Frequently Asked Questions: Research Involving Human Subjects

What exemptions of the Common Rule are most appropriate to social science research?

The Common Rule states that there are eight categories of research that are exempt from full IRB review. The first four of the exemptions are most appropriate for social science research:

1. Research in educational settings involving educational practices that are not likely to adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction (§ 104 (d) (1)).
2. Research involving educational tests (cognitive, diagnostic, aptitude, achievement), surveys, interviews or observations of public behavior, if either the information is recorded in manner such that the identity of the human subject cannot be readily ascertained, or any disclosure would not put the subjects at risk of civil or criminal liability or be damaging to their financial standing, employability, educational advancement or reputation (§ 104 (d) (2)).
3. Research involving benign behavioral interventions with adults who prospectively agree when information collection is limited to verbal or written responses (including data entry) or audiovisual recording, and the information recorded cannot be readily linked back to subjects, or any information disclosure would not place subjects at risk of harm (§ 104 (d) (3)).
4. Secondary research use of identifiable private information or identifiable biospecimens it is publicly available or was recorded in a manner that the identity of the human subjects cannot be readily ascertained (§ 104 (d) (4)).
5. Research and demonstration projects designed to study public benefit or service programs (§ 104 (d) (5)).
6. Taste and food quality evaluation and consumer acceptance studies (§ 104 (d) (6)).
7. Storage or maintenance of identifiable private information or biospecimens for secondary research (§ 104 (d) (7)).
8. Secondary research using identifiable private information or identifiable biospecimens ((§ 104 (d) (8)).

Exempt research is free from continued oversight by the IRB, although the institution (either a designated IRB representative, the entire committee or some other institutional authority), not the researcher, must determine that the project is exempt in the first place. Usually this is accomplished through a brief review process.

Does this mean that all questionnaire, educational test and interview-based studies are exempt?

Such studies are usually exempt unless:

• Specific individual human subjects can be identified directly or through identifiers linked to them (i.e., their names, telephone numbers or other unique identifiers are recorded in the data).
• Disclosure of their responses could place them at risk of criminal/civil liability or damage to their financial standing, employability or reputation.

Research on vulnerable populations may not be exempt. Consult with your local IRB or NSF program officer for guidance in specific cases.

Are third parties human subjects in research?

The Common Rule defines a human subject as "a living individual about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information" (§ 690.102(e)). When respondents give information about other people who are not directly interviewed these others are known as "third parties."

The goals of the Common Rule apply to any person who has the potential to be harmed because of a research project, whether or not the person is directly interviewed or identified through an interview with someone else.

A research project should be assessed for the likelihood that third parties could be harmed. If the project is low risk, then no special oversight is required.

If the data are stripped of identifiable private information, then no "human subjects" are involved. The IRB records should retain information about the process leading to this determination.

The project information should be kept confidential; the level of confidentiality (applicable to all identified persons, not just interviewed subjects in the research) should be commensurate with the level of risk.

Additional provisions may apply in the case of health information privacy and confidentiality (HIPAA). These provisions generally require securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them.

The regulations do not automatically mandate informed consent from third parties. If the potential risk is serious and not ameliorated by confidentiality procedures, then consent is necessary.

Is secondary analysis of data human subjects research?

Much research in the social sciences deals with the re-analysis of data often available in a "public use data file." This is known as "secondary analysis". The goals of the Common Rule apply to any person who has the potential to be harmed because of a research project, whether or not the person is directly interviewed or identified through data collected by another researcher for a different purpose. Public use data files are normally stripped of identifiable private information or "de-identified." In this case, the research is exempt since no identifiable human subjects are involved (§ 690.102.e.1). When identifiers are included in the data, several issues should be considered:

• The research project should be assessed for the likelihood that identified respondents could be harmed or easily identified. If the project is low risk, then no special oversight is required. If the data is de-identified, then no "human subjects" are involved in the research.
• The project information should be kept confidential and the level of confidentiality commensurate with the level of risk applicable to all identified persons.
• The regulations do not mandate informed consent from identified persons in secondary datasets although it may be required. If the potential risk is serious and not ameliorated by confidentiality procedures, then consent is necessary. Medical records may be subject to additional regulations.

