Author / Contributor
image for National Bioethics Advisory Commission
National Bioethics Advisory Commission More Posts
Report on Ethical and Policy Issues in Research Involving Human Participants Volume I - Report and Recommendations



Authoring Institution National Bioethics Advisory Commission
Share with EEL Yes
Authoring Institution (obsolete) National Bioethics Advisory Commission
Rights For more information on permissions to use this material please see:
Year 2001

Search this Publication

Table of Contents

Chapter 5: Ensuring Voluntary Informed Consent and Protecting Privacy and Confidentiality (Research Involving Human Participants V1)


Two analyses that are central to the ethical review conducted by Institutional Review Boards (IRBs) are an appraisal of the informed consent process to be used in a proposed research study and a determination of the extent to which the privacy and confidentiality of the potential participants will be protected. The current regulatory requirements relating to these ethical issues reflect the concept of respect for persons, as espoused in the Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research (Belmont Report)

(National Commission 1979). Informed consent becomes an essential protection, however, only after research has been determined to be ethically justifiable in terms of beneficence and justice. Adherence to these principles in the review of research serves a gatekeeper function, permitting only ethically acceptable research involving human participants to proceed.1

Back to Top

The principle of respect for persons requires that 1) individuals are treated as autonomous agents and 2) that persons with diminished autonomy are protected (National Commission 1979). (This report addresses informed consent only in the context of research involving competent adults.) An autonomous agent is ‘an individual capable of deliberation about personal goals and of acting under the direction of such deliberation’ (National Commission 1979, 5). Respect for persons requires that prospective research participants ‘be given the opportunity to choose what shall or shall not happen to them’ and thus necessitates adequate standards for informed consent (National Commission 1979, 10). As Vanderpool notes, the Belmont Report’s insistence on informed consent ‘accords with the fundamental moral values of a free and democratic society.’2 The informed consent process involves three elements: 1) disclosing information to potential research participants, 2) ascertaining that they understand what has been disclosed, and 3) ensuring their voluntariness in agreeing to participate in research (Faden and Beauchamp 1986). The disclosure of information should be sufficient ‘such that persons can decide whether they wish to participate in the furthering of knowledge’ (National Commission 1979, 11). Even when some direct benefit to participants may be anticipated, this high standard for disclosure should be met, because research inherently involves uncertainty and is always designed to acquire knowledge. To ensure comprehension, the presentation of information must be adapted to the potential participant’s capacities and characteristics, and great care must be taken to ascertain that the prospective participant understands the information. Extra efforts may be warranted to verify comprehension when risks are especially high or there is uncertainty whether the prospective participants are capable of understanding the risks. For consent to be voluntarily given, the process must be free of coercion and undue influence.

In previous reports, NBAC has focused much of its attention on addressing specific issues related to informed consent that arise from the interpretation of existing regulations. (See Exhibit 5.1.) This chapter looks beyond current regulations to focus on the overall scope and structure of the requirements for informed consent and focuses specifically on four issues:

  1. emphasis on disclosure;
  2. appropriateness of informed consent processes for different types of research;
  3. waiver of the informed consent process; and
  4. documentation of the informed consent process.

Deficiencies with the Current Regulations

Federal regulations permit IRBs to approve research when informed consent is sought and documented from each prospective participant (45 CFR 46.111(a)(4)-(5); 21 CFR 56.111(a)(4)-(5)). Requirements for informed consent are further described in two sets of federal regulations in 45 CFR 46.116 and 45 CFR 46.117, and 21 CFR 50.20, 50.25, 50.27 and 56.109. There are substantial differences between the two sets of requirements; the most notable being that the FDA regulations do not contain the criteria for waiver or alteration of informed consent as described in 45 CFR 46.116(d). The current regulatory system specifies eight basic elements of information disclosure that must be provided to prospective participants during the informed consent process, except in cases of an approved waiver or alteration of the consent process by the IRB. (See Exhibit 5.2.) Also specified are six additional elements of disclosure that must be included when appropriate (46 CFR 46.116(b); 21 CFR 50.25(b)). The regulations for documentation require that, except in specified circumstances, ‘informed consent shall be documented by the use of a written consent form approved by the IRB and signed by the subject or the subject’s legally authorized representative’ (45 CFR 46.117(a); 21 CFR 50.27(a) [FDA regulations differ in requiring that the form be dated at the time the consent form is signed]).

