8.2 Privacy, Confidentiality and Appropriate Access
Key Takeaways
Coded participant data are not necessarily anonymous.
Monitoring access should be attributable, appropriate and confidentiality-conscious.
Privacy incidents require prompt controlled response and evidence preservation.
Privacy, Confidentiality and Appropriate Access
Privacy concerns access to a person's information and circumstances; confidentiality concerns protecting information entrusted to the research team. Monitoring needs access to relevant records, but that need does not remove restrictions on use, copying or disclosure. E6(R3) requires protection of participant-identifying information throughout the trial and data lifecycle, consistent with applicable requirements.
The participant should understand confidential direct access by authorised monitors, auditors, authorities and, where applicable, the ethics committee. The investigator/institution uses an unambiguous code for data reported to the sponsor and retains the ability to link it to the participant. A coded dataset is not necessarily anonymous: someone may still be able to re-identify the person. Treat that distinction seriously when sharing data or discussing cases.
Designing appropriate access
Before monitoring, establish which records contain relevant source information, who authorises access, what the monitor can see and what restrictions apply. Site and sponsor processes should support the agreed review while limiting inappropriate access. A monitor account should be attributable and suited to the task. Never use a coordinator's or investigator's login to avoid an access delay.
For paper records, control the workspace, unattended documents, copying and return. For electronic records, consider participant scoping, permissions, download rights, access expiration and audit logs. Remote review adds questions about network security, viewing location, screen sharing and copies retained on devices. A convenient screenshot can create an uncontrolled identifiable record outside the approved repository.
What should travel to the sponsor?
| Information | Typical handling concern | Practical check |
|---|---|---|
| Coded eCRF data | Correct participant code and authorised fields | Check coding and relevant collection instructions |
| Participant identity linkage | Usually controlled by the investigator/institution | Preserve secure traceability without routine sponsor dissemination |
| Medical records needed for safety follow-up | Necessary details may coexist with identifiers | Use the authorised secure, privacy-conscious process |
| Recruitment or screening logs | May contain information about people not enrolled | Limit collection/access to what is justified and permitted |
| Electronic audit information | Can reveal user identity and accidental personal information | Preserve needed metadata while controlling disclosure |
Do not send a whole identifiable chart merely because one result is needed. Conversely, excessive redaction can remove information needed to assess a safety event. The responsible functions should establish an appropriate method balancing necessary review, confidentiality and applicable requirements. A CRA should escalate an unresolved access conflict rather than decide that either privacy or monitoring always overrides everything else.
An access scenario
A site offers read-only access to all hospital patients so the monitor can locate a few trial records. The CRA should seek a more appropriately scoped method and document the concern. If the system cannot technically restrict access to particular patients, the sponsor and institution should assess and mitigate the risk under their procedures. The monitor's behaviour and permissions still need controls; an imperfect interface is not permission to browse unrelated records.
Now suppose the site offers only a printed summary without certification or supporting context. Evaluate whether the agreed review can be achieved with originals, certified copies or another suitable arrangement. ICH does not universally require live EHR access, but the data must remain verifiable. Obtain a documented resolution that preserves both confidentiality and adequate oversight.
Incident response
An identifiable document sent to the wrong recipient requires prompt action. Stop further inappropriate distribution, restrict access where possible, notify the designated privacy/security and quality functions and preserve evidence. Determine what was sent, when, to whom, whether it was accessed and what containment occurred. Follow applicable assessment and notification requirements rather than assuming every incident has the same statutory deadline.
Do not independently destroy a source record, delete an audit trail or quietly replace a file to make the incident disappear. E6(R3) recognises rare justified audit-trail changes, such as removal of accidentally entered personal information, only with a log of the action and justification. The incident record should support reconstruction and prevention even when the exposed content is removed through a controlled process.
Continuing protection after closure
Confidentiality persists during archiving, service-provider changes and destruction. Ensure access remains authorised, records remain retrievable and any migration preserves needed information and metadata. Notify the responsible party when staff leave or roles change; remove access appropriately while retaining attribution for past work. A shared former employee account cannot be made compliant by changing its display name.
Country-specific privacy examples appear in the ECO tasks, but ACRP states that country-specific frameworks are not tested. Practise the underlying skill: recognise identifying information, confirm appropriate access and use, protect it during transfer and storage, and respond transparently when protection fails. The same reasoning applies whether the source is paper, an EHR, a participant application or a laboratory portal.
Official sources
Checked October 18, 2026: ICH E6(R3), Principles and Annex 1, WMA Declaration of Helsinki, 2024, ICH E11(R1).
A monitor receives an unrelated patient’s identifiable chart in error. What is appropriate?
Browse the chart because monitor access is unrestricted.
Forward it to all study staff for awareness.
Quietly delete every audit record of receipt.
Limit further access/disclosure, notify designated functions and follow a controlled incident process.
Sections you finish are checked off in the contents.