How clinical trials protect your privacy

§1 The promise in the consent form

The consent form is where a study tells you, in writing, how it will treat your information. Look for a confidentiality section explaining how records are stored, who may view them and whether results could ever identify you. These statements are reviewed by an ethics board before the study opens.

§2 Federal rules for human research

Most federally funded studies follow the Common Rule, and studies of FDA-regulated products follow FDA rules. Both require an ethics board to check that a study has adequate provisions to protect privacy and keep data confidential. That review happens before enrollment and continues while the study runs.

§3 HIPAA and the authorization form

When a study uses health information held by a hospital or clinic, the HIPAA privacy rule usually requires your written authorization. The form names what information can be used, who may receive it, the purpose and when the permission ends. Some authorizations never expire for research; the form must say so.

§4 Codes instead of names

Research forms normally carry a study number rather than your name. The key linking the number to you stays at the study site, often in a locked file or a restricted system. The organization funding the study and the statisticians who analyze results usually work only with the coded data.

§5 Certificates of Confidentiality

A Certificate of Confidentiality protects identifiable research information from forced disclosure, for example by a subpoena in a lawsuit. Since 2017, studies funded by the National Institutes of Health that collect identifiable sensitive information receive one automatically. Other studies can apply. The consent form will mention it if one applies.

§6 Security of systems

Study data is often entered into secure electronic systems with passwords, access logs and encryption. Paper records are kept in locked cabinets. Sites train staff on privacy, and monitors check that procedures are followed. Ask how your data is stored, and whether it ever leaves the country.

§7 Publishing without names

When results are published, they describe groups, not individuals. Journals and registries such as ClinicalTrials.gov show totals, averages and percentages. In rare diseases with very few participants, teams take extra care so that details like age and location together cannot point to one person.

§8 What privacy cannot promise

No system is perfect. Breaches happen, and some disclosures are required by law, such as reporting certain infectious diseases or suspected abuse. Regulators may inspect records to confirm a study was run properly. A good consent form lists these limits honestly rather than promising total secrecy.

§9 Privacy in studies run outside the United States

Many trials enroll people in several countries. Data collected abroad may follow local laws such as the European Union’s General Data Protection Regulation, which gives people rights to know how data is used and, in some cases, to have it erased. When a US study sends coded data overseas, the consent form should say where it goes and which protections stay attached to it. Ask whether any part of your record will be stored outside the country, and under whose rules.

§10 Changing your mind

You can usually withdraw a HIPAA authorization in writing at any time. After that, the study should stop collecting new information about you. Data already gathered may still be used where needed to keep the results reliable, and the consent form should explain this before you agree.

Privacy checklist

• Read the confidentiality section slowly
• Read the HIPAA authorization separately
• Note who is listed as able to see records
• Check whether the permission expires
• Ask whether a Certificate of Confidentiality applies
• Ask how and where data is stored
• Ask what happens if you withdraw
• Keep your signed copy

Summary table

Definitions

Common Rule

Federal rules for research with people.

HIPAA privacy rule

The federal rule protecting health information.

Authorization

Written permission to use and share health information.

Study code

A number used instead of your name.

Subpoena

A legal order to hand over information.

Withdrawal

Ending your permission for future data use.