Emphasis on Disclosure

Although the regulations pertaining to informed consent (45 CFR 46.116; 21 CFR 50.20) begin with a paragraph from the Belmont Report related to the ‘three elements’ of consent,information, comprehension, and voluntariness,the actual procedures emphasize disclosure requirements, and in so doing may distort the understanding of the ethical principle of respect for persons.3 Especially in the context of requirements that informed consent be documented using signed, written forms, this exclusive emphasis on information leads investigators and IRBs to equate informed consent with the information provided in a consent form and to focus mostly on disclosures to participants.4 Thus, these regulations fail to emphasize the informed consent process and to attend to the importance of comprehension and voluntariness, a failure the implications of which have been described in previous NBAC reports (NBAC 1998; NBAC 2001). Moreover, others have noted that the particular emphasis on disclosure in informed consent is a product of legal and regulatory thinking that equates informed consent solely with the requirements to disclose information (Beauchamp and Childress 1994, 145). This emphasis is not, however, fully conducive to the more comprehensive view of informed consent, which emphasizes the aspects of understanding, capacity to consent, voluntariness, and features of decisionmaking, including who may authorize consent (Beauchamp and Childress 1994; Faden and Beauchamp 1986).

Empirical evidence suggests that these regulatory shortcomings all too frequently result in failures to achieve voluntary informed consent (Verheggen et al. 1996; Waggoner and Mayo 1995). For example, a study by the Advisory Committee on Human Radiation Experiments (ACHRE) reviewed materials submitted to and approved by IRBs from a sample of federally funded studies. Generally, consent forms were difficult to understand, requiring an advanced reading level and including technical language and overwhelming level of detail (ACHRE 1995, 707). Difficulty in understanding consent forms has been reported in many research studies (Blenkinsop 1997; Hochhauser 1997; Waggoner and Mayo 1995; Young et al. 1990). Indeed, another study by ACHRE found that at least some individuals failed even to understand whether they had participated in research at all. At least 5 percent of patients who reported they were not research subjects actually were, and at least 6 percent of patients who reported they were in research actually were not (ACHRE 1995, 736). In general, these studies reveal the deficiencies in the standard practice of seeking informed consent. Anecdotal evidence in support of these findings was provided at each of the five town meetings held by NBAC. For example, IRBs are concerned that there is too much emphasis on consent forms, that forms are too long and written at a reading level that is too advanced, and most important, that participants often do not understand to what they are giving their consent.5 Rather than focusing on the ethical standard of informed consent and what that entails for the process of obtaining informed consent, IRBs and investigators have followed the lead of the regulations and tended to focus on disclosures found in the consent form. However, from an ethics perspective, the informed consent process is the critical communication link between the prospective participant and the investigator, beginning with the initial approach of the investigator to the participant (e.g., via a flyer, brochure, or any advertisement regarding the research study) and continuing until the end of the project. It should be an active process of sharing information by both parties throughout which the participant at any time is able to freely decide whether to withdraw or continue participating in the research. The consent form, if there is one, is intended only to document the interaction between the participant and the investigator, and it is only one part of the informed consent process. It is time to emphasize the process of informed consent, with the goals of ensuring that information is fully disclosed, that competent participants fully understand the research so that they can make informed choices, and that their decisions whether to participate are always made voluntarily.

Informed Consent Processes Appropriate for Various Research Settings

Although placing greater emphasis on the informed consent process is crucial, it is also important to tailor the process to suit the type of research being proposed and the interests and situations of the potential participants. The eight basic elements of disclosure specified in 45 CFR 46.116(a) and 21 CFR 50.25(a) are appropriate for clinical research, but some of them are inappropriate to the point of being nonsensical for other types of research, especially behavioral and social science or historical research. For example, the basic element requiring ‘a disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject’ (45 CFR 46.116(a)(4); 21 CFR 50.25(a)(4)) makes little sense for research studies involving no interventions. Because of this requirement, forms often contain illogical statements that can confuse participants. Some IRBs and the Office for Human Research Protections (OHRP) require a statement in the consent form, for example, that the advantageous alternative procedure or treatment is to not participate in the research. Similarly, including a statement that refusal to participate will involve no penalty or loss of benefits (45 CFR 46.116(a)(8); 21 CFR 5025(a)(8)) raises concerns in some survey research in which there are no benefits to be lost; in such cases, participants may become unduly alarmed (McQuillan et al. 2000).

Although any of these basic elements of consent can be altered or waived, the current criteria for doing so are often difficult to meet. One of the criteria for alteration or waiver is that the research could not practicably be carried out without the waiver or alteration (45 CFR 46.116(d)(3)). Because IRBs often interpret ‘could not practicably be carried out’ to mean impossible to carry out, they require the element of disclosure to be included, often in a less than meaningful way (NBAC 1999b). In other cases, investigators and IRBs spend much time documenting alteration or waiver justifications in order to meet the stringent standards set in the criteria, even though those criteria are not relevant within the context of the research.

