How Do You Balance Confidentiality Against a Duty to Protect Someone From Serious Harm?

What Should You Do When Confidential Research Information Suggests Someone Is in Serious Danger?

During a confidential interview, a participant describes a specific plan to seriously injure another person. The researcher had promised that interview responses would remain confidential, subject to the limitations explained during consent.

The disclosure creates a difficult question. Should the researcher protect the information because confidentiality is essential to ethical research, or disclose it because someone may be in danger?

Neither response is automatically correct in every jurisdiction or research setting. Researchers must distinguish credible threats from speculation, ethical concerns from legal reporting obligations, and information that may be disclosed from information that must remain protected.

The consequences of an incorrect decision can be substantial. Unjustified disclosure may expose participants to stigma, prosecution, retaliation, or loss of trust. Failure to respond appropriately to a serious threat may leave someone vulnerable to preventable harm.

Protect Confidentiality Unless a Specific and Defensible Basis Justifies Disclosure

Understanding Confidentiality, Protective Duties, and Permissible Disclosure

What Does Confidentiality Mean in Human-Participant Research?

Confidentiality concerns the obligation to protect information entrusted to researchers and to control how identifiable information is accessed, used, stored, and disclosed.

It differs from anonymity. In anonymous research, the research team does not collect information that enables participant identification, including through reasonably available combinations of data. In confidential research, researchers may know participants' identities or hold identifiable information but undertake to protect it.

Confidentiality is particularly important when research concerns illegal conduct, mental health, interpersonal violence, political beliefs, discrimination, or other sensitive experiences.

Participants may be less willing to provide accurate information when they reasonably fear that disclosures will reach employers, authorities, family members, or other third parties.

Consequently, confidentiality protects more than individual privacy. It also supports voluntary participation and the credibility of research involving sensitive information.

What Is the Difference Between a Duty to Warn and a Duty to Protect?

The terms are related but should not be treated as interchangeable legal obligations.

A duty to warn generally refers to an obligation, where recognized by applicable law, to notify an identifiable person or relevant authority about a qualifying threat.

A duty to protect may encompass a broader range of reasonable protective actions. Depending on the governing law and professional circumstances, these could include seeking emergency assistance, arranging appropriate intervention, or warning an endangered person.

These concepts are especially associated with certain mental-health professional responsibilities. They do not automatically apply in the same manner to every researcher who receives sensitive information.

Whether a legal duty exists may depend on the researcher's professional status, the relationship with the participant, the nature of the threat, and the jurisdiction.

Researchers should not assume that a rule applicable to a licensed clinician automatically applies to a social scientist conducting interviews. Conversely, a researcher who is also acting in a clinical capacity may have obligations that arise independently of the research protocol.

Does a Researcher's Ethical Concern Automatically Permit Disclosure?

No. A concern about potential harm is a reason to assess the situation, not an unrestricted authorization to reveal confidential information.

Researchers should determine whether disclosure is legally required, legally permitted, or prohibited under the rules governing the information.

They should also examine whether a protective response can be achieved without identifying the participant. Depending on the circumstances, options might include encouraging voluntary help-seeking, consulting an authorized institutional officer without sharing identifiers, or following an approved emergency-response procedure.

Where a genuine emergency requires immediate action, the response should follow applicable emergency obligations and established institutional procedures. Researchers should not delay necessary protective measures merely to complete routine administrative consultation.

However, urgency does not eliminate the need to consider what information may lawfully be disclosed and to whom.

Why Does the Seriousness and Immediacy of Harm Matter?

Statements about harm vary considerably. A participant may describe past violence, express anger, report intrusive thoughts, disclose an ongoing threat, or communicate a specific intention to injure someone.

These circumstances do not necessarily create identical risks or reporting obligations.

Assessment should consider the information actually available, including whether the threat concerns a specific person, whether it appears credible, whether the participant describes an intention or plan, and whether harm may occur soon.

Researchers should avoid presenting these considerations as a universally validated checklist for predicting violence. Assessing serious threats may require specialized expertise, and researchers without appropriate training should not assume the role of a clinical risk assessor.

Where the situation is unclear, timely consultation with qualified personnel may be necessary. If an immediate emergency is reasonably apparent, the researcher should use the appropriate emergency-response pathway.

When Is Reporting Legally Required?

Mandatory reporting requirements depend on jurisdiction, professional role, the type of information disclosed, and the circumstances in which it was obtained.

Possible reporting categories include certain forms of child abuse, abuse of other legally protected populations, specified communicable diseases, or other circumstances identified by applicable legislation.

Researchers must not assume that all disclosures concerning illegal activity are reportable. Nor should they assume that a confidentiality agreement overrides statutory reporting obligations.

The relevant law should be identified before data collection whenever the study could reasonably generate information triggering a reporting duty.

For international or multisite research, different jurisdictions may impose different requirements. Researchers should obtain advice appropriate to each relevant location rather than apply a single institution's procedures universally.

What if Research Information Has Special Legal Confidentiality Protection?

Some jurisdictions provide additional protections for identifiable research information.

