Content

Home » Publications » Human Research Ethics Handbook » A Research Law Collection » Confidentiality

Please note:

The Human Research Ethics Handbook – Commentary on the National Statement on Ethical Conduct in Research Involving Humans has been revoked. This information is kept here for archival purposes only. For the current guidelines, Human Research Ethics Committees should refer to the National Statement on Ethical Conduct in Human Research 2007.

Confidentiality

There are numerous provisions in the National Statement that require HRECs to ensure that adequate safeguards exist to protect the confidentiality of information obtained during a research project.

Meaning of confidential information

The essential characteristic of information that is confidential is that the information is inaccessible to the public. It does not matter that the information is simple, novel or of little objective value, as long as it is more than trivial. Further, the form of the information is irrelevant: the protection is attracted to words, written documents, designs, diagrams, photographs or even genetic structures.

[top]

Situations where a duty of confidentiality arises

A duty to maintain confidentiality arises in all relationships between health professionals and their clients, although there are some exceptions when confidential information may be lawfully disclosed to other people. The use of information in research is not automatically such an exception.

Note also that a duty to maintain confidentiality and not to disclose information can fall on people who gain confidential information after its initial disclosure. If HREC members were to obtain information about particular participants, for example, they would have a similar duty to keep it confidential, as does the researcher who first obtained the information. This applies whether the researcher is authorised to tell someone else about a particular participant or is in breach of the duty to maintain confidentiality. In both cases, third parties have an obligation to maintain confidentiality as soon as they are aware of the confidential nature of the information.

The obligation to maintain confidentiality continues as long as the information remains confidential. Whether publication of the information terminates its confidential character is a matter of fact in each case.

[top]

Circumstances where confidential information may be lawfully disclosed

Confidential information may be lawfully disclosed in certain circumstances:

  • where the person concerned consents (the consent would need to be given by a competent person, voluntarily and based on adequate information);
  • where it is mandated or permitted by statute or court order. An example of the former is mandatory reporting of notifiable diseases and suspected child abuse. An example of a court order is a subpoena requiring production of data gathered in research. A judge could, however, exercise judicial discretion in deciding whether it should be admitted in evidence. Often it will be excluded as it is not the best evidence of the facts in issue; and
  • where it is in the public interest. This is a limited and ill-defined common law principle based on the broad notion that a private obligation of confidence gives way to the obligation which 'lies on every member of the society to discover every design which may be formed contrary to the laws of society, to destroy the public welfare'. [Footnote 9] Disclosure of criminal activity or other civil wrong, even if it involves disclosing information that is confidential, may sometimes be justified on this ground. However, that disclosure must be in the public interest. For example, if the public interest is not advanced by the disclosure, it may not be permissible to breach confidentiality.

The notion of the public interest is not reducible to a set of hard and fast rules. Nevertheless, it is not met simply because information is to be used in research. Disclosure of matters that are 'medically dangerous' to the public may be justified even if the information was originally received in confidence. As with crimes, this will only be the case where disclosure is in the public interest. For example, in one case, disclosure of confidential information about the risks of a drug that had been withdrawn from the market was held not to be justified because there was no longer any danger to the public that that disclosure could prevent. [Footnote 10]

Where there is conduct that is neither criminal nor medically dangerous, but which misleads the public, disclosure may be justified. However, it is not sufficient to rely on some idea of the public's right to know. There must be a threat to the public interest that could be avoided or alleviated by disclosure, such as avoiding an epidemic of an infectious disease. Prospective benefits from research are not enough.

[top]

Obtaining confidential information from third parties

HRECs and researchers are usually well aware that confidential information about participants cannot be disclosed without consent or other lawful justification. It is sometimes less well understood that other people from whom researchers seek information may also be subject to a duty of confidentiality and that release of information for research purposes may be a breach of that obligation. This will often be the case, for example, where information is sought by a researcher from an institution such as a school or a hospital. The names, addresses, ages and other information about pupils and their families held by a school, or of patients in a hospital, are usually subject to a duty of confidentiality, that is, the information was given to the school or hospital for limited purposes and these commonly do not include research. To release that information to a researcher for another purpose will breach that obligation.

As indicated above, where the circumstances are such that researchers ought to know that such release will breach confidence, they become subject to the same duty. If information is released, it should be subject to an express promise of confidence from the researcher. Confidentiality is thus usually as relevant to participant recruitment as it is to participant consent and publication of results of research.