Moreover, when considering what information should be provided to prospective participants, IRBs and investigators should strive to ascertain what would be important to the prospective participants from the participants’ perspectives. For example, before initiating research on genetic screening for breast cancer, investigators held focus groups with prospective participants to ask them what they were interested in knowing about the proposed research. Rather than being solely interested in the type of information required under the regulations for disclosure, prospective participants were interested in knowing about options to reduce the risk of developing cancer, the cost of testing, and insurance coverage for the test. This information would not have been included in the informed consent process without input from prospective participants (Bernhardt et al. 1997). Moreover, this information was as relevant to their decisionmaking as the information required under the regulations. Elsewhere, NBAC has recommended that prospective participants can provide valuable input into the type of information other prospective participants might want to learn by involving them in the design of studies and the informed consent process (NBAC 1998; NBAC 1999b; NBAC 2001).

One specific type of research worthy of mention is deception research. Methods related to deception are sometimes the only valid ones for addressing an issue or question (e.g., study of prejudice). There has been longstanding debate among psychologists and ethicists about the merits of this research (Nicks et al. 1997). In all imaginable cases, deception research involves interaction with participants and thus the opportunity for an informed consent process. In all cases, the informed consent process must be tailored so that the research study can be carried out. Participants cannot be told the true purpose of the research until after the study is over, or participants can be told some, but not all, purposes of the research until the end of the study. When IRBs approve research studies that involve deception, an informed consent process should be designed that is appropriate to the purpose of the study and that provides adequate protection for the participants. For example, in a study designed to determine whether the stereotypical belief that women are not as proficient as men in mathematics adversely affects women’s test scores, two groups of participants were asked to take the same math test, but were given opposite information about whether the test had been shown to produce gender differences. Some or all of this information was false. The study was not intended to reveal whether the test itself produced gender differences in test scores, but rather whether the threat of stereotyping led to gender difference in test scores. Participants were told the true purpose of the study when the study was completed (Spencer et al. 1999).

Although it is tempting to require a set of basic elements of disclosure to be used during the informed consent process, it is unlikely that any single set of basic elements can be applied feasibly and credibly to all types of research. Whether an investigator has included the eight basic elements of disclosure is often open to interpretation. Further guidance is needed not only to describe required elements for different types of research, but also to describe procedures for ascertaining what information should be included in a particular research study.

In certain circumstances, monitoring the informed consent process could increase participant protection, and monitoring procedures could be used to measure participants’ understanding of the nature of the research and the risks involved. Such circumstances might include research involving significant risk, research enrolling participants who might have difficulty in understanding the risks associated with the study, or research for which the IRB is concerned about whether the informed consent is being carried out according to the stipulations in the approved protocol. In these cases, IRBs should require some type of monitoring of the informed consent process, although it need not perform the monitoring itself. These mechanisms could be either temporary, lasting until the concerns of the IRB are satisfied, or permanent, for the duration of the research study.

Prospective Participants Who Cannot Give Voluntary Informed Consent

The discussion thus far has focused on obtaining informed consent from competent adults.6 When individuals who do not have the capacity or who have lost the capacity to provide voluntary informed consent are enrolled in research, other mechanisms must be used to satisfy the ethical requirement of informed consent. A previous NBAC report has addressed this issue with respect to research involving individuals who have a mental disorder that may affect decisionmaking capacity (NBAC 1998). Other situations in which adults are unable to give voluntary informed consent also should be examined.

Recommendation 5.1:

Federal policy should emphasize the process of informed consent rather than the form of its documentation and should ensure that competent participants have given their voluntary informed consent. Guidance should be issued about how to provide appropriate information to prospective research participants, how to promote prospective participants’ comprehension of such information, and how to ensure that participants continue to make informed and voluntary decisions throughout their involvement in the research.

Waiver of Informed Consent

Although NBAC supports the ethical standard of informed consent in research, circumstances arise in which the requirement of seeking informed consent from competent participants may be waived (NBAC 1998; NBAC 1999a; NBAC 1999b; NBAC 2001).7 One circumstance involves the use of existing identifiable data. As noted in an earlier NBAC report on research involving the use of human biological materials, when the study offers the potential to gain important knowledge, poses little or no risk to participants, and consent would be difficult or impossible to obtain, it is appropriate to waive the informed consent requirement (NBAC 1999b).

The current federal regulations stipulate four criteria that must all be met to waive informed consent:

  1. The research involves no more than minimal risk to the participants.
  2. The waiver will not adversely affect the rights and welfare of the participants.
  3. The research could not practicably be carried out without the waiver.
  4. Whenever appropriate, the participants will be provided with additional pertinent information after participating (45 CFR 46.116(d); 21 CFR 50.23, 50.24) [FDA regulations only provide for waiver of informed consent in limited emergency situations]).