What about merging public data files or enhancing a public data file?

This activity requires IRB review to verify that the risk of identifiability has not occurred or increased. It also requires that an adequate data protection plan for confidentiality is in place.

What if the project intends to link data from a new survey to existing individual-level data from public data sources?

Whenever appropriate, the subjects should be provided with additional pertinent information about the use of their data. The researcher should inform the research participants of efforts to link their data to public data sources in the process of obtaining consent.

What if the project decides to link data from a new survey to existing individual-level data from public data sources after the survey has been completed?

If the level of confidentiality in the new data set created by the linkage is less than that in either of the pre-existing sets, then the change in research design must be examined by either the IRB official or fully convened IRB depending upon whether the initial review was exempt. Following that review, after evaluating the level of risk involved, a waiver of informed consent may be recommended if risk of harm is low and adequate confidentiality procedures are in effect.

What sorts of harm can arise from social and behavioral science research?

Here are some typical examples:

• Harms commensurate with daily life, requiring no special protection:
  • Mere inconvenience when a survey or other research interaction is administered at an inconvenient time or place or simply takes a long time to administer.
• Harms that have the potential for serious effects, which IRBs should examine:
  • Emotional or psychological harm, for example when a research interaction causes upset, or worry about breach of confidentiality.
  • Social harm due to stigma or other negative social outcomes of breach of confidentiality.
  • Physical harm if revelations about others get back to those persons, particularly when researchers study domestic violence, gang activity, political activity in a conflict zone, or other phenomena concerning violence-prone individuals.
  • Financial harm if revelations result in loss of employment or insurance coverage.
  • Legal harm when illegal activities are disclosed.
  • Moral harm when participation in research strengthens subjects' inclinations to behave unethically.

Informed consent in social and behavioral science

What is informed consent?

When there is likely to be some risk of harm or inconvenience to certain subjects, they should receive enough information to judge whether the risk is at a level they can accept. Research participation in most social-behavioral research involves time and possibly some inconvenience and discomfort. An adequate informed consent process can sort out those who would gladly participate from those who wish to opt out. Persons may agree to undertake some risks or inconveniences, which they would reject if unilaterally imposed upon them.

The emphasis of informed consent should be on effective communication with appropriate opportunity for exploration, asking questions, achieving clarity and understanding, reflecting and making reasoned decisions (§ 116, §117). The elements of informed consent include:

• A statement that the study involves research and an explanation of its purpose.
• A description of any reasonably foreseeable risks to the subject.
• A description of any benefits to the subject.
• A disclosure of appropriate alternative procedures of courses of treatment.
• A statement describing the extent to which confidentiality of identifying records will be maintained.
• An explanation as to compensation or treatment available if injury occurs, when the research involves more than minimal risk.
• An explanation of whom to contact for answers to pertinent questions about the research and subjects' rights.
• A statement that participation is voluntary and that the subject may withdraw their participation at any time for any reason.

If the research involves no more than minimal risk, an IRB may waive requirements to obtain informed consent.

The process of informed consent

Researchers and IRBs should distinguish between the process of informed consent and the documentation of informed consent.

Informed consent should take the form of a friendly, easily understood communication process with competent participants that continues throughout the research. It should provide a basis for subjects to decide about participation.

Ideally, informed consent should be a verbal exchange between researcher and subject, with a written summary of the information for the subject to keep as appropriate. When written, it should be brief, and simply phrased at a reading level that the least literate subject can understand.

Subjects should feel free to raise questions at any point in the research, as they may develop questions or concerns when they are well into the research experience. For example, a discussion of confidentiality may not be really understood until they are asked very personal questions in the research experience. When the research procedure is long and complex, the researcher should take extra precaution to make clear that the subject is free to ask questions at any time.

