Data Access

CRE Analysis

7. Potential for breach of patient/subject confidentiality.

Comment by the late Rep. George E. Brown (D-CA)

CRE Response:

The much-touted specter of invasion into the privacy rights of medical research subjects has plagued the data access debate since day one. Three points are critical to understanding the fallacy of these arguments. First, FOIA exemption 6, by its plain terms, protects against disclosure of personal medical data. Second, researchers have long been restricted by ethical standards and practices that prohibit the disclosure of patient- identifying data, and nothing in the new data access law runs counter to these standards and practices.

Third, with respect to the disclosure of research data to the funding agency itself (as opposed to the FOIA requester, from whom the private data would remain hidden), federal researchers are already obligated to provide such data to the agency upon request under Circular A-110. Merck and others have opined that research subjects will be scared away from participating in medical studies if it comes out that their records could be disclosed to the government. Such disclosures have always been a possibility in connection with federal research, however, and CRE respectfully points out that researchers' representations to study participants have been in error.

Moreover, it is unlikely that such "threats" to patient confidentiality will discourage human subject participation in research. As noted, FOIA prohibits disclosure of private medical and other personal data, and existing strict ethical rules on protection of human subject confidentiality will continue to apply. These include the practice of stripping all personal identifiers before medical research data is shared. Agencies already exempt disclosure of confidential human subject data, and they have an exemplary track record in handling such information. To the extent that any confusion regarding disclosure of personal data does exist, CRE submits that the responsibility for such confusion lies principally with researchers' mistaken representations to their own study participants.

Finally, OMB has clarified expressly in its August reproposal that personal medical data, including data that could be used to identify a person, shall not be disclosed under the new data access law.