Introduction

In the course of participating in a research study, a human subject may provide information to investigators about other persons, such as a spouse, relative, friend, or social acquaintance. These other persons are referred to as "third parties." Over the last two years, questions have arisen in the research community about whether the Common Rule (regulations governing the protection of human subjects in Federally-funded research that are codified by the Department of Health and Humans Services at 45 CFR 46 Part A) applies to third parties in research and whether third parties are human subjects or can become human subjects during the course of research. The Common Rule does not specifically address third party information and its definition of "human subject" leaves some room for interpretation in this regard.

Over the course of several months, the National Institutes of Health (NIH) carefully explored the question of whether third parties are human subjects. Our exploration was guided by two principles: the protection of human research subjects is of paramount importance and research to advance scientific knowledge is a public good.

What follows are "rules of thumb" that may be of help to investigators and Institutional Review Boards (IRBs) in determining whether third parties are human subjects with all of the rights and protections afforded human subjects under the Common Rule. These rules of thumb are intended to serve as a starting point for the development of additional guidance, if needed, on this important topic. The document also affirms the importance of protecting all research information about individuals, regardless of whether it is about a human subject or third party.

Are Third Parties Human Subjects?

As a result of our deliberations, we have found that, although third parties are not human subjects per se, third parties would meet the Common Rule definition of human subjects if, in the course of research, individually identifiable private information about them is collected. The Common Rule states in 46.102(f):

Thus, a third party is not a human subject unless and until the investigator obtains information about him or her that is both private and individually identifiable. When this occurs, the Common Rule then pertains and requires the informed consent of the subject or, if certain criteria are met, the subject’s informed consent may be waived.

Identity and privacy, however, are, by their nature, relative concepts. It can sometimes be difficult to determine what information should be considered both individually identifiable and private. It is important to emphasize that not all private information is individually identifiable and, likewise, not all individually identifiable information is private.

What is individually identifiable information?

The Common Rule states that in order for the collection of information to constitute research involving human subjects, the information must be individually identifiable, i.e., "the identity of the subject is or may readily be ascertained by the investigator or associated with the information." Such information might include items such as full name, address and other contact information, social security number, and identifiable photographic images, among others. However, information about familial or social relationships identified only by that association, i.e., spouse, father, mother, sister, friend, social contact, etc., should not usually be considered readily identifiable information.

"Readily" identifiable is the criterion used in the Common Rule, and it should be distinguished from "possibly" or "potentially" identifiable information, which is significantly different in degree. While it may be possible to ascertain the identity of a third party (e.g., the father of the index case) by piecing together bits of information (e.g., familial relationship, index case name, index case address, date and place of birth), making those linkages often requires time and special effort unless the third party’s full name or other identifying information is also collected. Information that requires such effort should generally not be considered readily ascertainable.

What is private information?

The Common Rule describes "private" information as including "information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record)." Although many types of health information are generally treated as private information, there are many exceptions. Information such as age, body build, and ethnic or cultural background that may have a bearing on health is generally not considered private. Information about family relationships and structure, marital status, social networks, and occupation is also generally not considered private.

In most cases, a researcher will ask a research subject (or the research subject will offer) information about a third party that is necessary to understand the health, medical history, life experiences, or behavior of the subject and which is relevant to the research question being addressed. Drawing on his or her own observations and experience, the subject reports his or her knowledge, perceptions or beliefs about the third party. Information about a third party that is obtained from the research subject as background information about the subject is not generally considered "private." Information of this type is deemed "contextual" since it is usually unverified information and is used to provide background information important to the condition and/or circumstances of the subject. Therefore, such information is generally not deemed "private."

Investigators and IRBs should evaluate carefully the relevance of the information obtained from the subject to the research study. If verification of the knowledge, perceptions, or beliefs of the subject about the third party is necessary, then the third party should be recruited into the study as a research subject. Investigators should carefully consider the methods used to establish initial contact with the third party. When there is a trustful, positive relationship between the human subject and the third party, contact is usually best made through the intercession of the research subject. On the other hand, there may be some instances when contacting the third party may be more appropriately done through the investigator. For example, this may be suitable when preserving the anonymity of the research subject is both desirable and reliably accomplished through this mode of contact. The best means of contacting third parties should be determined in accordance with acceptable guidelines for research of the type undertaken by the investigator and considered by the IRB in its review of the study. In addition, if the gathering of such information was not planned or expected at the outset of the study, advice should be sought from the IRB during the course of the study.

The medical record is explicitly cited in the Common Rule as an example of readily identifiable, private information. When a living third party’s medical record is sought and private information from it is recorded in such a way that the third party can be identified, the third party becomes a human subject and the need to obtain the consent of that party must be analyzed according to the Common Rule. An IRB may, however, waive the consent requirement if certain criteria outlined in the Common Rule are met. If private information from the medical record is recorded in a way that does not identify the third party, the research activity may be exempt from the requirements of the Common Rule (45 CFR 46.101(b)(4)), including IRB review and informed consent.

Confidentiality of Individually Identifiable Information

A significant risk of certain types of identifiable information is that its disclosure may have adverse consequences for the individual, such as the loss of employment or health insurance. If data are properly protected, the potential that such harms may occur is significantly reduced or eliminated. Protecting the confidentiality of data about identifiable individuals, whether they are human subjects or third parties, is a key responsibility of investigators and IRBs.

Risk to either the human subject or the third party from information disclosure is a function of data security and policy. Investigators must secure identifying data at all stages of research–from the time information is collected through the completion of analyses and publication of results, and for as long as the data are stored. The specific measures used to protect the data should take into account the sensitivity of the information collected and the risks associated with a breach of confidentiality. Investigators should consider obtaining a Certificate of Confidentiality to protect particularly sensitive data from compelled disclosure. When data identifying research subjects are no longer necessary to the progress of the research, investigators should take steps to de-identify the research records to further protect the subjects and any third party information they may have provided. Unauthorized individuals must not be able to access individually identifiable research data or learn the identity of research subjects or third parties during or after the completion of the study.

During the informed consent process, subjects should be made aware of confidentiality issues. That is, subjects should be informed about who will have access to the research data and for how long; what further disclosure or data sharing is anticipated; what data security measures will be employed and what, if anything, will be disclosed to others, by whom, and under what conditions. Subjects should also be advised about whether or not study results will be made available to them; approximately when they will be available; and whether they can opt to know or not know the results and under what circumstances. In addition, subjects should be advised about the potential consequences of sharing their research results with family members who also may be affected by the disorder. Such information can sometimes adversely affect family relationships or cause mental or emotional distress to individuals who do not want to receive certain health information. In cases where it may not be possible to protect the confidentiality of data about subjects or third parties (e.g., reporting of child abuse and certain infectious diseases), research subjects should be informed of confidentiality limitations during the informed consent process.

Conclusion

Third parties are not human subjects per se. They may become human subjects in the course of a research study if private, readily identifiable information about them is obtained by the researcher. Because privacy and identity are relative concepts, the rules of thumb outlined above may be helpful to investigators and IRBs in considering the question of when third parties may become human subjects. Further guidance on these issues, including the applicability of the Common Rule criteria for waiver of consent, may still be needed.

Footnote:

¹ In February 2001, the Director of the Office for Human Research Protections (OHRP) invited the NIH to provide recommendations to OHRP about the protection of third party information in research. The recommendations outlined here were developed through the deliberations of a committee composed of representatives from the NIH Institutes and Centers. NIH appreciates OHRP’s efforts to gather broad-based input on this important issue and urges the solicitation of additional perspectives from the research community and the public.