IRBs should be flexible in considering a wide range of media as possibly appropriate for administering informed consent, given varying degrees of risk. Video tapes, brochures, group discussions, websites and so on can be more appropriate ways of communicating with potential subjects than the kinds of legalistic formal consent forms that have often been used.

Documentation of informed consent

The initial agreement to participate can be documented in various ways. When appropriate, usually where risks of harm are substantial, individually signed forms are the "gold standard" of informed consent. When documentation by written consent forms is required (§ 117 (a)) then the regulations discuss two forms: a long and a summary, short form (§ 117 (b) (1) & (2)).

IRBs and researchers should not defeat the purpose of informed consent by substituting a legalistic consent form for an effective communication process. If signed forms are appropriate, signing the form should not be perfunctory, unreflecting and automatic. When written informed consent would be the only identifiable link to research participants, it may increase risk and, in some circumstances, should be avoided.

The IRB may approve a consent form that does not include, or alters some or all elements of informed consent, or waive the requirement to obtain informed consent. An IRB may waive the requirement for the researcher to obtain a signed consent form for all subjects.

Advice on the informed consent process

Common sense, courtesy and standard social norms should dictate what is communicated when asking such persons to participate in research.

• The cultural norms and lifestyles of subjects should be considered in deciding how to approach informed consent. Issues such as whether to present material in printed form, deal with subjects individually or in groups, seek the consent of gatekeepers or superiors in lieu of or in addition to individual subjects' consent, and whether to treat underage persons differently should be dictated by the culture and context of the research and the level of risk.
• Persons should be treated respectfully in accordance with their culture and circumstances. People who are functionally illiterate, who are suspicious of persons who proffer documents or require signatures, or from non-industrialized cultures should be approached in the style that is most comfortable to them. Protocols for research on such populations should show evidence that the researcher is informed about the culture of the intended research population and has arranged the informed consent and other research procedures accordingly.
• Detailed recitation of irrelevant information demeans the communication and is slightly insulting. People are capable of deciding whether to participate in surveys and ethnographic research. Assurances that there are no risks and descriptions of measures taken to assure confidentiality can be irrelevant, irritating, misleading, and may not decrease the risk of harm.
• When subjects are peers or superiors of the researcher, extremely detailed verbal informed consent is often unnecessary, and written consent may not be appropriate, unless the research is concerned with sensitive personal information.

My university does not have an "exempt" category for research, only "expedited" and "full review" categories. What does this mean in terms of social science projects that the federal government has declared "exempt"?

The regulations specify exempt research at § 104 (d) and expedited review at § 110. Your university requires that the IRB or some other non-involved person, and not simply the investigator, must confirm that the project is in the exempt category. For that determination to be made, the project must be examined by an independent authority. Exempt projects are usually free from continued oversight by the IRB unless the nature of the project changes.

On the other hand, your university may have simply collapsed the exempt and expedited categories of research together. In an expedited review, typically only one experienced member of the IRB committee, or the chair of the committee, will review the project and confirm that the project is indeed minimal risk, or a minor change to a previously approved protocol, and meets the criteria for expedited review.

What flexibility does the IRB have in applying the Common Rule?

The purpose of the federal regulations is to obtain the benefits of research for society while minimizing the risks of harm to human research participants. To further this goal the regulations encourage IRBs to make independent, informed judgments, using common sense and expertise to apply a standard set of rules to diverse research situations, and to document the procedure followed in arriving at its judgment.

For example, sections §116 (c), (d), and §117 (c) discuss flexible procedures that may be used to administer informed consent, depending on the specifics of the research project. Informed consent is the procedure by which the researcher respects the autonomy of research participants (as discussed in the Belmont Report).

