D32.0000
1
Privacy vs. Confidentiality
What’s the Difference?
The IRB is responsible for systematically evaluating proposed research for adequate provisions which
protect the privacy interests of participants and to maintain the confidentiality of identifiable data.
The federal regulations differentiate between privacy and confidentiality, and it is important to
understand the difference to determine whether these regulatory criteria for approval of human
subject research are appropriately met.
Privacy
Privacy refers to a person’s desire to control the access of others to themselves. For example, persons
may not want to be seen entering a place that might stigmatize them, such as a pregnancy counseling
center that is clearly identified as such by signs on the front of the building. Privacy concerns people,
whereas confidentiality concerns data. The research proposal should outline strategies to protect
privacy including how the investigator will access information from or about participants.
In developing strategies for the protection of subjects’ privacy, consideration should be given to:
• The methods used to identify and contact potential participants.
• The settings in which an individual will be interacting with an investigator.
• The appropriateness of all personnel present for research activities.
• The methods used to obtain information about participants.
• The nature of the requested information.
• Information that is obtained about individuals other than the “target participants,” and whether
such individuals meet the regulatory definition of “human participant” (e.g., a subject provides
information about a family member for a survey).
• Privacy guidelines developed by relevant professional associations and scholarly disciplines (e.g.,
oral history, anthropology, psychology).
• How to access the minimum amount of information necessary to complete the study.
Regulatory and Guidance References
• 45 CFR 46.111(a)(7)
• 21 CFR 56.111(a)(7)
Confidentiality
Confidentiality refers to the researcher’s agreement with the participant about how the participant’s
identifiable private information will be handled, managed, and disseminated. The research proposal
should outline strategies to maintain confidentiality of identifiable data, including controls on storage,
handling, and sharing of data. When appropriate, certificates of confidentiality could be used to
maintain the confidentiality of identifiable data (for more information on Certificates of Confidentiality,
see ORI’s “Certificate of Confidentiality Summary Sheet” in the online IRB Survival Handbook under
topic Confidentiality/Certificate of Confidentiality:).
