Certificates of Confidentiality and Everyday Confidentiality at the Site

Part of Human Subjects Protection for Clinical Research Staff: Privacy and Confidentiality.

About 5 minutes. Free, in your language, no account needed.

Why this matters

HIPAA covers one slice of confidentiality. A research site also protects participants through consent language, secure handling and, for some studies, a certificate of confidentiality. Most confidentiality failures at sites are not legal fights. They are ordinary lapses: a laptop left in a car, a file left on a desk, a promise in a consent form that no one kept.

ICH E6(R3) sets the international baseline: confidentiality is protected according to applicable privacy and data protection requirements. The certificates of confidentiality, HIPAA and the US rules here are US law, taught as the worked example. HIPAA applies to covered entities and business associates, so ask your privacy officer whether it governs your site. Outside the United States, your national privacy law applies.

What the IRB and the consent form must address

The Common Rule requires the IRB, when appropriate, to find adequate provisions to protect privacy and maintain confidentiality of data (45 CFR 46.111(a)(7)). FDA's IRB rule has the same finding (21 CFR 56.111(a)(7)). The consent must state the extent to which confidentiality will be maintained (46.116(b)(5), 21 CFR 50.25(a)(5)), and the FDA version adds that FDA may inspect records.

ICH E6(R3) says confidentiality of information that could identify participants should be protected according to applicable privacy and data protection requirements (Principle 1.6). Participants are told that records identifying them will be kept confidential, and that monitors, auditors, regulators and IRBs/IECs may have direct access to source records (section 2.8.10(o), (p)).

So the promise made to participants is not "no one will ever see your records." It is a statement of how far confidentiality extends, including the people who may review the records for oversight. Never improvise a stronger promise at the bedside.

Certificates of confidentiality

In the United States, the statute 42 U.S.C. 241(d) says that researchers whose research collects identifiable, sensitive information shall receive a certificate when the research is federally funded in whole or in part. Privately funded researchers may apply. A certificate holder may not disclose identifiable information, documents or biospecimens to anyone not connected with the research, including in any federal, state or local civil, criminal, administrative, legislative or other proceeding.

Exceptions are listed. They include disclosure required by federal, state or local law (but not in legal proceedings), disclosure with the subject's consent, disclosure necessary for the subject's medical treatment with consent, and disclosure for other research that complies with federal human subjects rules. In a legal proceeding such as a subpoena, the only exception is the subject's consent.

NIH says that since 2017, NIH-funded research that meets specific criteria is automatically deemed to have a certificate (policy notice NOT-OD-17-109, September 7, 2017). Responsibilities include informing participants about the certificate and not releasing identifiable sensitive information except in limited circumstances. NIH continues to consider requests for non-NIH-funded research within the NIH mission.

For you, the practical points are these. Check the protocol and consent to see whether a certificate applies. If it does, the consent language about it is part of what you explain. A certificate is not a promise that nothing can ever be disclosed, because the exceptions exist.

Confidentiality at the site every day

Confidentiality is mostly habit. Good habits (CRLN practice advice, not a legal requirement) include keeping source documents and consent forms in locked storage, not leaving screens open in shared areas, not discussing participants where others can overhear, and asking before you copy or send anything, "Does the person receiving this need the identity?"

In practice

A coordinator is packing a binder for a monitoring visit. A paper log shows full names next to study IDs. Participants were told in consent that monitors may have direct access to source records, but the coordinator does not stretch that to cover anyone who asks. She checks with the investigator about what the monitor's role needs and covers anything beyond it.

What this looks like when it goes wrong

A study nurse leaves a laptop with an unencrypted spreadsheet of participants' sensitive information in her car. It is stolen. OHRP's 2007 guidance names this kind of event, sensitive identifiable data on an unencrypted laptop stolen from a car, as an example of an unanticipated problem that is not an adverse event. No participant was physically harmed. The risk is a breach of confidentiality. The nurse tells the investigator at once, and the site follows its IRB's written procedures. Module 7 explains reporting.

Key takeaways