Certificates of Confidentiality: Protecting Human Subject Research Data in Law and Practice

Answering important public health questions often requires collection of sensitive information about individuals. For example, our understanding of how HIV is transmitted and how to prevent it only came about with people’s willingness to share information about their sexual and drug-using behaviors.¹ Given the scientific need for sensitive, personal information, researchers have a corresponding ethical and legal obligation to maintain the confidentiality of data they collect and typically promise in consent forms to restrict access to it and not to publish identifying data.²

The interests of others, however, can threaten researchers’ promises of confidentiality when legal demands are made to access research data (e.g., through subpoena). In some cases, the subject of the litigation is tightly connected to the research questions, and litigants’ interest in the data are not surprising. Researchers conducting studies on tobacco or occupational or other chemical exposures, for example, are relatively frequent targets of subpoenas.³ Similarly, those conducting research on illegal behaviors should not be surprised that their data may be considered useful in building cases.⁴ In other instances, litigants’ interest in the data may relate to individual participants, rather than the research per se, and may not be anticipated.⁵

When the research data collected could place participants at risk from disclosure, researchers need to take steps to minimize that risk.⁶ A Certificate of Confidentiality (“Certificate”) is a potentially important tool for protecting individually identifiable, sensitive research data from compelled disclosure. Under the terms of the authorizing federal statute, the holder of a Certificate “may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals.”⁷ However, questions persist about the strength of Certificate protections, and the evidence on which to judge their strength is scant.⁸

In this article, we examine Certificates and related statutory protections to enhance understanding and suggest ways to strengthen Certificates’ protections. We begin by briefly describing researchers’ obligations to protect the confidentiality of data they collect. We next summarize the legislative and regulatory history, and the case law—both reported and unreported—interpreting Certificates. We then analyze other statutes and regulations that provide similarly broad confidentiality protections for research data and compare them to Certificates. We briefly examine other legal strategies available for protecting research data. Finally, we make recommendations for how to strengthen protection of sensitive research data based on our research on this topic.

I. RESEARCHERS’ CONFIDENTIALITY OBLIGATIONS

Researchers are widely acknowledged to have an ethical and a legal obligation to protect the confidentiality of information that participants share with them.⁹ The ethical obligation arises out of the principle of beneficence, which requires researchers to minimize harms to research participants, and respect for persons.¹⁰ Federal regulations governing human subjects research (“federal regulations” or the “Common Rule”)¹¹ impose an obligation on institutional review boards (IRBs) to ensure that “there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data” before approving a study.¹² In addition, federal regulations require that “risks to subjects are minimized.”¹³ These two provisions thus impose an obligation on researchers to take steps to protect confidentiality, at least when the study methods and topic make confidentiality an issue. The importance of preserving confidentiality is also implied in other parts of the federal regulations. For example, whether information is collected or maintained in a way that could be linked back to an individual participant is an important consideration in determining whether the research is subject to the Common Rule and requires IRB oversight.¹⁴ Finally, laws protecting confidentiality of materials often used in research, such as medical records, may give rise to participant expectations about data confidentiality.¹⁵

There are a number of ways that researchers may protect confidentiality. For example, they may collect data anonymously so that it cannot be linked back to an individual. Alternatively, researchers may code data so that participants are not immediately identifiable. Access to the key that links the code to identifying information is typically limited, and additional steps taken to secure the data through physical means (e.g., locked cabinets) and/or electronic means (e.g., password protection).¹⁶ Researchers also often destroy the key once the research is completed.¹⁷

Even without ethical and regulatory obligations to protect participants’ confidentiality, many researchers would likely take steps to do so on purely pragmatic grounds. Without assurances that researchers will protect their information, people may not participate in research on sensitive topics.¹⁸

II. CERTIFICATES OF CONFIDENTIALITY

Legislative Authority

Certificates were originally authorized in 1970 for research involving drug use.¹⁹ In order to succeed with such research, researchers “had to guarantee confidentiality”²⁰ because, as one researcher explained, Congress wanted researchers “to study people under conditions where they must admit they have committed a felony.”²¹ Since this original authorization, the scope of Certificates has been expanded several times.²² The statute now reads:

“The Secretary [of Health and Human Services] may authorize persons engaged in biomedical, behavioral, clinical or other research (including research on mental health, including research on the use and effect of alcohol and other psychoactive drugs) to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals.”²³

