Beyond HIPAA: Protect sensitive information

Certificates of Confidentiality keep out prying eyes

The National Institutes of Health (NIH) issues Certificates of Confidentiality when it is necessary to provide better protection to research subjects’ privacy, but there have been questions recently about whether these are being used appropriately. Essentially, the certificates allow investigators to refuse to disclose identifying information in any civil, criminal, administrative, legislative, or other proceeding at the federal, state, and local levels. This protection can be a powerful aid when investigators are dealing with sensitive information, such as genetic, psychological, and substance abuse data. But do investigators and IRBs understand when and how to seek a certificate? Some institutions may use these too much and others too little, which is a problem that has prompted the NIH to issue some recent guidelines, addressing the issue.

How much is too much?

According to Certificates of Confidentiality experts at the National Institute of Mental Health (NIMH) in Bethesda, MD, there is some variability in familiarity with Certificates of Confidentiality across investigators and IRBs, depending on their history of past use, the kinds of research conducted at the local institution, and other factors.

This is why NIH created a Certificate of Confidentiality Kiosk at the web site: The kiosk provides background information and instructions about applications, and it provides a list of NIH contacts who can answer questions. However, should an IRB or investigator err on the side of caution or expediency?

Researchers at the Washington University School of Medicine in St. Louis have been using Certificates of Confidentiality for years, although NIH officials sometimes tell them that they use these too frequently, says Patricia Scannell, BA, CIP, director of the Human Studies Committee. "Evidently, many institutions do not use Certificates of Confidentiality to the extent that we do," she says. "We use them for sensitive, behavioral research, as well as research that screens for HIV/AIDS, and other sexually transmitted diseases [STDs]."

Investigators benefit because their subjects are provided an additional level of protection to assure them that their confidential information will not be disclosed, Scannell adds. Several years ago, an investigator at Washington University School of Medicine was served with a warrant from a local law enforcement agency, seeking the whereabouts of a particular research subject. This experience brought home the value of having a Certificate of Confidentiality, Scannell notes.

"We have many research proposals that focus on substance abuse and involve information that could be used against a subject should the information be brought to court or discovered outside the research realm," she says. "Likewise, HIV testing is frequently part of studies, and this information could cause significant harm to a subject should it become known outside of the research." It may be difficult for investigators to recruit potential subjects without providing them this additional security, Scannell says.

It’s appropriate to use Certificates of Confidentiality for research involving HIV, however STD and HIV disclosures may be made to public health authorities as voluntary reports, and subjects should be informed of this possibility in the informed consent, NIMH officials say.

Some IRB members and research experts may be concerned that research sponsors and investigators could misuse the certificates, particularly if these are rarely used by others involved in similar research. For instance, an IRB at North Memorial Healthcare in Robinsdale, MN, reviewed a research project involving a clinical trial of two drugs, and a Certificate of Confidentiality had been sought, says Mark Hochhauser, PhD, of Readability Consultant in Golden Valley, MN. Hochhauser is the community representative of the IRB. "I couldn’t figure out why these were in a clinical trial of two drugs," he says. "I asked the researcher who presented it before our committee why there was a Certificate of Confidentiality for this kind of research because there was no sensitive information and nothing illegal."

The investigator told the IRB that the company was doing research in prisons, and this was the consent they were using there and it probably just got attached as the same consent form for every site, Hochhauser recalled. "But I’m still a little troubled because of the implications of a Certificate of Confidentiality," he says. "I was cynical enough to think this is a way for the sponsor to avoid disclosing information in a court setting."

While Hochhauser raises a valid point, the rules regarding Certificate of Confidentiality should protect subjects from these being used abusively. Researchers and research institutions cannot use the certificates if the subject requests disclosure of his research information, NIMH officials say. That restriction is imposed to prevent precisely the sort of scenario Hochhauser envisioned of a researcher or institution using the certificate to evade responsibility in the event a subject chooses to file a lawsuit, NIMH officials say.

Should the IRB require a certificate?

Sometimes it’s the IRB that will ask investigators to apply for a Certificate of Confidentiality when IRB members believe the information is highly sensitive and that extra protection is warranted. However, investigators sometimes balk at this request. "Investigators say, You’re asking us to do all this paperwork in order to put an extra blanket of protection on something we’re scrupulously protecting to begin with,’" Scannell says. "I guarantee that with all the hoops investigators go through they are not happy when IRBs ask them for additional paperwork."

Plus, NIH asks that Certificates of Confidentiality be submitted three months before research subjects are enrolled, and this could tie up some studies. So it’s up to the IRB to weigh the risk of disclosure of subject’s private information vs the investigator’s need to proceed on schedule with the study, Scannell says.

HIPAA may impact use

Sometimes the IRB may decide that the protocol cannot be approved without the certificate, while in other instances the IRB may say that if the investigator can destroy all links to the private information, that would be protection enough, she adds. Also, with the Health Insurance Portability and Accountability Act (HIPAA) privacy regulations, it’s possible that these will diminish the need for Certificates of Confidentiality. This is a development that NIH is in the process of analyzing, although, so far, it appears that HIPAA will not seriously affect the usefulness of Certificates of Confidentiality, NIMH officials say.

Here are some of the basic NIH guidelines pertaining to applications for Certificates of Confidentiality:

• These can be used for biomedical, behavioral, clinical, or other types of research that is sensitive, which means that the disclosure of identifying information could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation.

• Sensitive research activities may include genetic information; information on subjects’ psychological well-being; information on subjects’ sexual attitudes, preferences, or practices; substance abuse data; information on illegal risk behaviors; and studies where subjects may be involved in litigation related to medical, environmental, or occupational exposures.

• Projects that are not eligible for a certificate include projects that are not research; where personally identifiable information is not collected; where studies are not reviewed or approved by an IRB; or where the collection of information would not significantly harm or damage a participant if it were disclosed.

• Certificates protect against involuntary disclosure, but subjects may voluntarily disclose their research data or information to physicians or third parties, and they may authorize in writing for investigators to release the information. Investigators may not use the certificate to refuse disclosure when authorized by the subject.

• Certificates do not prevent researchers from disclosing child abuse, reportable communicable diseases, or a subject’s threatened violence to self or others.

• A Certificate of Confidentiality protects identifiable information about subjects in perpetuity, so long as identifiable data about that subject was maintained in study records while the certificate is in effect.

• A certificate is issued by the NIH based on a principal investigator’s (PI) application for a specific research project, and it’s granted to the researcher’s institution. When a study is a multisite project, the PI may apply on behalf of all sites.