At the time these requirements were written, one set of criteria was wanted that would address waivers and alterations for both biomedical and behavioral research. Although the third and fourth criteria appear to apply primarily to deception research (Dresser 1981) and are useful in an IRB’s deliberation about altering the informed consent process in deception research, they are not readily applied to other types of research in which an alteration is requested or even when a waiver of the entire informed consent process is requested. As mentioned earlier, one of the most poorly understood terms by IRBs and investigators is practicably.8 Only in a few research studies would it be impossible to obtain informed consent; however, in many studies the financial cost and time required to obtain informed consent would be prohibitive and a potentially poor use of limited research resources.

Indeed, four recommendations in NBAC’s report on the use of human biological materials address the interpretation of these waiver criteria when conducting research with stored biological material (NBAC 1999b). These recommendations, displayed in Exhibit 5.3, were intended to add clarity to the regulations, not to change them.

As a matter of policy, two options are available. The first, which NBAC recommended in previous reports, is to specify the clarifications necessary to existing regulations for granting waivers (NBAC 1999b; NBAC 2001). The second is to revise the regulations, given a broader understanding of the ethical standards of informed consent. With this second approach, criteria for altering the consent process would no longer be needed if Recommendation 5.1 of this report were adopted. However, criteria for waiving the informed consent process altogether would still be required.

Waiver of the informed consent process is justifiable in research studies when there is no interaction between investigators and participants, such as in studies using existing identifiable data (e.g., studies of records). In a previous report, NBAC discussed risks associated with research involving the use of existing data (NBAC 1999b), noting that in such studies, risks will usually not be physical and instead are likely to arise from the acquisition, use, or dissemination of information from the research study and thus are likely to involve threats to privacy and breaches in confidentiality. As discussed in the following section, many steps can be taken to protect both privacy and confidentiality, and with such protections in place, IRBs may waive the requirement for informed consent. The criteria for waiving informed consent in such instances should be revised.

Recommendation 5.2:

Federal policy should permit Institutional Review Boards in certain, limited situations (e.g., some studies using existing identifiable data or some observational studies) to waive informed consent requirements if all of the following criteria are met:

  1. all components of the study involve minimal risk or any component involving more than minimal risk must also offer the prospect of direct benefit to participants;
  2. the waiver is not otherwise prohibited by state, federal, or international law;
  3. there is an adequate plan to protect the confidentiality of the data;
  4. there is an adequate plan for contacting participants with information derived from the research, should the need arise; and
  5. in analyzing risks and potential benefits, the Institutional Review Board specifically determines that the benefits from the knowledge to be gained from the research study outweigh any dignitary harm associated with not seeking informed consent.

The first criterion is intended to limit exposure to riskier research when informed consent is not obtained, except in circumstances in which a component involving more than minimal risk also offers the prospect of direct benefit. The second criterion is intended to protect participants’ rights existing under federal, state, or international statute. Protecting welfare is removed from the text of the criterion because welfare is protected through criterion a, c, or e in Recommendation 5.2. The third and fourth criteria are recommended on the assumption that strong confidentiality protections can reduce violations of privacy (see discussion below). The fifth criterion is recommended based on the discussion above regarding the justification of research through risk/potential benefit analysis. A criterion related to practicability is not included, because it would not add to the protection of participants if the other criteria are met.

Documentation of Informed Consent

A similar sort of flexibility is needed for the documentation of informed consent. Current regulations require, with limited exception, that informed consent be documented using a written consent form approved by the IRB and signed by the participant (45 CFR 46.117(a); 21 CFR 40.27(a), 56.109(c), (d)). As NBAC noted previously, this requirement could pose inappropriate barriers to conducting useful and ethically sound research that otherwise conforms to regulatory requirements related to informed consent (NBAC 2001), an observation that is made elsewhere as well (Singer 1978).9 A signed, written consent form may be problematic in at least two ways: it must be signed, and it is in writing. In some cultures, both in the United States and in other countries, requesting a signature raises issues of trust and might suggest inappropriate gravity regarding the research. In addition, a written form has little utility with illiterate populations. In certain types of research, such as survey research, signed, written consent forms are not considered part of the standard methodology. For example, telephone surveys (such as those used by telemarketers) and face-to-face interviews are often encountered as part of daily living, and individuals either freely participate or refuse, for example, by hanging up the telephone. For these reasons, NBAC has distinguished between the substantive ethical standard of informed consent and the procedures by which consent is obtained and has recommended that investigators should not deviate from the substantive ethical standards, although the procedures by which informed consent is obtained could vary if approved by the IRB (NBAC 2001).

Although the federal regulations may have been attempting to reflect a legal standard for documentation of informed consent, NBAC is aware of no case law in which a signed, written consent form is required.10 To fulfill the substantive ethical standard of informed consent, depending upon the sort of research being proposed, it may be more appropriate to use other forms of documentation, such as audiotape, videotape, witnesses, or telephone calls to participants to verify informed consent and participation in the research study.

