Confidentiality

Confidentiality refers to the agreements you make with subjects about how you will collect, store, analyze, use, and report on information about themselves that they agree to share with you. By contrast, privacy refers to the control over what information someone shares with others.

For purposes of this guide, we will refer to both information and biospecimens as “information.”

The primary risk to research participants in the social and behavioral sciences and the humanities is an inadvertent disclosure of data when:

The information collected from or about the subjects reveals their identity, either directly or indirectly, and
Disclosure of the information could harm research participants. Possible harms range from a damaged reputation to criminal prosecution for engaging in illegal activities.

If your study collects individually identifiable information that could pose harm to subjects if disclosed, you will need to design a data protection plan and describe it in the protocol application. The IRB staff will pre-review the plan and forward it to the Information Technology Security Office (ITSO) for approval.

You will also need to explain the confidentiality procedures to your research subjects.

It is not sufficient just to tell participants that identifying information they provide will be “kept confidential”. You have to explain how it will be done.

This guide offers sample text for describing confidentiality procedures to research subjects. Use the 7 question provided below to access appropriate sample language. Do not use the samples uncritically because they may not be appropriate for your study.

Do you need to collect email addresses, physical addresses, or other identifiable information so that you can keep a record of people who have participated in your study?
- I will keep your email address so that I can send you a reminder notice if you haven't completed the survey. The only information connected to your email address will be whether or not you completed the survey, not your answers to the survey.
- I will keep your contact information apart from your interview responses. I will hold on to your contact information until I have transcribed the interview in case I have additional questions. My field notes will be on my laptop computer that uses whole disk encryption.
Do you need to link data, for example, from pre- and post- intervention questionnaires?
- You will be asked to create your own unique study ID to put on your questionnaires so I can link your responses without collecting your name.
- You will be assigned an ID number that we will use to link your responses to surveys throughout the study. We will keep the key separate from your responses. We will keep the key until the study is completed, but it will be stored on a secure server with restricted access.
- The research log that includes your name will be kept in a locked file cabinet.
Can your participants' identities be deduced with relative ease because you plan to conduct research in a small community or with a small number of subjects who are well-known in some way?
- I will use pseudonyms and misleading information when preparing reports or articles about the research.
- I will use false names when writing reports about this study. I will also make up some information about you so no one will be able to guess who you really are.
- When reporting my analysis, I will use information from different people and combine them to create new characters in order to protect the individual identity of each person I interview.
Do you plan to audio-record interviews?
- With your permission, I would like to tape this interview so that I can make an accurate transcript. The tape will be destroyed as soon as the transcript is completed.
- If it is OK with you, I would like to tape this interview so that I can write down what you said without mistakes. Once I have made my notes, I will erase the tapes.
- With your permission, I would like to tape this interview because I think that your story will be valuable for other researchers interested in this topic.
Are you collecting data in a situation in which confidentiality cannot be offered, such as focus group discussion?
- Your name will not be used in our research. While we hope you feel comfortable to openly answer our questions, you do not have to share information you do not want others to repeat outside this group discussion.
- I hope you feel comfortable to respond to the discussion questions. I won’t be using any identifying information from this discussion in my dissertation, and I will be advising the other participants not to share the discussion outside the group. However, I cannot guarantee that they will follow this request.
Are you collecting information that is identifiable, but identifying subjects is a central feature of your research method, such as oral history; or you are interviewing public figures or acknowledged experts in your field of inquiry?
- With your permission, I will use your name in my report and attribute quotations to you. Please let me know if you would you like any of your comments to be off the record.
- I will archive the recording of your interview in the Duke Library where it will be available for others to use for research and educational purposes. I would also like to incorporate portions of the interview in a documentary film about [this topic].
- I’ll be using our interview to write a paper on this topic and I’d like to use your name and what you tell me. However, it’s not essential to have your name. If you would prefer I don’t use your name just let me know.
- After I have transcribed the recording of our interview, I will give you the opportunity to review it for accuracy.
Are you collecting identifiable information that might be subject to subpoena by a court of law, such as information about illegal activities or sexual orientation?
- You may want to apply for a Certificate of Confidentiality so you will not be compelled to disclose your data.
  
  When a CoC is granted, the NIH requires that research participants be told in the consent form the protections that the CoC affords and exceptions to that protection. Click here for more details.

Collecting Risk-Free Data

If you will not collect any direct identifiers, such as names or email addresses, and no other information that would allow someone to deduce your subjects' identities, it is important to explain that to you subjects.

I will not write down your name.
The survey does not collect your name or any identifying information about you, such as your email address.
No information will be collected that can link you back to your responses. This means that we will be unable to identify your questionnaires or return them to you.

The information you collect is identifiable, but neither sensitive nor potentially damaging, and you do not plan to identify subjects in your findings.

Information I collect from this study will only be analyzed and reported as a whole. That is, I will write about groups of people, not about individuals.
While I will not use your name, I would like your permission to use your age range, your gender, and your job title to describe you. If your job is unique and could potentially identify you, I will not use it. Instead, I will describe your job in general terms.

Public or Future Use of Data

Researchers must inform participants whether their data, in identified or de-identified form, will be made public, shared with other researchers, or used for future research purposes.

Researchers being asked to make their data public a requirement of publication or funding has become a common practice in recent years. Please think carefully when designing confidentiality procedures as you write your protocol. While the Campus IRB does not obligate researchers to make their data public, we discourage researchers from guaranteeing de-identified data will never to be made public unless they are absolutely certain they will not be asked to do.

Identifiable data about participants should not be made public without explicit permission.

What to do:

Include a statement in your consent process to inform participants whether identifiers associated with their information will be removed, and whether their information may (or will not) be made public or used for future research purposes.

How to say it:

Although collected data may be made public or used for future research purposes, your identity will always remain confidential.
At the conclusion of this study, identifiable information may be made public or used for future research purposes without additional consent.