Regulatory Authority

While statutes provide the authority for Certificates’ confidentiality protections,²⁴ HHS regulations specify their form.²⁵ These regulations define the “identifying characteristics” that are protected by the Certificate as “the name, address, any identifying number, fingerprints, voiceprints, photographs or any other item or combination of data about a research subject which could reasonably lead directly or indirectly by reference to other information to identification of that research subject.”²⁶ (emphasis added) They also give authority to National Institutes of Health (NIH) to issue Certificates upon application, regardless of whether the research is funded by the federal government.²⁷ The regulations also specify the content of the application ²⁸ and the information that must be disclosed to research participants about the Certificate.²⁹

Reported Cases Involving Certificates

The disclosures Certificates protect against come about in the legal process called discovery, which is the phase when parties to the case, in whatever forum, can seek relevant documents, testimony, and other information from the other side and from non-parties. For both procedural and practical reasons, discovery decisions are seldom appealed and thus do not give rise to reported decisions.³⁰ In this section, we analyze the few reported cases that address Certificates and their implications.

People v. Newman

³¹ This was the first case to address the confidentiality provision introduced in the Comprehensive Drug Abuse Prevention and Control Act of 1970 (“1970 Act”). While a compelling factual story, the legal story focused more on the conflict between two statutes than the scope of the Certificate’s protections.³²

In Newman, a methadone maintenance clinic patient who witnessed a murder told police that she had previously seen the murderer in the clinic’s waiting room.³³ Based on this information, a grand jury subpoena was served on the clinic’s director, Dr. Robert Newman, ordering him to produce photographs of patients who fit the witness’s description. Dr. Newman moved to quash the subpoena on the grounds that the production was prohibited because he had a Certificate. The trial court denied Dr. Newman’s motion and, when he still refused to produce the photographs, found him in contempt of court and sentenced him to thirty days in jail.³⁴

In his appeal, Dr. Newman claimed that the photographs were protected because he had a Certificate authorized by the 1970 Act.³⁵ The New York District Attorney countered that the 1970 Act was superseded by the Drug Abuse Office and Treatment Act of 1972 (“the 1972 Act”), and it permitted court-ordered disclosure of methadone maintenance program records.³⁶ Thus the Court needed to determine whether the 1972 repealed the more stringent protections of the 1970’s Act.³⁷

The Court determined that the 1972 Act did not repeal the 1970 Act’s “absolute confidentiality” protections, noting those protections were necessary to “ensure the success of drug research programs in which addict participants require anonymity.”³⁸ Having made the decision about which statute controlled, the Court quickly decided that Dr. Newman could not be compelled to produce the photographs and could not be held in contempt for his failure to do so.

People v. Still

³⁹ In this case, the defendant, Still, was charged with criminal possession of methadone. Still asserted that his possession was lawful because he was a patient in a methadone clinic. In support of his claim, he provided the district attorney with a letter from the clinic’s director to his attorney affirming his participation in the program and that he received the methadone in question from the clinic. The district attorney issued a subpoena to the clinic for the defendant’s records to assess the credibility of Still’s claim. The clinic moved to quash the subpoena, and the trial court, relying on Newman, granted their request.

On appeal, the Court ordered the clinic to produce the records, allowing the district attorney to inspect only those records necessary to determine whether Mr. Still lawfully possessed the methadone.⁴⁰ In reaching this conclusion, the court noted, unlike Newman, where the methadone clinic director was being asked to identify participants in his program to the police,⁴¹ Still had waived his right to anonymity by disclosing his participation in the program to defend himself from criminal charges.⁴²

North Carolina v. Bradley

⁴³ Bradley was a criminal defendant charged with “indecent liberties with a minor” and statutory rape. Bradley’s granddaughter was a prosecution witness who was expected to testify (and ultimately did) that Bradley had sexually abused her. Prior to trial, Bradley subpoenaed research records pertaining to his granddaughter from a study conducted by Duke University researchers for the purpose of challenging her credibility. Duke moved for a protective order on the grounds that a Certificate protected the data, which the trial court granted.⁴⁴ However, Duke was ordered to maintain a sealed copy of the records that could be used should the defendant later appeal the ruling.⁴⁵

After a jury convicted Bradley on all the charges against him, his appellate lawyer moved for access to the Duke files for his appeal.⁴⁶ The trial court granted the request and ordered disclosure of the study documents to allow Bradley’s appellate lawyer to determine whether earlier denial of access to the documents provided a basis for appeal.⁴⁷ The judge limited access to the study documents to the defendants’ and Duke’s lawyers. Duke appealed the order requiring disclosure.