Recommendation 5.3:

Federal policy should require investigators to document that they have obtained voluntary informed consent, but should be flexible with respect to the form of such documentation. Especially when individuals can easily refuse or discontinue participation, or when signed forms might threaten confidentiality, Institutional Review Boards should permit investigators to use other means of verifying that informed consent has been obtained.

Back to Top

Exhibit 5.1: Previous NBAC Recommendations Regarding Informed Consent

NBAC has addressed the issue of informed consent in four previous reports (NBAC 1998; NBAC 1999a; NBAC 1999b; NBAC 2001), and, because the topic is central to the protections offered to research participants, recommendations regarding informed consent have played a key role in each of these reports. NBAC, for example:

  1. fully supports the principle of voluntary informed consent as an essential safeguard to protect participants’ rights and welfare (NBAC 1998; NBAC 1999a; NBAC 1999b; NBAC 2001);
  2. has acknowledged that certain research contexts may require greater flexibility in procedures used to obtain consent, for example, where cultural or language differences exist (NBAC 1999b; NBAC 2001);
  3. recognizes the importance of appropriate limitations regarding the use of substitute or third-party consent (NBAC 1998);
  4. recommends that individuals be provided with certain options for providing informed consent regarding future research studies (NBAC 1998; NBAC 1999b);
  5. acknowledges that it is sometimes difficult to distinguish between research and treatment and has suggested that the distinction needs to be clear to participants (NBAC 1998; NBAC 1999b; NBAC 2001);
  6. recognizes the importance of limiting coercion or undue influence in obtaining voluntary informed consent (NBAC 1999b; NBAC 2001);
  7. recognizes that informed consent should be sought from donors who are contributing biological materials to research (NBAC 1999b); and
  8. emphasizes that informed consent is a process and not merely a form to be signed in a routine manner (NBAC 1998; NBAC 1999b; NBAC 2001).

Back to Top

Exhibit 5.2: Required Elements of Disclosure

  1. A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject’s participation, a description of the procedures to be followed, and identification of any procedures which are experimental.
  2. A description of any reasonably foreseeable risks or discomforts to the subject.
  3. A description of any benefits to the subject or to others which may reasonably be expected from the research.
  4. A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject.
  5. A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.
  6. For research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs, and, if so, what they consist of or where further information may be obtained.
  7. An explanation of whom to contact for answers to pertinent questions about research and research subjects’ rights, and whom to contact in the event of a research-related injury to the subject.
  8. A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled (45 CFR 46.116(a); 21 CFR 50.25(a) [FDA regulations differ in requiring an additional statement that FDA may inspect records]).

Back to Top

Exhibit 5.3: Previous NBAC Recommendations Regarding Waiver of Informed Consent

Recommendation 10:

IRBs should operate on the presumption that research on coded samples is of minimal risk to the human subject if the study adequately protects the confidentiality of personally identifiable information obtained in the course of research, the study does not involve the inappropriate release of information to third parties, and the study design incorporates an appropriate plan for whether and how to reveal findings to the sources or their physicians should the findings merit such disclosure.

Recommendation 11:

In determining whether a waiver of consent would adversely affect subjects’ rights and welfare, IRBs should be certain to consider whether the waiver would violate any state or federal statute or customary practice regarding entitlement to privacy or confidentiality, whether the study will examine traits commonly considered to have political, cultural, or economic significance to the study subjects, and whether the study’s results might adversely affect the welfare of the subject’s community.

Recommendation 12:

If research using existing coded or identified human biological materials is determined to present minimal risk, IRBs may presume that it would be impracticable to meet the consent requirement (45 CFR 46.116(d)(3)). This interpretation of the regulations applies only to the use of human biological materials collected before the adoption of the recommendations contained in this report (specifically Recommendations 6 through 9 regarding informed consent). Materials collected after that point must be obtained according to the recommended informed consent process and, therefore, IRBs should apply their usual standard for the practicability requirement.

Recommendation 13:

OPRR [now OHRP] should make clear to investigators and IRBs that the fourth criterion for waiver, that ‘whenever appropriate, the subjects will be provided with additional pertinent information after participation’ (45 CFR 46.116(d)(4)), usually does not apply to research using human biological materials.

Privacy and Confidentiality

All research, whether clinical, epidemiological, health services, or social science, involves issues related to protecting privacy and confidentiality. In fact, in some research the invasion of privacy or breaches in confidentiality are the only research-related risks to which participants might be exposed (e.g., some anthropological, psychological, and historical research studies; records review studies; and secondary analysis of existing data). Privacy and confidentiality, however, tend to be poorly understood concepts, often mistakenly used interchangeably, and either ignored or inappropriately handled by investigators and IRBs.11 Privacy refers to persons and to their interests in controlling access of others to themselves (Boruch and Cecil 1979). In the research context, privacy refers to how investigators collect or access identifiable data from participants. Protection of privacy naturally follows as an application of the ethical principle of respect for persons, because in respecting the personhood and autonomy of individuals, investigators must be sensitive in the ways in which they interact with participants who are deciding whether to reveal or withhold information. Americans value their privacy and are concerned about the circumstances under which they share information about themselves and, once shared, how the information will be handled (IOM 2000).