Since written documentation of informed consent can create harm for research participants in some circumstances, it should not be routinely required in all cases. For example, research should not use signed forms when the focus is on illegal behavior, or on partisan political activity in violent areas, where signed forms may potentially increase risks to the participants. Here the respondent's signed form could expose him or her to harm from state authorities or private vendettas.

Your IRB can authorize a waiver of written consent forms or other formal consent procedures under specified conditions. (See 45 CFR Part 46 §116, 45 CFR Part 46 §117, Informed consent in social and behavioral science, and When a signed consent form can harm a participant).

What if the researcher and the IRB disagree about the risk and appropriate action to be taken in the project?

The regulations do not discuss procedures for resolving conflicts between IRBs and researchers. Each institution should develop a written set of procedures for resolving differences of opinion. For example, perhaps a conversation could be scheduled between the research office administrator, the IRB chair, the researcher, outside consultants if deemed appropriate, and the funding agency representative. The major principles to be respected in any mediation procedure should include:

• Limitation of risk of harm to human subjects.
• Reasonable implementation of informed consent.
• Avoidance of conflicts of interest.
• Advancement of knowledge through research.
• Oversight commensurate with the level of risk.
• Adherence to the Common Rule.

Ultimately, however, authority to approve the research must rest with the IRB.

Advice to IRBs on dealing with researchers

The advance of scientific research is a vital interest of the U.S. Your institution is by definition an important part of the U.S. research effort. The institution should provide enough resources to enable the IRB to:

• Act in a timely way on research protocols. Expedited reviews should take no longer than five working days.
• Incorporate sufficient expertise to review the research presented to you (§107 (a)). The institution should provide a roster of experts to the Office of Human Research Protections of HHS, without conflicts of interest with the research, willing to contribute to the IRB discussion of every proposal.
• Seek ways to streamline the process. Proposals may be reviewed on-line to minimize paper clutter; departmental representatives could be included in the IRB to triage the reviews.
• Give talks and workshops for departments (and especially for their graduate students) whose protocols are often problematic; make handouts or on-line materials that suggest useful procedures for handling human subjects issues that frequently arise.
• Make sure that your institution's library carries books and articles that offer useful guidance on sensitive issues such as research on children, procedures for assuring confidentiality of research data, state laws concerning mandated reporting of child or elder abuse, etc.
• Offer to consult with researchers as they design their research and as they prepare their protocols.
• Ensure that the IRB includes members who are, themselves, researchers and who are knowledgeable about research design and human subjects protections. Have a directory available to researchers to identify which IRB staff or member to consult with for any given type of problem.
• Be willing to work with researchers to help them improve their protocols rather than rejecting problematic protocols.

Remember that the time you spend being helpful before a protocol is finished saves everyone's time, creates goodwill, and earns the IRB a reputation that will make it easier to recruit top notch researchers to your institution and to the IRB membership.

Advice to researchers on dealing with IRBs

Researchers can do several things to avoid problems with IRB review:

• Become familiar with the federal policies and regulations and with the local IRB procedures.
• Provide the IRB with sufficient information to allow them to accomplish their job.
• Volunteer to serve on the IRB.
• Consult with the IRB as soon as you begin to consider doing sensitive research or research on a vulnerable population, learn their concerns and recommendations, and ask them the best ways to solve the problems they mention. If they suggest solutions you cannot live with (e.g., getting written consent when you know this would be virtually impossible or would compromise your sample, rendering the research invalid) let them know their requirement means you can't do the research. If they cannot respond in a way that is helpful, consult with the following and provide written documentation of what you learned from them.
• Refer to your scientific society's code of ethics or discuss the issue with representatives of your scientific society. Official representatives of your scientific society may be unwilling to give advice but may refer you to members who are knowledgeable and who might advise you.
• Consult with the agency (actually or potentially) funding your research.
• Consult with researchers who have worked on this kind of sensitive research and learn how they and their IRB resolved the problem.
• Consult the ethics/methodology literature on this issue.
• Check the federal regulations to see what options they allow, but which your IRB may not wish to follow. Remember that your IRB has the option of being stricter than the regulations, but it may be useful to remind them that you are operating within the regulations.
• Consult the OHRP guidance.