Bradley sought to set aside Duke’s appeal, but the court allowed the appeal it because the order required Duke to disclose information that it was required to protect under the Certificate and federal statute. Despite this recognition of Duke’s obligations, the appellate court did not rely on the Certificate in its decision that the records should not have been released to defense counsel. Rather, the court relied on the lack of evidence of materiality of the records, a general discovery concept, to make its determination.⁴⁸ Having resolved the matter on materiality, the court concluded that it “need not consider [Duke’s] argument that the confidentiality of the documents was statutorily privileged.”⁴⁹ The appellate court found that the trial court erred in ordering the documents produced and vacated that order, but, at that point, the disclosure had already been made.⁵⁰

Murphy v. Philip Morris Inc

⁵¹ The discovery dispute in this case arose in a personal injury suit against Philip Morris. The plaintiff, Robert Murphy, claimed that he contracted lung cancer through exposure to second-hand smoke. Philip Morris sought data from a study conducted by the University of Southern California (USC), the California Department of Health Services, and others, which was pivotal to the United States Environmental Protections Agency’s conclusion that second-hand smoke causes lung cancer. According to the Court, USC’s opposition to the motion presented “a compelling case” that “a reasonably capable researcher” could connect redacted data to specific study subjects.⁵² The court also noted that USC had obligations to preserve the confidentiality of “the names and ‘identifying characteristics’ of the subjects,” citing the consent provisions of the Common Rule and the Certificate authorizing statute.⁵³ Nevertheless, the court ordered production of the data, in part because the data alone were not identifiable.⁵⁴ It did, however, issue a protective order that, among other things, (1) imposed restrictions on attempts to re-identify the subjects; (2) limited use of the documents to the particular case; (3) limited the disclosure of the documents to specified individuals who first signed a non-disclosure agreement; and (4) required return of the documents after the case was concluded.

What is most interesting about the Murphy case is that, despite citation to the Certificate authorizing statute, it does not appear that the study had a Certificate and, thus, that the statute had any bearing on the case. So why did the court’s order refer to 42 U.S.C. § 241(d)? It appears that the court adopted the arguments presented by USC’s counsel⁵⁵, which seem to be a misunderstanding of 42 U.S.C. §241(d) as a protection that extends to all research projects, rather than protection granted to qualified research projects that apply.⁵⁶ In its reply, Philip Morris’ attorneys did not address this argument, except to note that it did not seek identifying information.

Unreported Cases Involving Certificates

Because of the paucity of reported⁵⁷ cases involving Certificates, and the limited legal analysis of Certificates within those cases, we sought to identify cases at any level that might involve Certificates and add to our understanding of how courts address them.⁵⁸ Through these searches, we were able to identify some additional cases, although the amount of information available on each was variable.

Three cases involved claims of harm following drug⁵⁹ or other chemical⁶⁰ exposure and were resolved similarly. In each case, the defendants sought access to research data, and the researchers asserted that a Certificate protected the data from disclosure. In two of these,⁶¹ the researchers raised concerns about whether the data could be effectively deidentified and about the chilling effects on future research if the data were shared. In all three, redacted data were disclosed under a protective order issued by the court.⁶² Among the terms of the protective orders were a uniform protocol for redaction, promises not to try to re-identify the subjects, limiting who could access the data, and limiting use to the litigation at hand.⁶³

Two others unreported cases, a state attorney general opinion and a juvenile court case, highlight different interpretations of the Certificate’s protections, with implications for our recommendations. Thus, we discuss them in some detail despite their limited precedential value.

In re: Louisville Branch-National Association for the Advancement of Colored People/Administrative Office of the Courts and the University of Louisville

⁶⁴ involved a study conducted by Louisville for the Administrative Office of the Courts (AOC) evaluating racial fairness in sentencing at the court. The NAACP filed an open records request to the AOC and Louisville for the data supporting Louisville’s research report “to monitor the performance of [the] elected judiciary through records access.”⁶⁵ Louisville asserted the Certificate in opposing the request.

