VDH IRB October Newsletter

This Month's Highlight

Privacy and Confidentiality in Research – What’s the Difference?

Privacy is about people. It refers to research participants’ willingness to allow access to themselves and their information. Additionally, privacy involves protecting the research participants’ right to control the information being collected, used, and shared with others. Consideration of privacy includes the time and setting where private information is obtained, the nature of the information collected, and who receives and uses the information. Privacy protections in research include methods used to protect participants’ privacy during the collection of information and conduct of the study.

How Can I Protect the Research Participants’ Right to Privacy?

• Tell participants at the beginning of surveys or interviews that they can choose not to answer any questions that make them feel uncomfortable or they can end participation at any time.
• Send non-specific emails and/or leave only general messages on voicemail when contacting participants (not saying anything specific about the participant or the research) . 
• Ensure that only authorized research study personnel will be present during research related activities.
• Limit the collection of information about participants to the amount necessary to achieve aims of the research.
• Conduct interviews about sensitive topics individually in a private location, rather than in a group setting.
• De-identify photos, audio recordings, or videos recordings of participants made during the study.
• Allow for anonymous submission of surveys and questionnaires.

Confidentiality is about Information/Data or Specimens. Confidentiality concerns the protection of information, data, or specimens provided by research participants. It requires ensuring that such materials are not shared without authorization and are used only within the scope of an approved research study. Confidentiality in research involves implementing safeguards to protect data during collection and throughout its storage and use.

How Can I Protect the Confidentiality of Research Data?

• Restrict access to identifiable data and specimens to authorized personnel only.
• Use encrypted email and ensure all transferred data is encrypted.
• Store all materials and specimens in locked cabinets or secure access‑restricted areas.
• Maintain electronic data with appropriate safeguards, including unique usernames and passwords; use two‑factor authentication when possible.
• Install and regularly update security software (e.g., firewalls, antivirus) on all servers, workstations, laptops, and other study devices.
• Conduct routine virus and spyware scans on all computers with access to study data.
• De‑identify all study data.

What are the Risks from the Loss of Privacy and/or Confidentiality?

Loss of privacy and confidentiality in research can significantly affect participants, researchers, and the credibility of current and future studies.  The potential consequences include:

Harm to Participants Unauthorized disclosure of sensitive information, such as health conditions, illegal activities, or personal behaviors, can lead to embarrassment, reputation damage, job loss, or loss of health insurance.

Impact on Trust and Data Quality When participants doubt that their information will be protected, they may withhold details, provide inaccurate responses, or decline participation. This erodes public trust in research and reduces willingness to engage in future studies, particularly those involving sensitive topics.

Legal and Regulatory Consequences Breaches of confidentiality can result in fines, loss of funding, and legal action, especially when Protected Health Information (PHI) is involved under HIPAA regulations. 

NOTE: The principal investigator has responsibility to ensure privacy and confidentiality are adequately addressed.

If you have questions, please contact the IRB at IRBVDH@vdh.virginia.gov or Janice.hicks@vdh.virginia.gov.

What's the Word?

Get to Know Your IRB Terms

Minimal Risk Research is a study where the expected harm or discomfort to the participant is no greater than what people face in daily life or during routine physical and psychological tests. Some common examples include surveys or interviews on non-sensitive topics, observational studies of public behavior, and the use of de-identified existing data or biological specimens. (The IRB may determine that studies including surveys or interviews on sensitive topics or identifiable existing data or biological specimens may be considered minimal risk if reasonable and appropriate protections will be implemented to protect privacy and confidentiality.)