How should research involving "snowball samples" be handled from a human subjects perspective?

In a "snowball sample" each respondent is asked to suggest other persons for inclusion in the research. These persons are then contacted to see if they wish to serve as research participants.

This is a valid procedure often used by investigators who seek to recruit from populations for which adequate sample frames are not available. For example, a researcher seeking to study patterns of informal leadership in a community may ask individuals to name others who are influential in a community. Similarly, studies of the diffusion of ideas and acceptance of new technologies can be traced through scientific and medical communities.

Snowball samples in and of themselves do not necessarily pose a risk for human subjects. IRBs should follow the normal procedure of examining the project for risks of harm commensurate with normal life. Each respondent is given the opportunity to participate or to decline participation.

For studies studying sensitive topics, study protocols should adhere to the recommendations for confidentiality. For example, studies of networks of drug users or tracking sex partners of HIV+ cases require extreme caution with information gathered from one subject about another. All information should be treated confidentially (See Certificate of confidentiality).

How should IRBs deal with research in foreign countries?

The U.S. institution administering the research has the primary responsibility, normally codified in an assurance, to ensure that the project complies with U.S. regulations. The Common Rule § 101 (h) discusses foreign human subjects regulations and procedures for substituting them for U.S. regulations. When an appropriate foreign IRB exists, the regulations foresee involving it in reviewing the research. The U.S. institution's IRB chair determines that the procedures prescribed by the foreign IRB afford protections that are at least equivalent to those provided in the Common Rule.

This regulation is most germane to biomedical research, as few foreign countries apply human subjects regulations to social and behavioral science. In many foreign countries IRBs deal only with biomedical research and will refuse to extend their purview to cover social and behavioral science. In other foreign situations there will be no analogue to an IRB and the concept may be irrelevant.

When this situation occurs, the U.S. institution remains the responsible authority, and the services of a foreign IRB might not be necessary.

Can research proceed at a foreign institution if no foreign IRB has reviewed the research?

The Common Rule discusses cooperating research institutions at §114, which envisions each institution reviewing the research through its IRB. When institutions are in foreign locations with no tradition of IRB review of the relevant research, the review of the U.S. institution may be sufficient. If the IRB has concerns about the risk of harm to research participants, the IRB should make a serious effort to involve appropriate cultural expertise in its review by soliciting the cooperation of persons knowledgeable about the customs and language in the society where the research will occur.

There are options that can be considered in order to ensure that research proceeds even in the absence of a foreign IRB. Some foreign IRBs have Federalwide Assurances (FWAs) and can be used for the review of research to be conducted in that country. Alternatively, a foreign IRB or ethics board in the country where the research is to be conducted can review the research.

Does research conducted as a classroom exercise count as human subjects research?

The Common Rule defines research as "a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge" (§ 102.(l)).

Several sets of activities (not academic fields) are deemed to not meet the definition of research:

• Scholarly and journalistic activities where the focus in on the specific individual about whom the information is collected. This includes "oral history, journalism, biography, literary criticism, legal research, and historical scholarship."
• Government activities such as public health surveillance activities, information collected for criminal justice or national security purposes.

How can research conducted as a classroom exercise be reviewed to protect human participants?

Since the Common Rule exempts classroom exercises (see Does research conducted as a classroom exercise count as human subjects research?), the IRB has no mandated role to play in reviewing such exercises. However, the IRB typically is the only institutional store of expertise about human subjects protections and may in principle be involved in such research in an oversight function.

The following suggestions are offered as guidance for institutions seeking to protect participants from harm in such situations without overburdening IRBs with needless review responsibilities.

