between privacy and confidentiality?

   

  Confidentiality pertains to data.

  Confidentiality means making sure others don’t have more access to information about you than you want them to have.

  Privacy pertains to people.

  Privacy means making sure others don’t have more access to you than you want them to have.

   

• Methods for maintaining CONFIDENTIALITY in research

  • Provide accurate information in the consent process about who will have access to the records. 
  • If appropriate, substitute codes for identifiers and keep the key code in a secure, separate location. For example, a participant number or some other type of code could be used instead of using identifiers such as names or social security numbers. 
  • Keep data in locked files.
  • Ensure that all involved staff know the importance of confidentiality. 
  • Ensure that any electronic storage is secure. 
  • When planning the research study, consider using collection or analysis procedures that provide anonymity. 
  • Prevent the possibility of deductive identification by using broader categories or other data presentation methods. Be careful that it is not possible to make someone identifiable by the information you ask. For example, if race, gender, and age are asked in a small group, some members would be identifiable even if no names were collected. To prevent this, use broader categories (i.e., age ranges rather than birthdate) or ask fewer questions. 
• Methods for maintaining PRIVACY in research

  • Ensure that the informed consent provides potential participants adequate information about what they will be asked and what they may experience.
  • Consider the ages of participants. Expectations of privacy vary with age. For example, a young child will want the presence of his/her parents. A teenager would be embarrassed to be asked personal questions in the presence of his/her parents.
  • Consider a participant’s culture and its impact on their expectations of privacy. Community consultations, focus groups, etc. may provide insight into cultural perspectives.
  • Include ways to protect privacy in a participant’s environment. For example, provide a private environment for a participant to read the informed consent.
  • Explain the study to a participant in a private setting.
  • Provide a private setting for a participant to complete study related procedures.

Confidentiality & Data Security

For research studies that do not involve highly sensitive information or the collection of identifiable data, the IRB generally accepts compliance with East Tennessee State University’s (ETSU) institutional policies on data storage, security, and backup as sufficient to meet confidentiality requirements. Researchers are expected to follow university-approved practices for securing electronic and physical data, including the use of password-protected devices, secure servers, and appropriate data backup procedures. Studies involving sensitive topics, vulnerable populations, or identifiable information may require additional confidentiality safeguards, which will be assessed on a case-by-case basis during IRB review.

Remember, the IRB cannot approve a study unless there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

Sources: 45 CFR 46.111, Sieber J., Procedures to Protect Privacy and Maintain Confidentiality, California State University