How does the Common Rule define "identifiable private information," and why is it important for IRB review?

How does the Common Rule define "identifiable private information," and why is it important for IRB review?

• A. Private information that can be linked to an individual directly or indirectly; its identifiability triggers human subjects protections and IRB oversight.
• B. Information that is publicly available; no IRB oversight.
• C. Any data collected in a public setting.
• D. Information that is never linked to a person.

Answer: (C)

Identifiable private information is information about an individual that is private and can be linked to that person, directly or indirectly. The Common Rule treats such information as requiring human subjects protections because it carries privacy risks and a potential for harm if kept or used improperly. This is why IRB review is important: it ensures appropriate safeguards for confidentiality, determines whether informed consent or a waiver is needed, and sets standards for data security and who can access the information. Publicly available data or information that cannot reasonably be linked to a person does not meet this private-identifiable threshold, so it generally does not trigger the same level of IRB oversight. However, if public data can be linked back to an individual or is used in a way that reveals private information, extra protections may still be warranted.

Identifiable private information is information about an individual that is private and can be linked to that person, directly or indirectly. The Common Rule treats such information as requiring human subjects protections because it carries privacy risks and a potential for harm if kept or used improperly. This is why IRB review is important: it ensures appropriate safeguards for confidentiality, determines whether informed consent or a waiver is needed, and sets standards for data security and who can access the information. Publicly available data or information that cannot reasonably be linked to a person does not meet this private-identifiable threshold, so it generally does not trigger the same level of IRB oversight. However, if public data can be linked back to an individual or is used in a way that reveals private information, extra protections may still be warranted.