In its opinion, the Kentucky Attorney General found that Louisville’s Certificate was controlling and provided “absolute protection against compelled disclosure of identifying information about the subjects of the study.”⁶⁶ Louisville had submitted information demonstrating how someone could piece information from the data with publicly available documents to identify the judges. Based on this information coupled with the NIH FAQ definition of “identifying”, the AG concluded: “To require involuntary disclosure of the disputed data would be tantamount to breaching the protection afforded by the certificate through release of a combination of data about research subjects that could reasonably lead, directly or indirectly by reference to other information, to the identification of those subjects.”⁶⁷

Juvenile court case

⁶⁸ This case involved four children who were participants in Yale studies on abuse and neglect and stress on brain development. The Yale researchers voluntarily notified the government that they were concerned about the children’s welfare. The government took temporary custody of the children and subsequently subpoenaed the research records, contending they were necessary to providing appropriate medical treatment to the children.

Critically, in this case, both sides agreed that the government learned about the children’s study participation through the researchers’ notification.⁶⁹ Relying on People v. Still, the regulations, and the Certificate language (which allows the researcher to voluntarily disclose identifying information in instances of suspected child abuse), the Court concluded the researchers could “waive the right to refuse to disclose identifying information,”⁷⁰ which they did when they voluntarily disclosed their concerns about the children’s welfare based on information from the children’s study participation. The Court went on to conclude that the policy of protecting the identity and records of research subjects must “give way to the extent necessary to accommodate the dominant public policy of protecting children.”⁷¹ As with the environmental exposure cases described above, the Court provided some confidentiality protections: it restricted the use of the records to providing treatment for the children, required disclosure of identifiable information only to the four children in custody,⁷² and prohibited the government from seeking to re-identify any research subject or to disclose information about them.⁷³ It is unclear why the Department needed the research records, given that it had already obtained custody of the children and, thus, was in a position to provide medical treatment.

Experiences reported by institutional counsel

As reported in more detail elsewhere,⁷⁴ legal counsel at major academic medical centers have described experiences similar to those reflected in the cases described above.⁷⁵ In qualitative interviews (n=24), nearly all counsel had experience with legal demands for research data, and almost two-thirds reported having experience with demands for research data protected by a Certificate.⁷⁶ Most cases that counsel described were civil, not criminal cases. Overall, counsel reported that usually they were able to resolve cases without going to court and without disclosure of identifiable data. Counsel described multiple strategies they had successfully used in protecting research data. In some cases, simply informing opposing counsel of the Certificate was sufficient. In others, counsel were able to persuade the requesting attorney to obtain the information from other sources. In some cases, counsel negotiated disclosure of non-identifiable data. Even when required to go to court, counsel indicated that they were often successful in protecting the data, although they typically relied on other legal protections, rather than the Certificate.

Implications of the Cases

Several lessons can be taken away from the cases we uncovered—reported and unreported—involving Certificates. First, the cases and the experiences of counsel suggest that Certificates generally function as intended. Counsel often are able to avoid both production of data and court fights over production by informing the requesting counsel about the Certificate and its protections. When data are produced, typically only limited data are produced to avoid identification;⁷⁷ such production is consistent with the Certificate’s protection, although perhaps not with people’s ordinary understanding of the protections.⁷⁸

Second, despite this seemingly reassuring picture of data protection, the cases reveal some important areas of concern. Significantly, the cases suggest uncertainty and confusion about Certificates and their protections. Specifically, despite the strong statutory language, it appears that when research data are sought, counsel and judges do not start by considering whether the Certificate protects the data, but rather by viewing the Certificate as one aspect among many to be considered. This approach, perhaps, is not so surprising given that lawyers encounter few Certificate cases in their careers and may not be familiar with them.⁷⁹ Given how few cases go to court, judges are even less likely to encounter Certificates and, therefore, may be likely to approach demands for research data the same way they approach other discovery disputes about sensitive, confidential data. However, this apparent hesitancy to raise the Certificate as a primary argument to protect data may also reflect uncertainty about whether courts will uphold a Certificate’s protection. In interviews, counsel expressed concerns about the strength of the protections and reluctance to assert the Certificate when there were other protections on which to rely. As one counsel explained, “I guess the prevailing thought or position is that we don’t want to challenge [Certificates] in court and set precedent for the court saying they’re not effective.”⁸⁰

Finally, judicial treatment of two critical issues related to the Certificate’s protections—waiver and identifiability—in some cases seem to validate counsels’ concerns about how Certificates will fare in the courts. With regard to waiver of a Certificate’s protections, the two issues that arise are 1) whether waiver has occurred, and 2) the scope of the waiver. In People v. Still, the court had to determine whether the methadone clinic could assert the Certificate’s protections against the district attorney’s subpoena, when the patient, Still, had revealed his relationship with the clinic and was relying on a letter from the clinic, provided at his request, to support his defense.⁸¹ The court appropriately concluded that Still’s disclosure constituted a waiver of the Certificate’s protections, although only with respect to records that would “aid in determining the veracity of the defendant’s claim of lawful possession of the methadone found on him.”⁸² In Still, the waiver was voluntary, purposeful, and limited in scope.

