The IRB assesses whether there are adequate provisions to protect research subjects’ privacy and maintain confidentiality by evaluating the methods used to obtain information and whether the activities in the research constitute an invasion of privacy. The IRB protocol should include how investigators are getting access to subjects or subjects’ private, identifiable information and the subject’s expectations of privacy in the situation. Describe the setting for research consenting and subject intervention (e.g., physical comfort, privacy, convenience, travel required). Demonstrate consideration for subject’s ability (mental, physical, developmental), environment, educational level, geographical location, and social context (especially for children and other vulnerable populations. Assure that the investigators have appropriate authorization to access the subjects or the subjects’ information.
Confidentiality and anonymity are not the same (see datatypes). If anyone, including the investigator, can readily ascertain the identity of the subjects from the data, then the research is not anonymous and appropriate protections must be in place to minimize the likelihood that the information will be inappropriately divulged. The level of confidentiality protections should be commensurate with the potential of harm from inappropriate disclosure.
HSPP Standard Operating Procedures includes detailed guidance for Privacy and Confidentiality in Section 3.7.5. Other potential resources are HIPAA Personal Identifiers and Protected Health Information; Registries and Repositories; and Certificates of Confidentiality.