Confidentiality, on the other hand, refers to identifiable data and relates to agreements between the participant and the investigator about how the participant’s data will be handled and to whom it will be disclosed. It is an extension of the concept of privacy.12 Participants are concerned about unauthorized or inadvertent disclosures of their data, and although participants and the public are generally supportive of research, they often want to be assured that they are in control of access to their information and that potential breaches in confidentiality are minimized.13 Current federal regulations incompletely address privacy and confidentiality issues in research. IRBs may only approve a research study when the research study is judged to have adequate provisions to protect the privacy of participants and to maintain the confidentiality of data (45 CFR 46.111(a)(7); 21 CFR 56.111(a)(7)). Federal regulations do not provide any additional requirements, stipulate acceptable protection provisions, or define the terms.

Some federal departments have established additional protections relating to privacy and confidentiality that are applicable to research. The Department of Education complies with the Family Education Rights and Privacy Act of 1974, which is designed to protect student records from disclosure without consent from parents or students over 18 years of age. In addition, the Protection of Pupil Rights Amendment gives parents the right to consent for their children to participate in sensitive research. The Department of Justice provides additional regulatory protections for prisoners (28 CFR 512) that give prisoners control over their data, require at least one prisoner and a majority who are not prison personnel to be members of the IRB reviewing the research, and prohibit prison administrators from accessing research data.

Additional confidentiality protections are provided in the National Center for Educational Statistics Confidentiality Statute and the Public Health Service Act for the Centers for Disease Control and Prevention’s (CDC’s) assurance of confidentiality. These statutes limit the use of research data to those purposes for which the participants consent and prohibit the disclosure of identifiable data to anyone without the consent of participants.

The Health Insurance Portability and Accountability Act of 199614 required that legislation regarding standards for the privacy of individually identifiable health information be enacted by August 21, 1999, or DHHS would be required to issue regulations. Because Congress did not pass such legislation, on December 20, 2000, DHHS announced regulations entitled ‘Standards for Privacy of Individually Identifiable Health Information,’ which became effective April 14, 2001. Although these regulations provide some confidentiality protections for individually identifiable health information, their application in the research context is limited because the regulations apply only to health plans, health care clear-inghouses, and health care providers. The regulations outline conditions under which individually identifiable health information held by any of the three entities may be disclosed without the individual’s authorization to investigators. Such disclosures may be made if an IRB or ‘privacy board’ (as defined in the rule) approves a waiver of authorization based on certain criteria, if the information is sought solely for review preparatory to research, or if the research is on a decedent’s information. Notwithstanding these additional federal protections of privacy and confidentiality, there is little federal guidance for IRBs and investigators regarding the protection of privacy and confidentiality.


Respecting privacy involves more than seeking informed consent from participants to access their data. Obtaining informed consent serves a vital role in providing participants with control over whether they will allow investigators to have access to them and to data about them. Privacy is influenced by the culture and individual circumstances of participants, the nature and context of the research, and the particular social and political environment in which the research and use of the data will occur. Individuals have different views on what is considered private. For example, telling an investigator about one’s sexual practices is acceptable to some participants, but highly offensive to others. It may be even more difficult to respect a participant’s privacy when he or she is different from the investigator in terms of age, ethnicity, locale, socioeconomic status, or gender.15 Privacy refers to the ways and circumstances in which investigators access information about participants. Consent processes can protect the aspect of privacy that deals with seeking permission to access data, but other research procedures are needed to protect the aspect of privacy related to the circumstances surrounding the actual accessing of that data. Privacy can be respected by using procedures such as written questionnaires rather than face-to-face interviews, by using techniques in which responses are signaled on the telephone touch pad rather than verbally during telephone interviews, or by using private rooms for disrobing for clinical examinations. To respect privacy is to let participants control the access of others to themselves, to provide conditions in which the investigator’s inquiries are welcome, and to provide an opportunity for participants to decline or restrict access.16 To breach privacy is to violate participants’ space or to intrude where one is not welcome or not trusted. In fact, the mere act of contacting people about participating in a research study may be a violation of their privacy, particularly when the prospective participants are identified as having a stigmatizing condition (e.g., HIV/AIDS, drug addiction). Research in which management gives consent to conduct research on employees, or deception research, in which participants are led to behave in a way that they would not wish to be seen, are examples of invasions of privacy.17 Although there are few publicized cases of violations of privacy, the invasion of privacy may cause any of the following harms: psychological (e.g., worry, irritation, fear, embarrassment, self-doubt), legal (e.g., arrest), social (e.g., stigmatization), or economic (e.g., blackmail or unemployment).18 Because privacy concerns vary by type and by context of research, as well as by the culture and individual circumstances of participants, investigators should be well informed and mindful of participants’ cultural norms. Investigators also need to be aware of the various research procedures and methods that can be used to respect privacy. In addition, a clear, comprehensive regulatory definition of privacy along with guidance for protecting privacy in various types of research is needed.19 NBAC proposes the following as a regulatory definition of privacy: Privacy interests are persons’ interests in controlling access of others to themselves and to information about them. Privacy and confidentiality have long been concerns of social scientists and oral historians, and many professional societies for these disciplines have developed ethics codes and guidance describing specific privacy and confidentiality issues and protections for their disciplines (e.g., psychology, anthropology, and oral history).20 In developing new guidance, policymakers should consult existing codes and guidance.