In the United States, for example, Certificates of Confidentiality protect qualifying identifiable, sensitive research information against certain compelled disclosures and prohibit other disclosures except under specified statutory exceptions.

Under 42 U.S.C. § 241(d), relevant exceptions include disclosures required by applicable laws, certain disclosures made with participant consent, and other specifically authorized purposes. The protections do not create a general exception allowing researchers to disclose information whenever they personally believe doing so would be beneficial.

NIH guidance also explains that researchers and institutions have responsibilities to maintain these protections and inform participants about their scope and limitations.

Researchers should verify whether a Certificate applies to their study, what information it protects, and which exceptions govern the contemplated disclosure. Similar-sounding protections in other jurisdictions should not be assumed to operate identically.

Why Must Confidentiality Limits Be Explained Before Participation?

Participants should understand material limitations on confidentiality before deciding whether to participate.

If researchers anticipate circumstances requiring or permitting disclosure, the consent process should describe those circumstances accurately and in language participants can understand.

For example, a study involving sensitive interviews might explain that identifiable information will be protected but that certain disclosures may be required by applicable law. Where appropriate, it should identify the categories of information concerned rather than relying on an unexplained statement that confidentiality has exceptions.

Researchers should avoid promising absolute confidentiality when identifiable information may be subject to lawful disclosure or unavoidable security risks.

Nevertheless, including a broad disclosure clause in a consent form does not independently create legal authority to release information. Consent language must remain consistent with the actual legal and ethical framework.

The broader challenge of balancing participant autonomy against the duty to prevent harm becomes especially consequential when participants have relied on confidentiality assurances in deciding to disclose sensitive experiences.

What Does Proportionate Disclosure Mean?

When disclosure is required or lawfully justified, researchers should ordinarily limit it to what is necessary for the relevant purpose, subject to any specific legal reporting requirements.

Proportionality involves considering who needs the information, which details are relevant, and whether unnecessary identifiers or unrelated disclosures can be withheld.

For instance, a legally required report may concern a particular allegation or threat. It does not necessarily justify transferring an entire interview transcript, unrelated participant histories, or the complete research dataset.

Researchers should follow the applicable reporting instructions and institutional procedures rather than independently assume that every detail must be disclosed.

After a disclosure, records should accurately describe what information was shared, with whom, under what authority, and for what purpose, while maintaining appropriate security.

Should Researchers Tell Participants Before Disclosing Information?

Where lawful, appropriate, and safe, researchers should consider explaining the disclosure requirement to the participant and providing an opportunity to understand the process.

However, advance notification may sometimes increase danger, compromise a legally required response, or conflict with instructions from an authorized authority.

There is therefore no universal requirement to notify participants before every disclosure. The decision should follow the relevant law, approved protocol, professional responsibilities, and circumstances of the threat.

Researchers should also distinguish transparency about confidentiality limits during consent from notification about a particular disclosure after sensitive information has been obtained.

How Can Researchers Prepare Before a Serious Disclosure Occurs?

The most defensible approach begins during protocol development rather than after a threatening statement has been made.

Researchers should identify foreseeable reporting situations, consult relevant institutional and legal authorities, establish a response pathway, and ensure that research personnel understand their responsibilities.

Protocols should distinguish ordinary participant distress from situations involving credible threats, immediate emergencies, or legally reportable information.

Where decisions are particularly complex, independent ethical advice may clarify competing obligations before the study begins.

Preparation reduces the likelihood that researchers will respond to a serious situation through improvisation, excessive disclosure, or misplaced reliance on a confidentiality promise.

What Should a Researcher Do After Hearing a Specific Threat During an Interview?

The example does not establish that every researcher who hears a threatening statement has the same legal duty. The appropriate response depends on the jurisdiction and the researcher's role.

Its central lesson is that serious threats require prompt, informed assessment. Neither automatic disclosure nor an absolute refusal to consider protective action is an adequate universal rule.

Common Misunderstandings About Confidentiality and Protective Disclosure

How to Respond When Confidentiality and Safety Appear to Conflict

Before beginning sensitive research, identify the circumstances in which confidentiality could lawfully be limited. Determine who can advise on reporting obligations and how emergencies should be handled.

If a serious concern arises, assess whether there is an immediate threat requiring urgent action. Avoid making unsupported clinical or legal judgments outside your competence.

Where the situation permits consultation, obtain guidance from the appropriate institutional, legal, or professional authority before disclosing identifiable information.

Do not use a perceived duty to protect as a substitute for determining the applicable law. Equally, do not rely on a confidentiality promise to ignore an established legal reporting obligation.

When the response involves substantial ethical uncertainty, documenting the ethical reasoning behind the decision supports transparency and institutional accountability.

Researchers should also review whether the event reveals weaknesses in the approved protocol that require amendment, additional training, or changes to future consent procedures.

Before Disclosing Confidential Research Information to Prevent Harm

Frequently Asked Questions About Research Confidentiality and Serious Harm

Confidentiality Should Be Preserved Unless a Defensible Protective Obligation Justifies Disclosure

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.