• The relevant department should set up a Human Research Committee to review classroom exercises for harm to participants.
• The department should state, in writing, what sort of research is reviewed in the department (i.e., classroom exercises, non-federally-funded research, etc.) in contrast to research which must go to the IRB.
• The department should state, in writing, the criteria used to evaluate proposals (i.e., voluntary participation, informed consent, lack of risk of harm, lack of deception, procedures for ensuring confidentiality of data), and the mechanism used to perform the evaluation (i.e., a standing committee, an ad hoc committee appropriate to specific proposals, etc.).

The department should specify, in writing, the records it will keep. This may consist of the proposal itself, each reviewer's comments, correspondence with the researcher including requests for revisions and responses to requests. These records should be open for inspection at any time by the IRB or the designated institutional official. There should be at least one review per year.

It is a good idea for one member of the departmental committee to be a formal member of the IRB, to insure appropriate levels of communication between the department and the IRB, and training for the departmental committee.

Deception

Deception in research involves lying to or intentionally misleading subjects. Withholding information may or may not be deception. For example, telling subjects that an urn contains an unspecified number of red and blue balls, and inviting them to participate in an experiment by guessing the number, would not involve deception because the subjects "know what they don't know."

Concealing the fact that there is a hidden camera would be deceptive. The distinction is whether subjects have the information to make an informed choice about whether to participate in the research. Secretly filming their behavior denies them the opportunity to consider whether or not they want to be filmed for research. Not telling them how many balls are in the urn is part of the accepted framework for a participant to guess the number.

It may be important in some research to withhold the specific theoretical purpose of the research from subjects, in order not to bias their opinions. If done in a neutral way, it would not be deceptive. If subjects are intentionally led to believe that the research is for a purpose different than the actual purpose, this would be deceptive.

Deception potentially poses ethical problems and should be dealt with by weighing the benefits of the research against the harm (if any) from the deception. Aside from any potential harm to participants, deception can also harm the institution by building the perception among potential subjects that "researchers are liars." The IRB should follow the regulations in § 690.116.

What issues arise concerning compensation?

The Common Rule does not address the compensation of subjects for participation in research. Good ethical practice suggests some guidelines:

• Researchers should be careful about paying compensation to subjects who are placed at risk, so that the payment is not seen as coercive. A high payment may induce a needy participant to take a risk that they normally would clearly prefer not to take. That concern would not exist when the risk is minimal.
• Advertising the amount of compensation in order to give information to potential subjects poses no risk or ethical problem.
• Sometimes compensation can take the form of a lottery. Provided that subjects do not risk their own money, this is not gambling. Lotteries are often part of the research design, for example in studies of attitudes towards risk. In assessing whether lotteries involve appropriate levels of compensation, the expected value (the prize amount divided by the number of contenders) of the lottery should be assessed, not the size of the largest prize.
• Compensation may depend on circumstances or performance, for example, when participants are paid on the basis of the choices they and other participants make. The Common Rule does not suggest that this is improper, and researchers have not reported ethical or practical problems arising from these circumstances.

Does this mean that I cannot collect or record personal identifying information?

If you collect information on individually identified participants from publicly available sources, the project may be in the exempt category as long as that information would not cause harm to the individual if it were known. For example, recording observations of everyday public behavior or interviewing people about non-controversial opinions or preferences.

Does this mean that I cannot collect or record personal identifying information when studying sensitive topics?

If the personal identifying information could harm the participant, then the project would need to be reviewed by the IRB. The IRB might require informed consent to be obtained, including a description of the confidentiality procedures to be used. The IRB should be convinced that the subject can understand the procedures for confidential handling of the information as communicated in the consent process.

On the other hand, your university may have simply collapsed the exempt and expedited categories of research together. In an expedited review, typically only one experienced member of the IRB committee, or the chair of the committee, will review the project and confirm that the project is indeed minimal risk, or a minor change to a previously approved protocol, and meets the criteria for expedited review.

Doesn't the Common Rule demand confidentiality in research records?