The opposite is true in the juvenile court case. While it is true that the researchers’ disclosure of the pediatric participants’ identity was voluntary, the ultimate extent of the waiver of the Certificate’s protections could hardly be said to be voluntary and purposeful, nor limited in scope. The judge interpreted the researchers’ disclosure of participant identities in order to report child neglect as a waiver of all the Certificate’s protections.⁸³ This interpretation appears inconsistent with both the researchers’ intentions, as evidenced by their motion to quash the subpoena for the records,⁸⁴ and with the intent of the Certificate statute and implementing regulations. Specifically, researchers can use a Certificate to resist compelled disclosure of identifying information, but the regulations and NIH’s Certificate kiosk make it explicit that the Certificate does not apply to voluntary disclosures. With respect to communicable disease, for example, NIH policy requires an agreement to comply with state disease reporting requirements in order to receive a Certificate.⁸⁵ If disclosure of limited but identifiable information for reporting purposes waived the Certificate’s protections, this NIH policy would be nonsensical, because the agreement to report would render the Certificate’s protections meaningless. Such a broad interpretation of waiver also raises concerns that the Certificate’s protections could be waived inadvertently. From the juvenile court’s decision, it is not difficult to imagine a case where a researcher’s response, “I cannot give you Mary Smith’s records. She is in a research study protected by a Certificate,” is interpreted as a waiver of the protections because the researcher confirmed an identified person as a participant in the study.

The juvenile court case also highlights some problems concerning the concept of identifiability. In that case, the judge appears to consider only the identity (i.e., the names) to be protected. In the judge’s view, once the researchers revealed to the department the names of four children who were participating in the study, there was no reason to keep any data relating to them confidential.⁸⁶ This interpretation appears to be too narrow. Certainly when Certificates’ protections only applied to research on illegal drug use, identity was the critical issue. Identifying someone as a participant in such a study revealed sensitive information about them—that is, that they had engaged in illegal activity. But even then, identity in and of itself was not the only issue. Rather, it was—and is—the individual’s identity in connection with some other information that the statute addresses (originally, use of illegal drugs) that creates the risk to participants. This point is reinforced in the illegal drug use context by considering that there are different legal penalties for possessing different types of drugs, as well as different levels of opprobrium and stigma attached to such use; for example, marijuana use is judged less harshly (and is even legal is some states) than heroin use. Thus, the harm to a person identified as a participant in a study of illegal drug use could be increased by also revealing specific information about her drug use. The importance of the connection between the data and the identity is evidenced in the way that NIH describes research topics that are appropriate for a Certificate’s protection, under the current, broader statute. For example, NIH lists “[s]tudies that gather information that if released could be damaging to a participant’s financial standing, employability or reputation within the community; [r]esearch involving information that might lead to social stigmatization or discrimination if it were disclosed” as studies eligible for a Certificate.⁸⁷ This is consistent with the NIH definition of “identifying characteristics,” which not only lists specific identifiers, such as name and social security number, but notes that “any other item or combination of data about a research participant which could reasonably lead, directly or indirectly by reference to other information to identification of that research subject.”⁸⁸ (emphasis added)

Viewed against this background, the juvenile court’s ruling is inconsistent with the purpose of the Certificate. Moreover, if other courts were to follow this approach, such decisions could ultimately stifle the type of research that Certificates are intended to encourage. While it seems likely that the court’s interest in protecting the health and well-being of the children factored into its ultimate decision to require disclosure of the data, it is not clear such disclosure was necessary to do so. Indeed, the researchers already had disclosed to the government their concerns about the children’s welfare, and, as a result, the government had custody of the children.⁸⁹ It is difficult to understand how, under such circumstances, the research data could enhance the government’s ability to protect the children; the government could access medical records, as well as speak with the children, their doctors, and others to get information that might help in their care. Moreover, had the researchers understood that identified data would be subject to compelled disclosure if they reported their concerns, they may have hesitated to disclose, which would have decreased protection for the children.

