II.9.1 Privacy Rights

Criticism: FOIA does not adequately protect the privacy rights of research subjects. Subjects make confidentiality agreements with researchers, not with the government.

Response: Opponents of data access have not explained why FOIA does not adequately protect privacy rights of research subjects. The proposed revisions to Circular A-110 would exempt from disclosure confidential medical and personnel data under established FOIA procedures. The federal awarding agency will be obligated to delete data that would identify an individual.

As discussed above, both the National Center for Health Statistics and the Centers for Disease Control and Prevention have guidelines for the stripping and coding of health data before dissemination to ensure the privacy of individual study participants. Guidelines such as these can be adopted to direct primary investigators in removing patient identifiers and thereby guard against the identification of individuals as study participants. OMB should cite to these guidelines as examples of rules that individual agencies should adopt on data sharing. In the alternative, OMB should incorporate these guidelines by reference into the revisions to A-110.

Criticism: Compulsory, premature disclosure could alter the behavior of study participants, thereby jeopardizing research into questions that require longitudinal evidence-gathering to answer. Patients could obtain information through FOIA that disclosed, for example, whether the patient is in the "treatment" or the "control" group, and the patient might decide to discontinue participation in the study on that basis.

Response: If scientists are concerned that release of the data will potentially impact the behavior of participants remaining in the study, then the scientists should not release the data for publication.

Moreover, this criticism poses an unlikely scenario. In a large longitudinal study, study participants, as well as the general public, have always had access to preliminary published reports. Access to the raw data on which these published reports are based might influence the behavior of subjects with the ability and interest in accessing and manipulating the data, but this would be a very small minority. The screened/coded or redacted data in raw form would not contain results or conclusions which might alter participant behavior.

In some cases, existing agency regulations allow withholding of data from individuals requesting information about themselves. Under HHS rules, for example, the National Center for Health Statistics has a "K-4 exemption" for its statistical systems, as permitted under the Privacy Act (5 U.S.C. § 552a), so that the subjects of those data files do not have access to information about themselves.³⁵ Additional safeguards such as those adopted by HHS and the NCHS should be adopted by other agencies when those agencies issue regulations to conform with revised OMB Circular A-110. See Section II.3, supra.

Criticism: What about a 5-year follow-up versus a 10-year? Is CRE suggesting that the results of the 5-year study not be published?

Response: No. Confidentiality protections will also ensure against any individual study participant discovering his or her treatment status in a study of blinded design, therefore clinical trial subjects could not knowingly affect study results in any direction.

Criticism: The new rule has the effect of expanding the definition of "agency records" for purposes of FOIA requirements to include records of universities, hospitals, and non-profits. This expanded definition of "agency" could spill over into non-FOIA areas and threaten privacy rights.

Response: There is no indication from the legislative history that Congress intended the data access law to impose obligations on federal grantees beyond the provision of data to awarding agencies that the agencies have a right to request from researchers under existing law. The new law does not impose restrictions comparable to those placed on federal employees. Restrictions on political activity under the Hatch Act, for example, would not apply to awardees. Likewise, nothing in the law would make federal awardees "agents" of the state or expand the "state actor" doctrine for constitutional purposes. Thus, the specter of creeping federal intrusion into the private lives of researchers is more of a scare tactic than a real concern. The law merely requires that, upon receipt of a FOIA request from the public, federal agencies obtain from their awardees data that the agencies had an unexercised right to obtain all along.

³⁵ NCHS Staff Manual on Confidentiality, Department of Health and Human Services, Public Health Service (Sept. 1997), p. 2.