The Common Rule addresses privacy of information about persons and confidentiality of data. A research project involving individual information about respondents can be exempt under either of two conditions:

• If the information is not linked to the respondent's identity (§ 101 (b) (2)) (e.g., it is anonymous).
• The information is linked to the respondent's identity, but the nature of the information is such that disclosure will not be reasonably expected to cause harm (§ 101 (b) (2)). Non-anonymous data recording can be exempt if any breach of confidentiality will not cause harm beyond that encountered in everyday life. Historical or other research where the respondent is fully aware that publication will involve names, or where the information is in public records, is not of concern here.

The Common Rule thus explicitly allows social and behavioral science research involving minimal risk to record the identity of respondents in the data. Whether or not the research is exempt, professional ethics and respect for persons mandate confidentiality unless the participant agrees to release the information (§ 111 (a) (7)).

What is the difference between privacy and confidentiality?

The Common Rule defines "identifiable private information" as "private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information" (§690.102(e)(5)).

• Privacy refers to persons and to their interest in controlling the access of others to themselves.
• Confidentiality refers to data and to the agreements that are made about ways in which information is restricted to certain people.

Identifiable information collected through research should be kept confidential as much as possible, as a matter of professional courtesy, no matter whether there is an identified harm or not in accordance with any promise made in the consent form (unless the research is such that respondents clearly understand that identities will be published, as in historical studies).

Successful confidentiality begins from the top, and implies a research culture which involves everyone, whether they normally have access to project files or not, being aware that identifiable private information must be kept confidential.

There are many techniques for insuring confidentiality and of de-identifying data, from simple to complex (See What are the major techniques for protecting confidentiality?). The level of confidentiality should match the level of risk inherent in the project and with any promise made in the consent form.

What are the major techniques for protecting confidentiality?

The following techniques for assuring confidentiality are listed on a continuum according to the degree of prospective harm that may occur:

• The simplest procedure to insure confidentiality is to substitute codes for personal identifiers and to store the key in a different locked physical location.
• Another simple procedure is to remove the face sheet, which typically contains personal identifying information such as name, telephone and address.
• Data with personal identifiers should be kept in locked files, and access to the data should be controlled by the researchers with specified procedures.
• Research assistants should be educated in the importance of confidentiality and the potential risks of harm to subjects. In situations of serious risk assistants could be asked to sign confidentiality agreements.
• Access to the data can be controlled electronically, perhaps by storing very sensitive data on computers not attached to a network where hackers could penetrate the files. Electronic files can be protected with keywords, and portable computers should be appropriately secured.
• The data can be manipulated electronically, for example by encrypting data files. The data can also be recoded to eliminate identifiers by collapsing it into categories.
• Research involving many data files on the same person can use anonymous linkage systems.
• Certificates of Confidentiality: If research is contemplated on a topic which is likely to be subject to legal proceedings, the federal government can issue a "Certificate of Confidentiality" which shields the data from required disclosure by the researcher. Under section 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize persons engaged in biomedical, behavioral, clinical or other research to protect the privacy of individuals who are the subjects of that research. This authority has been delegated to the National Institutes of Health (NIH). Persons authorized by the NIH to protect the privacy of research subjects may not be compelled in any federal, state or local civil, criminal, administrative, legislative or other proceedings to identify them by name or other identifying characteristic. Visit NIH's Human Subjects Research website for more information, including detailed application instructions.

Where can I find information about confidentiality in data?

The following resources provide additional information on confidentiality in data:

• "Improving Access to and Confidentiality of Research Data: Report of a Workshop" (2000, National Research Council Committee on National Statistics).
• "Summary of Human Subjects Protection Issues Related to Large Sample Surveys" (2001, U.S. Department of Justice Bureau of Justice Statistics).
• "Report on Statistical Disclosure and Disclosure-Avoidance Techniques" (1978, Federal Committee on Statistical Methodology (FCSM)).
• "Report on Statistical Disclosure Limitation Methodology" (2005, FCSM).
• Resources for Confidentiality and Data Access Information (FCSM's Confidentiality and Data Access Committee).
• Doyle, Pat, Julia Lane, Jules J. M. Theeuwes, and Laura V. Zayatz. Confidentiality, disclosure, and Data Access: Theory and practical applications for statistical agencies. Amsterdam: Elsevier, 2001.