Guidance can be instrumental in helping investigators and IRBs raise concerns and issues about privacy, however it cannot be expected to provide all of the solutions. It is incumbent on investigators and IRBs, therefore, to tailor research procedures to protect privacy as appropriate for each research study. In addition, IRBs and investigators must be familiar with a variety of procedures and methods that prevent violations of privacy.


Applied to research, confidentiality, like privacy, is a complex, multifaceted issue. Privacy is an agreement between the investigator and participant regarding disclosures of the participant’s identifiable data and how that data will be handled. Confidentiality involves informing the participant about mandatory reporting requirements (e.g., reports of child abuse), plans for sharing identifiable data with other investigators or interested parties (e.g., FDA), and the extent to which confidentiality can be protected by law,that is, investigators could be subpoenaed to release identifiable data. In addition, state law must be taken into account in describing confidentiality protection. IRBs and investigators are expected to be knowledgeable about applicable state laws involving privacy and confidentiality, which vary in their coverage of types of data and disclosure requirements.21 Confidentiality also involves informing participants about how the data will be managed. Inherent in this disclosure is review by the IRB of the actual procedures used to ensure protection of confidentiality, which include those used in handling and transmitting data, eliminating linkages of data and identifiers, storing raw data (e.g., questionnaires, records, abstract forms) and data sets, and planning for long-term storage and use, including sharing the data with other investigators.

Research procedures unrelated to data management but generally related to research might compromise confidentiality. For example, reimbursing participants by check or reporting results back to participants could provide a link between the research and the participants that would not otherwise exist. In longitudinal studies, calling or mailing participants might identify them with a research study. IRBs and investigators should review all of the proposed research procedures for possible compromises to confidentiality.

Making stronger legal protections available to all investigators could enhance confidentiality protections. In examining such options and designing such protections, mandatory federal or state reporting requirements (e.g., mandatory child abuse disclosures) should be considered.

In addition to the federal statutes mentioned earlier, another mechanism available to protect confidentiality is the Certificate of Confidentiality. Under the Public Health Service Act, DHHS agencies may issue Certificates of Confidentiality to investigators authorizing them to withhold identifiable data about research participants that may be summoned under federal, state, or local civil, judicial, administrative, legislative, or other proceedings. DHHS regards the certificate’s protection as superceding state law, and some case law supports this position.22 However, Certificates of Confidentiality do not provide the same degree of protection as that provided under CDC’s and the Department of Education’s National Center for Educational Statistics Confidentiality Statutes, because although certificates protect against compulsory disclosures by the investigator, they do not prohibit investigators from making disclosures unauthorized by the participant.

In addition, certificates, which are specific to a research study and not to an investigator or institution, are issued sparingly and only when it is determined that the data are sensitive and that issuance will increase study participation. Stronger confidentiality protections are needed for all research involving sensitive, identifiable data. At a minimum, Certificates of Confidentiality should be issued on request to investigators when it is determined that the research involves sensitive, identifiable data and no other legal protections apply. Much stronger protection of confidentiality would be afforded if a mechanism such as a Certificate of Confidentiality also prohibited investigators from making unauthorized disclosures, however, such additional protection should be imposed cautiously because it may entail serious costs, as investigators would not be able to share data with others without the participant’s permission. Like privacy, confidentiality concerns vary by research type and context, and no one set of procedures to protect confidentiality can be developed that would cover all types of research contexts. IRBs and investigators must tailor confidentiality protections to the specific circumstances and methods used in each specific research study. A recent Institute of Medicine (IOM) report describes procedures investigators can easily adopt to reduce the risks associated with breaches of confidentiality (IOM 2000). This report suggests that IRBs consider recommending or requiring such procedures when appropriate and it encourages IRBs and investigators to consider using strong confidentiality protections to reduce some of the violations associated with privacy. A clear, comprehensive definition of confidentiality along with guidance for protecting confidentiality in various types of research is needed. NBAC offers the following definition of confidentiality: Confidentiality is the protection of identifiable data through agreements between participants and investigators about who may have access to the data and how the data will be managed in order to control access.

