Human Research Protection Program: Policy

Protecting Research Participants’ Privacy Interests and Confidentiality of Data

 

Adopted By: All Campus IRB

Adoption Date: November 10, 2005

Purpose:  This document describes how the UW-Madison IRBs evaluate proposed arrangements for protecting participants’ privacy interests and confidentiality of research data.

Definitions

I.      Privacy refers to a person’s desire to control the access of others to him or herself. For example, research participants may not want to be seen entering a place that might stigmatize them, such as a pregnancy counseling center that is clearly identified as such by signs on the front of the building.

II.     Confidentiality refers to the researcher’s agreement with the participant about how the research participant’s identifiable private information will be handled, managed, and disseminated.

III.    Anonymity means that no one, not even the investigator, has any information that can be used to connect information in a data set with a particular individual. Anonymity is a very high standard of information security.

Policy

I.      For research to be approved by UW-Madison IRBs, the protocol must include, when appropriate, adequate provisions to protect the privacy interests of research participants and the confidentiality of research data. See, 45 CFR 46.111(a)(7); 21 CFR 56.111(a)(7); see, also, Applicable Wisconsin Law.

II.     If a protocol involves the use of Protected Health Information (PHI), UW-Madison IRBs must assure that the protocol satisfies the requirements of the HIPAA Privacy Rule, including any waiver or alteration of HIPAA authorization. [45 CFR Parts 160 and 164]

III.    It is the policy of UW-Madison's IRBs that if the research involves the use of image or audio recording of participants, the consent form should clearly state that fact and should include the following additional information:

A.  how the recordings will be used

B.  how long they will be kept

C.  who will see/hear the recording

D.  where the recording will be used (e.g., in a classroom, professional meeting).

E.  For protocols reviewed by the SBS IRB, if the investigator wants permission for the recording to be viewed or heard by anyone other than the research staff, or, if it involves sensitive material, participants should also be given an opportunity to view, or listen to, the recording after it is completed, and permission for the tape to be used should then be obtained.

Procedure

I.      Submission of Information

A.  Social and Behavior Sciences IRB and Education Research IRB:  In the Initial Review Application and consent form, investigators are asked to provide the following information:

 

1.  Whether the research involves vulnerable populations, illegal or stigmatizing behaviors, image or audio recordings, targets a gender, racial or ethnic group or takes place in another country

 

2.  The role of participants, including what they will be asked to do, for how long, where, and whether deception will occur.  Will psychological tests be required?

 

3.  Explanation of if and how confidentiality of data will be maintained.

 

4.  If the research study involves collections of images or audio recordings of subjects, explanation of how the material will be used, who will see the images or hear the recordings, and in what setting and how long the recordings will be maintained.

 

5.  An assessment of the types and level of each type of risk involved in the research, including any social, psychological, legal, and economic or employment risks and risks to participants’ privacy interests and confidentiality of data.

 

6.  Where the research will take place, i.e., in the investigator's lab, in the participant's home, or at some other location

 

7.  Whether the results will be published and whether participants’ names or quotes will be used.

B.  Health Sciences IRB and Health Science Minimal Risk IRB:  In the Initial Review Application, consent form, data collection form and case report forms, investigators are asked to provide the following information:

 

1.  Whether the research involves vulnerable populations, illegal or stigmatizing behaviors, image or audio recordings, targets a gender, racial or ethnic group or takes place in another country.

 

2.  The type of information elicited from participants and whether the questionnaires ask sensitive questions (e.g. illegal behaviors, HIV/STD history, alcohol abuse)

 

3.  Whether the study will:

 

a.  store blood or tissue samples beyond publication of the study results for future studies or a different research purpose in the future

b.  use an existing depository or collection of blood or tissue samples

c.  do testing for genetic markers on blood or tissue samples

d.  involve identifiable blood or tissue samples

 

4.  An assessment of the types and level of each type of risk involved in the research, including the risks to participants’ privacy interests and confidentiality of data.

 

5.  Who is collecting the data and/or accessing medical records and who is keeping the data and where it will be kept. 

 

6.  Where the research will be conducted.

 

7.  How research data will be kept confidential - whether the data will be coded, whether it will be kept in a locked cabinet or on secure server, or whether identifiers will be stripped from the data.

 

8.  Whether the HIPAA Privacy Rule applies to the research and whether the standards outlines in the Rule are satisfied.

 

9.  If the research study involves collections of images or audio recordings of subjects, explanation of how the material will be used, who will see the images or hear the recordings, and in what setting and how long the recordings will be maintained.

II.     Evaluating Protections of Participants’ Privacy Interests and Confidentiality of Data

A.  The IRB may consider the following when determining whether a protocol should include provisions for protecting participants’ privacy interests and/or confidentiality of data:

 

1.  An assessment of the risk/benefit ratio of the research in regards to privacy and confidentiality issues: whether the risks of breach of participants’ privacy interests and confidentiality of data are commensurate with the benefits to participants and the risks of everyday life and whether measures for mitigating those risks are necessary for approval of the research

 

2.  Location of the data collection

 

3.  The sensitivity of the data being collected

 

4.  Whether the research involves:

 

a.       Vulnerable populations, such as prisoners, institutionalized individuals, abused spouses or children

b.       Illegal or stigmatizing behaviors

c.       Stigmatizing medical conditions

d.       Genetic markers that serve as potential predictors of disease

e.       Participants in another country whose political or cultural climate raises unique risks for participants.

f.         Image or audio recordings involving sensitive information.

g.       Other sensitive personal information about participants

 

5.  Whether the research is truly anonymous, i.e., no identifiers are recorded when a survey or interview is conducted

 

6.  Whether measures can be taken to separate direct from indirect identifiers when anonymity is not possible

 

7.  In some instances, the IRB may find it unnecessary or impracticable to require provisions to protect participants’ privacy interests or confidentiality of data:

 

a.       When the sample size is so small that it is virtually impossible to assure confidentiality of data and privacy interests of participants regardless of measures to minimize risks. In this case, the IRB would ensure that the risks of participation were clearly articulated to potential participants.

 

b.       When the nature of the research calls for publication of the identity of and the information obtained from participants, such as in oral history or social anthropological studies.

B. When the IRB determines that provisions to protect participants’ privacy interests and/or confidentiality of data are necessary, the IRB may consider the following when evaluating whether the provisions are adequate:

 

1.  The characteristics of the vulnerable population involved

 

2.  Whether interaction or intervention with participants will occur in a location offering adequate privacy and that is not stigmatizing or dangerous for participants

 

3.  Whether those collecting data and interviewing participants have the appropriate training and valid access to data being collected

 

4.  The sensitivity of the data being collected

 

5.  Where and how the data will be collected and analyzed

 

6.  Where and how data will be stored and how long and in what form will it be maintained

 

a.  Paper or electronic storage

 

b.  Locked room

 

c.  Secure server

 

7.  Whether and how the data will be coded and who will have access to codes or master list and how long the master list will be maintained

 

8.  Who will have access to the data

 

9.  Whether a certificate of confidentiality has been or should be obtained (See, Certificate of Confidentiality Guidance)

 

10. Whether a participant may be indirectly identified because of small sample size

 

11. Whether all information proposed to be collected is necessary for conduct of research (“Minimal Necessary Information”)

 

12. Whether participants are adequately informed of the risks of breach of privacy interests and confidentiality of data posed by the research and of the protections put in place to mitigate those risks.