Certificates of Confidentiality Protect Individual Privacy and Promote Public Health
by Bruce F. Howell, Powell Goldstein, LLP, Dallas, TX and Alex M. Hendler, Powell Goldstein, LLP, Washington, DC
In the atmosphere of heightened confidentiality concerns, entities conducting clinical research must seriously consider the privacy requirements and protections for human subjects participating in clinical trials or research studies. Given the tremendous investigatory powers of both federal and State governments and the substantial public health value of research conducted with human subjects who feel free to discuss a history of unlawful or risky behavior such as illegal drug use, it is very important to protect the privacy of such individuals to the maximum extent permitted by law. Information about human subjects obtained in the course of clinical trials or research studies is not fully protected by the Health Insurance Portability and Accountability Act ("HIPAA") because of the exception found in HIPAA that can require certain information to be disclosed in court or to certain investigative or administrative bodies. Furthermore, while some State laws may be more stringent and thus preempt HIPAA, many of those laws do allow the release of information to certain entities for litigation or law enforcement purposes.
To account for the confidentiality gaps in HIPAA and State law, a Certificate of Confidentiality is the strongest tool routinely available under federal law to protect information gathered in connection with certain research involving human subjects. The Public Health Service Act allows the Secretary of Health and Human Services ("HHS") to issue Certificates of Confidentiality to "persons engaged in biomedical, behavioral, clinical or other research (including research on mental health, ... alcohol and other psychoactive drugs)." The purpose of the Certificate of Confidentiality is "to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals." Persons who are authorized to protect the privacy of the research subjects "may not be compelled in any Federal, state or local civil, criminal, administrative, legislative or other proceedings" to identify the research subjects. It is important to note, however, that a Certificate of Confidentiality does not prevent a researcher from voluntarily disclosing identifying information in accordance with applicable law or ethical requirements, such as, for example, information obtained about communicable diseases that must be reported to authorities or a subject's intent to harm or history of harming others.
An entity conducting a clinical trial or research study should obtain a Certificate of Confidentiality for research that is likely to require the collection of sensitive information. Current federal guidance indicates that such research would potentially include information regarding (a) genetics, (b) the psychological well-being of subjects, (c) subjects' sexual attitudes, preferences or practices, (d) substance abuse or other illegal risk behaviors, and (e) studies in which subjects may be involved in litigation related to exposures under study (e.g., breast implants, environmental or occupational exposures). Some research institution internal guidance indicates that in addition to most of the above, a researcher should apply for a Certificate of Confidentiality when the study will involve storage and collection of tissue samples, information regarding HIV/AIDS or other sexually transmitted diseases, and behavioral interventions and epidemiological studies.
Applications for Certificates of Confidentiality are made to the National Institutes of Health ("NIH") or other HHS entities that are overseeing the research. Such applications should be obtained before a clinical trial or research study begins, but if that is not possible, informed consent should be obtained from the research subjects advising them that the information described above is not yet protected in accordance with Certificate protections. If a trial or study is operating under a Certificate of Confidentiality, participants should still be enrolled with informed consent that includes "a fair and clear explanation of the protection that [a Certificate of Confidentiality] affords, including the limitations and exceptions" described above.
At least one court case addressing the protections inherent in Certificates of Confidentiality has upheld the protections offered. As suggested above, the availability of protections is particularly relevant when considering, for example, identifiable information obtained from a prison population or substance abusers participating in a clinical trial or research study--protecting this information can encourage participation in such trials or studies without fear of recrimination. Thus, a Certificate of Confidentiality not only protects the privacy of individuals participating in clinical trials and research studies, but can also facilitate research that may lead to improving the health and well-being of the most vulnerable among us.