III. OTHER STATUTORY CONFIDENTIALITY PROTECTIONS

Federal protections

The Certificate is not the only statutory protection for research data. The Department of Justice,⁹⁰ Agency for Healthcare Quality and Research,⁹¹ and the Centers for Disease Control and Prevention,⁹² among others, have statutes protecting research that is conducted by or on behalf of the federal government about identifiable individuals or entities.⁹³ These statutes differ from the Certificate authorizing statute in two important ways. First, they do not require that a researcher apply for the protections. Rather, the protections attach to all research within the scope of the statute. Second, they prohibit disclosure of any of the information collected, not just the identifiers.⁹⁴ Accordingly, this avoids some of the problems arising with data that is not directed identified, but may, when coupled with other information, be identifiable.

The only guidance for any of these statutes comes from a 2001 AHRQ Memorandum on Statutory Confidentiality Protection of Research Data.⁹⁵ The Agency interprets the restrictions of the statute as attaching to “any identifiable research data once it has been collected pursuant to AHRQ-supported programs or projects.”⁹⁶ The terms of the statute are not time-limited—the obligation of protection does not end, even if the original statute is replaced.⁹⁷ The memorandum acknowledges the lack of legal challenges to the AHRQ statute, but notes examples of potential legal challenges and also that the CDC has taken steps to avoid potential legal problems by negotiating solutions with parties to avoid a violation of its similar statute.⁹⁸

State protections

A number of states have adopted statutes to protect research data from compelled disclosure. Some of these statutes are similar to the federal statutes described above, in that they broadly protect data derived from research conducted by or for a state agency.⁹⁹ Other states have adopted protections that are specific to certain types of research, rather than research conducted by or for a particular state agency. These tend to be for research involving potentially stigmatizing topics, such as mental health (Hawaii¹⁰⁰), HIV/AIDS (California¹⁰¹), and genetics (Arkansas and Oklahoma¹⁰²).

One of the strengths of these statutes compared to the Certificate statute is that the protection attaches to all research within the statute’s scope, either by topic or under the aegis of the state entity, rather than requiring a researcher to know about and apply for the protection. In some cases, the protection afforded is stronger than that offered by the Certificate.¹⁰³ For example, the Maryland, North Dakota, and South Dakota statutes explicitly limit the use of the data for purposes other than research.¹⁰⁴ In addition, these statutes refer to any disclosure, not just compelled disclosure.¹⁰⁵ Similarly, the Arkansas and Oklahoma statutes allow disclosure for litigation only if the data form the basis of the claims.¹⁰⁶ Several of these do not appear to be limited to identifiable information, even though they may permit publication of aggregate information.

Although these laws have important strengths compared to a Certificate, they may ultimately be less protective because, as state laws, they may not be able to prevent disclosure where federal law permits or even requires the disclosure.

IV. OTHER AVAILABLE PROTECTIONS

Our interviews with counsel and our review of the cases suggests that there are a variety of legal tools beyond Certificates that can be used to try to protect sensitive, identifiable data from compelled disclosure.¹⁰⁷

First, our interviews and the cases serve as a reminder of the general discovery tools that are available when research data are subpoenaed. Counsel can, and should (where appropriate), object to demands, for example, on the grounds of relevance, materiality, breadth, and burden.¹⁰⁸ Objections can form the basis for negotiating limits on the subpoena, such as excluding identifiers, or, if necessary, for moving to quash the subpoena.¹⁰⁹ The counsel with whom we spoke reported that they frequently are successful in limiting requests using these types of tools. If disputes do go to court, protective orders provide another mechanism for protecting data.¹¹⁰ As our case examples demonstrate, the protective order can be used not only to limit disclosure of identifiable components of data, but also to limit who has access to the data and how they can be used (e.g., limited to the lawsuit in which they were subpoenaed), forbid attempts to re-identify, and require destruction of data held by the requesting party when the litigation ends.

