Confidential Information
Protection of Confidential Information:
The PI is responsible for ensuring the privacy and confidentiality of all personally identifiable information from research participants, except as required by law (e.g., child abuse) or allowed with written permission of the research subject. This information may be contained in either electronic or hard copy formats. When appropriate, the informed consent document should outline those conditions under which data are not considered confidential (e.g., child abuse).
Data collection and storage, and safeguards to ensure confidentiality must be delineated by the PI in the procedures portion of the application to the IRB.
University Access to Confidential Records:
The University has the right of access to the supporting records for all research at the University or supported by University-sponsored funds, provided such access to the records shall be for reasonable cause, at reasonable times, and after reasonable notice. The University's right of access to the data shall continue regardless of the location of the responsible investigator. Information or data that would violate the confidentiality of sources or participants involved in the research should not be disclosed. Extramural sponsors providing support for research at the University may also have the right to review the data and records resulting from that extramural support.
Co-investigators and trainees who are an integral part of a research project have the right to review all records and data which are part of that project.
Family Education Rights and Privacy Act
The Family Education Rights and Privacy Act (FERPA) is a federal law (20 U.S.C. § 1232g; 34 CFR Part 99) that applies to educational agencies and institutions that receive federal funds under any program administered by the Secretary of Education. FERPA gives parents certain rights with respect to their children’s education records.
These rights transfer to the student when he or she reaches age 18 or attends a postsecondary school. Students to whom the rights have been transferred are “eligible students.” Generally, schools must have written permission from the parent or eligible student before releasing any identifiable information from a student’s education record. The consent must specify the records that may be disclosed, state the purpose of the disclosure, and identify the party to whom the disclosure may be made.
FERPA does, however, allow schools to disclose records to organization(s) conducting studies for, or on behalf of the school, in order to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction. Additionally, schools may disclose, without consent, “directory” information, unless specifically directed by parents or eligible students not to disclose directory information about them.
Researchers are encouraged to consult with the school early in the research design process regarding the need to obtain consent for educational records.
Protection of Pupil Rights Amendments
Schools and contractors must obtain prior written parental consent before minor students are required to participate in any U.S. Department of Education funded survey, analysis, or evaluation that reveals information concerning the following:
- political affiliations or beliefs of the student or the student’s parent; mental and psychological problems of the student or the student’s family;
- sex behavior or attitudes;
- illegal, anti-social, self-incriminating, or demeaning behavior;
- critical appraisals of other individuals with whom respondents have close family relationships;
- legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;
- religious practices, affiliations, or beliefs of the student or student’s parent; or income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).
Additionally, local educational agencies or institutions that receive funds under any program administered by the U.S. Department of Education are required to develop and adopt policies concerning parents’ rights to inspect, upon request, any survey created by a third party before the survey is administered or distributed by a school to students and provide parents the opportunity to ask that their child not participate.
PIs are encouraged to consult with the school early in the research design process regarding how PPRA may impact the research protocol.
Privacy Rule under HIPAA
Other Regulations related to Privacy, Confidentiality, and Consent:
In addition to 45 CFR 46 and FDA regulations (21 CFR 50), other federal regulations may apply to research involving human participants.
Privacy Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA):
The Privacy Rule, a Federal regulation under the Health Insurance Portability and Accountability Act (HIPAA) of 1996, regulates the way covered entities handle individually identifiable health information known as protected health information (PHI). The Privacy Rule itself applies only to covered entities, not to research itself; however, the Privacy Rule may affect researchers because it establishes the conditions under which covered entities can use or disclose PHI for research.
The Privacy Rule does not directly regulate researchers who are engaged in research within units that are not part of the covered entities, even though they may gather, generate, access, and share personal health information. The Privacy Rule is in 45 CFR Part 160 and Subparts A and E of Part 164.
PIs planning to engage in physical or medical health related research that is covered under the Privacy Rule are advised to begin consultation with the covered entity early in the research design process.