Recommendation 5.4:

Federal policy should be developed and mechanisms should be provided to enable investigators and institutions to reduce threats to privacy and breaches of confidentiality. The feasibility of additional mechanisms should be examined to strengthen confidentiality protections in research studies.

Back to Top


Once an IRB has determined that risks of a given protocol are reasonable in relation to potential benefits, no person should participate in that research without his or her voluntary informed consent (or that of an appropriate representative). However, for some studies that pose minimal risk, it might be possible to waive this requirement. The process of informed consent involves investigators making appropriate disclosures about their research and participants developing a good understanding of the information provided and their choices regarding participation in a study. Participating in the process of informed consent is one of the best ways investigators can demonstrate their concern and respect for those they wish to enroll in a study.

In this report, NBAC reinforces previous recommendations from earlier reports by recommending that the process of providing information and ensuring comprehension should be emphasized, rather than the documentation of the decision to give consent, and that both the information and the way it is conveyed,while meeting full disclosure requirements,should be tailored to meet the needs of the participants in a particular research context. NBAC also recommends that documentation requirements should be adapted for varying research settings and that the criteria for deciding when informed consent is not necessary should be clarified to better ensure that participants are protected. Finally, because there are no clear policies on protecting privacy interests and confidentiality in the research context, the informed consent process alone is sometimes insufficient for protecting the rights and welfare of participants. Federal policy should be clarified and strengthened in this area to assist investigators in ensuring that the interests of participants are protected.

Back to Top


  • 1 See Vanderpool, H., ‘Unfulfilled Promise: How the Belmont Report Can Amend the Code of Federal Regulations Title 45 Part 46,Protection of Human Subjects.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 2 Ibid.
  • 3 Ibid.
  • 4 Ibid.
  • 5 NBAC Town Meetings: February 9, 2000, Houston, Texas; April 5, 2000, Pittsburgh, Pennsylvania; May 3, 2000, Orlando, Portland, Oregon.
  • 6 Informed consent requirements pertaining to research involving children are not addressed in the Common Rule. However, DHHS regulations include specific requirements relating to research Role of the States.’ This background paper was prepared for NBAC involving children (45 CFR 46 Subpart D) and is available in Volume II of this report. DHHS regulations require that ‘when in the judgment of the IRB’ children are capable of providing assent (their affirmative agreement to participate), they are asked to do so. In addition, at least one parent or guardian 345 N.Y.2d 502, 1973). and in some instances both parents or guardians are required to give permission for the child to participate in the research. NBAC has not addressed ethical issues pertaining to children participating in research. Attention should be given to the ethical standards and regulatory requirements for adequately protecting children.
  • 7 It should be noted that special provisions exist for waiving consent in the context of emergency research.
  • 8 Ibid.
  • 9 Ibid.
  • 10 See Schwartz, J., ‘Oversight of Human Subject Research: The Role of the States.’ This background paper was prepared for NBAC Informed Consent Process for and is available in Volume II of this report.
  • 11 See Goldman, J., ‘Privacy and Confidentiality in Health Research.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 12 See Sieber, J., ‘Privacy and Confidentiality: As Related to Human Research in Social and Behavioral Science.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 13 See Goldman, J., ‘Privacy and Confidentiality in Health Research.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 14 Pub. Law 191, 104th Congress.
  • 15 See Sieber, J., ‘Privacy and Confidentiality: As Related to Human Research in Social and Behavioral Science.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 16 Ibid.
  • 17 Ibid.
  • 18 See Goldman, J., ‘Privacy and Confidentiality in Health Research.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 19 In DHHS’ response to NBAC’s report, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance, it was noted that NBAC’s recommendations regarding identifiability and privacy might be inconsistent with proposed medical record rules promulgated by DHHS.
  • 20 Anthropology: Florida; June 7, 2000, Chicago, Illinois; August 14, 2000, ethcode.htm; Psychology:; Oral History: Each last accessed September 4, 2000.
  • 21 See Schwartz, J., ‘Oversight of Human Subject Research: The Role of the States.’ This background paper was prepared for NBAC and is available in Volume II of this report.
  • 22 People v. Newman (32 N.Y.2d 379, 298 N.E.2d 651,345 N.Y.2d 502, 1973).
Cite this page: "Chapter 5: Ensuring Voluntary Informed Consent and Protecting Privacy and Confidentiality (Research Involving Human Participants V1)" Online Ethics Center for Engineering 6/14/2006 OEC Accessed: Tuesday, May 22, 2018 <>