Investigators must anticipate the potential current and future uses as well as potential disclosures of private information during the protocol design phase and discuss these uses and disclosures with potential subjects during the consent process. For example, if investigators plan to retain data collected during a research study for future secondary research purposes, then consent and authorization should be obtained from the subjects to store and use the information for these future research purposes. Consent to store the data for future unspecified research should be obtained separately from consent to participate in the initial research. Potential subjects should also be informed about how their private information will be secured and who, listed by job titles and institutions, will have access to it, both in the immediate study and in any future studies. Potential subjects must also be informed of those individuals, listed by job titles and/or agency who may view the data as part of their study oversight/auditing function.
Investigators are required to specify the limits of their ability to maintain confidentiality of a subject’s data and communicate this to a potential subject during the consent process. If private information collected from a subject is to be incorporated into his/her medical record, school file, or any other similar record where others may have access to it in the future, the subject must be notified during the consent process and the investigator must ensure, to the extent possible, that the potential subject understands who may access those files in the future. In some cases separate confidential research files can be created. The circumstances under which the investigator might have to disclose information mandated by law (e.g., suspicion of child abuse or elder abuse) should also be disclosed during the consent process, where appropriate. Investigators should attempt to anticipate situations that might require disclosures and inform potential subjects. By properly disclosing the circumstances under which private information may be released, and its potential uses and recipients, during the consent process, the investigator can avoid ethical dilemmas later.
In certain areas of Yale University, the HIPAA regulations apply. These regulations restrict an investigator’s access to, as well as use and disclosure of, a subject’s (or potential subject’s) health information without his/her authorization. This authorization is separate from the protocol’s consent agreement. This authorization form may be combined with the consent form but it is often kept separate as the consent form usually contains additional information that may not be appropriate in the permanent medical record. More information on obtaining informed consent can be found in module #2, Informed Consent. More information on HIPAA can be found in the Applicable Regulations and/or Guidance From Professional Associations section of this module.