Researchers planning to recruit participants from the clientele of an institution such as a school, hospital, club or association need to recognise that the information in the pupil or patient registers or membership records of such institutions is confidential. The clients and members are the ones to whom the obligation of confidence is owed and it is their consent, and not that of the institution or club, that is necessary to release that information. One means of communicating with potential participants without breaching the confidentiality owed to them is to request the institution to distribute the researcher's invitation to participate in the research project to members of that institution. Potential participants are then free to contact the researcher directly.

It is important to recall that it is not only personal identifying information that can be the subject of the duty of confidentiality. That duty can attach to any information obtained for the purpose of, in the course of, or as the result of, the conduct of research. This is of particular relevance to the publication of research results. The detailed content of a final report and the extent of its distribution and availability need to be established before people are asked to become participants. The details of these matters are an essential part of the information that potential participants need to have so that they can balance the risks of participation against the benefits. Where total control of these matters is beyond researchers, frank disclosure of the extent of their control should be made.

The purpose for which the confidential information is obtained needs to be carefully considered and clearly expressed, especially when the information could be used for further research consequent upon that for which the information was initially gathered. Unless this possibility of secondary use is made clear, such further use could be restrained.

Where information is collected in the course of research, disclosure of that information for other purposes will be, prima facie, a breach of the duty of confidentiality. The usual exceptions of consent and compulsion of law will be available. However, the more difficult and unclear question will be the other circumstances in which disclosure of that information is justified because it is in the public interest.

Consistent with the policy supporting statutory obligations to disclose information about risks to public health, it could be argued that disclosure in order to prevent some other social harm, or harm to an identifiable group, should be similarly justified. The predictability of that harm and its tangible nature will be important and will clearly need to be of greater weight than some general idea of the public right to know, which, as noted above, would not of itself justify disclosure. Going public with confidential information gathered for research purposes in order to draw attention to some social injustice would not fall within any recognised exception to the duty, no matter how compelling the need to remedy that injustice may appear.

[top]

Information obtained from public authorities

Public authorities collecting confidential information often have statutory obligations of confidentiality that prevent confidential information being disclosed to other people, such as researchers. Relevant Federal and State statutes include the following.

Commonwealth statutes

Relevant Commonwealth Acts include the following:

  • The Archives Act 1983 (Cth) protects confidential records from public access even when other records in the Archives become available to the public.
  • The Australian Institute of Health Act 1987 (Cth) protects information in the records of the Institute now called the Australian Institute of Health and Welfare.
  • The Census and Statistics Act 1905 (Cth) prevents staff disclosing census results but permits the Minister to determine that certain information be disclosed (s.13).
  • The Epidemiology Studies (Confidentiality) Act 1981 (Cth) allows controls to be imposed on a wide range of research activities, including those that would fall within conventional definitions of social and behavioural research. It applies when Commonwealth regulations declare Commonwealth epidemiological studies to be prescribed studies to which the Act applies. One example is the Vietnam Veterans Study.
  • The Health Insurance Act 1973 enables personal information gained in the course of quality assurance activities to be withheld from public disclosure and from production in legal proceedings.
  • The National Health Act 1953 applies to specific types of research regarding the operation of departmentally funded institutions. There are statutory prohibitions of disclosure of personal information in reports. Examples include nursing home standards (ss. 45DA and 45DC) and certain inquiries regarding professional conduct (s. 134A). The Act also contains provisions directing compliance with guidelines issued by the Privacy Commissioner under the Privacy Act (ss. 135AA and 135AB). The guidelines will address storage, use, disclosure and some linkages of personal information. They will not be applicable to information that identifies providers or referrers of services in respect of which claims for payment are made by persons, or database information maintained for identifying persons eligible to be paid benefits under specified programs (s. 35AA(2)).

State statutes on gathering information for public purposes

State statutes and guidelines on gathering information for public purposes and the confidentiality exemption provisions include:

It should be noted that the freedom of information legislation applies to patients in public hospitals in all jurisdictions except ACT, where the legislation enables private patients to gain access to their medical records. In other jurisdictions, patients who are treated in a private hospital or by a private practitioner have no legal right to see their records although the hospital, or practitioner, may choose to disclose them on the patient's request. Also, it is possible that the patient may obtain access to the records by applying for a court order that they be revealed (a court order is within the discretion of the court but can be enforced); or by the patient complaining to a health complaints body that he or she was unreasonably denied access to the records (this might lead to an agreement by the hospital, or practitioner, that the records, or some of them, should be shown to the patient).

[top]

| Handbook TOC | Abbreviations | Commentary on the National Statement |
| A Research Ethics Collection | A Research Law Collection |
| Bibliography | Appendices | Downloads |

Related topics

footer links