The Certificate of Confidentiality (Certificate) is an important tool for protecting identifiable, sensitive human subjects research data in the United States. However, little is known about the Certificate’s effectiveness in protecting identifiable data. We interviewed 24 legal counsel representing U.S. research institutions about their experiences with legal demands for research data. Our respondents reported few, if any, legal demands over the course of their tenure, but two-thirds had experience with legal demands for data protected by a Certificate. They reported such demands often were resolved without disclosure of identifiable research data, typically without court intervention. While our respondents reported similar success protecting identifiable data in court, they often did not rely on the Certificate to do so.

Précis In its Advanced Notice of Proposed Rule Making (ANPRM), the US Department of Health and Human Services proposed substantial changes to how biospecimen research is treated under the regulations governing human subjects research. Currently, much of this research can be conducted without consent because it may not be considered “human subjects” research, is considered exempt, or consent may be waived. Responding to criticisms that scientific changes have made biospecimen research riskier than contemplated when the Common Rule was last amended, the ANPRM proposes to require written consent for biospecimen research, even if they have been stripped of identifiers or initially collected for a non-research purpose. The ANPRM’s recognition of these risks is consistent with relatively recent NIH recommendations that research projects involving genetics, genomics, or biospecimen repositories should consider getting a Certificate of Confidentiality to provide additional protections to participants where breach of confidentiality is typically the primary risk. Ironically, the ANPRM proposals may make it more difficult to provide these protections. Our paper explores the implications of the conflicting requirements of the Certificate and the ANPRM proposals and makes recommendations for achieving the dual goals of appropriate consent and adequate confidentiality protections.

No abstract

No abstract