Second, some counsel reported success in protecting data based on First Amendment claims and/or a researcher’s privilege, a concept akin to a reporter’s privilege. These claims have been successful particularly when the data have not yet been published, recognizing the researchers’ interests in the fruits of their labor and in choosing how and when to publish.¹¹¹

V. DISCUSSION

Certificates of Confidentiality and other confidentiality statutes and legal doctrines can be effective tools for protecting sensitive, identifiable research data. However, problems have been identified with understanding about Certificates and their implementation,¹¹² and, as our discussion demonstrates, their protections can be vulnerable to judicial interpretation. In this section, we offer recommendations to improve understanding about Certificates, minimize the vulnerabilities in Certificates’ identified through our analysis, and strengthen the Certificate’s protection.¹¹³

Education regarding Certificates

The Secretary’s Advisory Committee on Human Research Protections (SACHRP) recently recommended better guidance for IRBs on informing researchers about Certificates and suggested that IRBs may want to include questions about Certificates on their application forms.¹¹⁴ We agree with this recommendation, and would expand on that recommendation to include better guidance for university counsel and others who may be involved in the IRB process. Our research suggests that IRBs’ understanding of Certificates is lacking and more education is needed.¹¹⁵ IRBs play a key role in identifying studies for which a Certificate may be appropriate and researchers likely look to the IRB for guidance about the use of Certificates; thus, it is essential that they have accurate information. Lack of understanding may explain why IRBs do not recommend or require Certificates for the full range of studies in which they may be beneficial.¹¹⁶ If they are not alerted to the existence of such protections, researchers may not apply for a Certificate for studies that would benefit from a Certificate’s protections. SACHRP’s suggestion that IRBs include questions about Certificates in the application process is one way to make researchers aware of this tool.¹¹⁷

Any such education should also include instructions for avoiding inadvertent waiver of the Certificate’s protections or expansion of the scope of any waiver. For example, researchers may want to avoid explicitly confirming the participation of any individual when research data are requested and to limit the amount of data shared in response to any request—compelled or otherwise.¹¹⁸ Scrupulously following confidentiality measures will make it easier for an attorney to argue for keeping the data confidential.

Increasing appropriate use of Certificates in the ways just described is not enough to ensure appropriate protections. IRBs, researchers, and their counsel need to understand what they should do if they receive a legal demand.¹¹⁹ Institutions should have policies to ensure prompt responses such demands, including established procedures that researchers should follow if they receive a subpoena. At a minimum, such policies should require notification of appropriate legal counsel as soon as possible to enable counsel to develop a timely response. It would also be appropriate to notify the IRB and, if applicable, the project officer and the Certificate coordinator at the NIH institute issuing their Certificate because of the potential threat to data confidentiality.¹²⁰ This might facilitate better collection of information about legal demands.

We recognize that, for good reasons, counsel may be unfamiliar with Certificates; three-quarters of the counsel we interviewed saw only a few legal demands for human subjects research data, with or without a Certificate, in their careers.¹²¹ Accordingly, to prepare adequate, timely responses, counsel need access to information about legal strategies that have been successful in protecting research data. Because this information is rarely available in reported cases, the shared experiences, such as those we have collected, are vital;¹²² NIH and professional organizations, such as the National Association of College and University Attorneys and the American Health Lawyers Association, should help to gather and communicate those experiences so that they are available to institutional counsel when they need them.

Strengthening Certificate’s protections

SACHRP recommended some changes to the laws concerning Certificates to strengthen its protections.¹²³ This includes a recommendation to expand the Certificate’s protections to non-identified data, at least where reidentification is possible. We agree that expansion of the Certificate’s protection is needed.¹²⁴ When the Certificate protection was first adopted in 1970, the focus on name and other direct identifiers made sense. Particularly in its earliest incarnation, the risk to individuals came from being identified as a user of illegal drugs. However, as technology has advanced, concerns about how data may be used and how to protect private information have evolved. Some have begun to fear that re-identification of individuals may be possible no matter how many “identifying characteristics” have been removed from released data.¹²⁵ A number of recent examples lend credibility to this fear.¹²⁶

While examples of re-identification animate the broader debate about whether de-identification is ever feasible, for our purposes, they serve to illustrate how the world has changed since Certificates were first adopted in 1970, and to suggest that our understanding of what Certificates protect needs to adapt to that world. In particular, to keep confidentiality promises to participants, the research community needs to be prepared to articulate how seemingly unidentified data could be “readily identifiable” and, therefore, should be protected by a Certificate.