Is ethnography covered by the Common Rule?

Ethnography refers to a type of social science research where the researcher studies human behavior in a natural setting, rather than in a laboratory, for purposes of understanding the culture of that particular population. Research may involve observations and/or interviews with people in that setting. Since human participants are involved, the research is covered by the regulations.

Is ethnographic research exempt?

Depending on the specifics of the research project, ethnographic research may be exempt, qualify for expedited review, or require full IRB review. Although research involving public behavior is exempt under the Common Rule, projects focusing on sensitive information, where the disclosure of responses could harm the respondent, require full review.

Is written documentation of informed consent required in ethnographic research?

Ethnographic research interviews are not necessarily formal interviews with a questionnaire. They often are simple conversations on the respondent's home ground (as opposed to the researcher's laboratory). Competent adult individuals have the option of participating and responding to questions or the respondent has the choice of not allowing the researcher access to his or her person, ignoring requests for information, giving misleading replies or responding to requests in other ways that preserve the respondent's dignity and independence. Informed consent is usually implied by the respondent's willingness to talk to the researcher.

In most ethnographic projects a request for a written, formal consent would seem suspicious, inappropriate, rude and perhaps even threatening. In other words, written consent can potentially harm the research interaction and generate rather than ameliorate concern in respondents. In many parts of the world, for many people with a history of exploitation and unfair dealings with authorities and government, a request to sign a form is fraught with danger. Respondents may not be fully literate, may not have familiarity or experience with social science research, and may have learned to expect the worst from strangers through experience or popular belief.

The roles of women and minors are not necessarily the same in other societies as in the U.S. In many cultures women and children are forbidden from making any agreement without their husband's or father's permission, which may not be appropriate in all situations. Written informed consent in such cases would be impossible to obtain, or if obtained would generate concern in respondents.

Researchers should be sensitive to such cultural differences within the U.S. as well as in cultures outside the U.S. A vital aspect of protecting and respecting human subjects is to "do your homework" of learning about the cultural norms of those you wish to study. Expertise regarding the locale is essential and may be provided by the investigator or a consultant. In these circumstances, the Common Rule authorizes a waiver of written documentation. § 117 (c) (1) discusses situations where the only record linking the subject and the research would be the consent document, and the principal risk would be potential harm resulting from a breach of confidentiality.

§ 117 (c) (2) deals with waiving written documentation of informed consent in situations where "the research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context." This covers a large portion of ethnographic research on non-sensitive topics.

How should IRBs proceed in reviewing ethnographic research?

As with any project, the IRB administrator should assess the research to determine if there is any risk of harm to participants (beyond that which might be experienced in daily life), to determine whether the research is exempt or qualifies for expedited or full review.

What is "group consent" and how is it relevant to informed consent?

The concept of informed consent derives moral force as a mark of respect for persons. The request for informed consent envisions each human being as autonomous and capable of making informed judgments about appropriate personal activities.

Many traditional societies rely on an elder or group of leaders to express decisions with respect to the group. An individual community member who acted independently, without the knowledge and consent of the group, might be seen as suspicious, perhaps acting counter to the best interests of everyone. The appropriate way for a foreigner to get permission to do research in a setting like this would be to present the project in an open meeting, allowing questions to be raised and answered publicly. After formal group approval, any individual member of society would be free to cooperate or not with the research project.

In all societies, when research is planned in sharply defined communities, consultation with community representatives may be necessary in order to avoid negative gossip and refusals to participate. Such community consultation and public relations is part of a good research design and not a substitute for individual informed consent.