/
ABA Health eSource
April 2008 Volume 4 Number 8

Certificates of Confidentiality Protect Individual Privacy and Promote Public Health
by Bruce F. Howell, Powell Goldstein, LLP, Dallas, TX and Alex M. Hendler, Powell Goldstein, LLP, Washington, DC

Alex M. HendlerIn the atmosphere of heightened confidentiality concerns, entities conducting clinical research must seriously consider the privacy requirements and protections for human subjects participating in clinical trials or research studies. Given the tremendous investigatory powers of both federal and State governments and the substantial public health value of research conducted with human subjects who feel free to discuss a history of unlawful or risky behavior such as illegal drug use, it is very important to protect the privacy of such individuals to the maximum extent permitted by law. 1 Information about human subjects obtained in the course of clinical trials or research studies is not fully protected by the Health Insurance Portability and Accountability Act ("HIPAA") because of the exception found in HIPAA that can require certain information to be disclosed in court or to certain investigative or administrative bodies. 2 Furthermore, while some State laws may be more stringent and thus preempt HIPAA, many of those laws do allow the release of information to certain entities for litigation or law enforcement purposes.

Bruce F. HowellTo account for the confidentiality gaps in HIPAA and State law, a Certificate of Confidentiality is the strongest tool routinely available under federal law to protect information gathered in connection with certain research involving human subjects. 3 The Public Health Service Act allows the Secretary of Health and Human Services ("HHS") to issue Certificates of Confidentiality to "persons engaged in biomedical, behavioral, clinical or other research (including research on mental health, ... alcohol and other psychoactive drugs)." 4 The purpose of the Certificate of Confidentiality is "to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals." 5 Persons who are authorized to protect the privacy of the research subjects "may not be compelled in any Federal, state or local civil, criminal, administrative, legislative or other proceedings" to identify the research subjects. 6 It is important to note, however, that a Certificate of Confidentiality does not prevent a researcher from voluntarily disclosing identifying information in accordance with applicable law or ethical requirements, such as, for example, information obtained about communicable diseases that must be reported to authorities or a subject's intent to harm or history of harming others. 7

An entity conducting a clinical trial or research study should obtain a Certificate of Confidentiality for research that is likely to require the collection of sensitive information. Current federal guidance indicates that such research would potentially include information regarding (a) genetics, (b) the psychological well-being of subjects, (c) subjects' sexual attitudes, preferences or practices, (d) substance abuse or other illegal risk behaviors, and (e) studies in which subjects may be involved in litigation related to exposures under study (e.g., breast implants, environmental or occupational exposures). 8 Some research institution internal guidance indicates that in addition to most of the above, a researcher should apply for a Certificate of Confidentiality when the study will involve storage and collection of tissue samples, information regarding HIV/AIDS or other sexually transmitted diseases, and behavioral interventions and epidemiological studies. 9

Applications for Certificates of Confidentiality are made to the National Institutes of Health ("NIH") or other HHS entities that are overseeing the research. Such applications should be obtained before a clinical trial or research study begins, but if that is not possible, informed consent should be obtained from the research subjects advising them that the information described above is not yet protected in accordance with Certificate protections. 10 If a trial or study is operating under a Certificate of Confidentiality, participants should still be enrolled with informed consent that includes "a fair and clear explanation of the protection that [a Certificate of Confidentiality] affords, including the limitations and exceptions" described above. 11

At least one court case addressing the protections inherent in Certificates of Confidentiality has upheld the protections offered. 12 As suggested above, the availability of protections is particularly relevant when considering, for example, identifiable information obtained from a prison population or substance abusers participating in a clinical trial or research study--protecting this information can encourage participation in such trials or studies without fear of recrimination. Thus, a Certificate of Confidentiality not only protects the privacy of individuals participating in clinical trials and research studies, but can also facilitate research that may lead to improving the health and well-being of the most vulnerable among us.

1 See, e.g., Gale A. Richardson et al., Effects of Prenatal Cocaine Exposure on Growth: A Longitudinal Analysis, 120 Pediatrics e 1017 (October 2007) (indicating that under a Certificate of Confidentiality, in a study of the long-term effects on children of a mother's prenatal cocaine use, 90 percent of women meeting initial study enrollment criteria consented to participate in the study) available at http://www.pediatrics.org/cgi/content/full/120/4/e1017.
2 See 45 C.F.R. §§ 164.103, 164.512(a) (defining the scope of disclosures "required by law").
3 See Patricia A. Carney et al., Current Medicolegal and Confidentiality Issues in Large, Multicenter Research Programs, 152 Am. J. Epidemiology 371, 373--74 (2000).
4 See 42 U.S.C. § 241(d). The term "Certificate of Confidentiality" does not appear in the statute; rather it is the result of the Secretary's implementation of the statutory authority to issue permission to researchers to withhold certain information. See Department of Health and Human Services, Office of Human Research Protections, Guidance on Certificates of Confidentiality (Feb. 25, 2003), available at http://www.hhs.gov/ohrp/humansubjects/guidance/certconf.pdf.
5 See 42 U.S.C. § 241(d).
6 See id.
7 See National Institutes of Health, Office of Extramural Research, Detailed Application Instructions for Certificate of Confidentiality: Extramural Research Projects, available at http://grants.nih.gov/grants/policy/coc/appl_extramural.htm (last accessed March 26, 2008); UCLA Office for Protection of Research Subjects, Investigator's Manual for the Protection of Human Subjects Ch. 7, available at http://www.oprs.ucla.edu/human/manual/hspcmanual/7E (last accessed March 26, 2008). See also note 11, infra.
8 See National Institutes of Health, Office of Extramural Research, Certificates of Confidentiality: Background Information, available at http://grants.nih.gov/grants/policy/coc/background.htm (last visited March 26, 2008).
9 See Yale University School of Medicine Human Investigation Committee, Yale University School of Medicine HIC Policy Regarding: Certificate of Confidentiality ( June 7, 2006) available at http://www.med.yale.edu/hic/policy/CofC.pdf (last accessed March 26, 2008).
10 See id.
11 See National Heart, Lung, and Blood Institute, "What is a Certificate of Confidentiality and do I need one?", available at http://www.nhlbi.nih.gov/crg/funding_confidential.php (last accessed April 1, 2008).
12 See Murphy v. Philip Morris Inc., 2000 U.S. Dist. LEXIS 21128 (C.D. Cal. 2000) (ordering the University of Southern California, as non party to a lawsuit by a plaintiff with lung cancer against Philip Morris, Inc., to disclose to Defendant the results of an epidemiological study on the effects of smoking, provided, however, that all personally identifiable information was redacted from the results).