Amending the statute to address under what circumstances data are considered “identifiable” in light of technological and informational advances would be the strongest approach.¹²⁷ However, there are also drawbacks to this strategy. First, a statute may not be flexible enough to keep up with rapidly changing technology and increasing availability of information. Some of the specifics may be better addressed through regulations or guidance, which are more easily changed. Second, in the current political environment, getting any legislation passed is challenging, and, thus, it may not be feasible to implement statutory change. Of course, there are political considerations to the regulatory process as well, which may limit the ability to effectuate change.¹²⁸

An alternative approach is for NIH to issue clarifying guidance on these topics. While such guidance can be useful to individuals interacting with the agency (e.g., in this case, can enhance researchers’ and IRBs’ understanding of Certificates), it also has legal significance. While not entitled to as much deference as regulations that interpret a statute that is silent or ambiguous on an issue,¹²⁹ agency guidance is entitled to some deference by reviewing courts.¹³⁰

While deference is not guaranteed, HHS should take advantage of the experience it has with Certificates to educate courts about their purpose and scope. It already does so to some extent through the NIH Certificate kiosk. The kiosk contains a wide variety of information, from basic instructions for investigators, to information about the statute authorizing Certificates, to contact information for NIH legal counsel.¹³¹ However, HHS could expand this information to provide more guidance regarding how it views the Certificates it grants, issues that have arisen, and how those issues have been resolved.¹³² Provided the guidance is consistent with its overall position, which has supported strong confidentiality protections, courts would likely welcome guidance on this otherwise unfamiliar topic. Even if more detailed guidance from HHS does not get deference in judicial decision-making, such guidance can be beneficial from an educational standpoint and provide important, practical information to those confronting a legal demand involving a Certificate.¹³³ In any event, issuing guidance is likely to be the easiest to accomplish¹³⁴ and, therefore, may a good short-term strategy.

Improving communication to research participants about Certificate protections

We previously concluded that the mixed opinions expressed by IRB Chairs about the extent of Certificate protections “may be due, in large part, to true uncertainty in the field rather than misunderstanding or lack of knowledge.”¹³⁵ This uncertainty contributes to challenges in simply and accurate describing the Certificate’s protections to research participants, potentially leading to heightened concern or false reassurance.¹³⁶ IRB chairs and institutional legal counsel both expressed dissatisfaction with the NIH’s sample consent language, although it appears few institutions have attempted to simplify it.¹³⁷ Our interviews with prospective research participants give some support for these concerns. While most interviewees were neither reassured nor alarmed by information about Certificates, a higher proportion who read the NIH standard description said that it raised new concerns compared to those who read our simplified version.¹³⁸ In addition, a higher proportion of those who read the NIH standard description reported sections of the description were unclear.

Conclusion

Our research demonstrates that Certificates have generally been effective as a deterrent to legal demands for research data and may be useful when disputes end up in court. However, those protections have some vulnerabilities, particularly arising from changing technological and informational advances. IRBs, researchers, and, presumably, research participants rely on Certificates to protect sensitive, identifiable research data and facilitate research on important public health issues. We owe it to them to ensure those protections are used appropriately and are as strong as possible. Combined with SACHRP’s recommendations, we believe our recommendations present realistic strategies for improving understanding of Certificates and addressing some of the uncertainty concerning their protections.

Biographies

Leslie E. Wolf received her J.D. in 1991 from Harvard Law School in Cambridge, Massachusetts and her M.P.H. in 1997 from Johns Hopkins School of Public Health in Baltimore, Maryland.

Mayank J. Patel received his J.D. in 2012 from Georgia State University College of Law in Atlanta, Georgia and his M.P.H. in 2009 from the George Washington University in Washington, D.C. He was a research assistant with Professor Wolf from 2010-2012.

Brett A. Williams Tarver received her J.D. in 2012 from Georgia State University College of Law in Atlanta, Georgia. She was a research assistant with Professor Wolf from 2010-2012.

Jeffrey L. Austin received his J.D. in 2012 from Georgia State University College of Law in Atlanta, Georgia. He was a research assistant with Professor Wolf from 2010-2012.

Lauren A. Dame received her J.D. in 1983 from Harvard Law School in Cambridge, Massachusetts and her M.P.H. in 1992 from the Harvard School of Public Health in Boston, Massachusetts.

Laura M. Beskow received her M.P.H. in 1995 from Boston University and her Ph.D. in Health Policy and Administration with a minor in Epidemiology in 2005 from the University of North Carolina in Chapel Hill, North Carolina.