Can Researchers Create Vulnerability Through the Way a Study Is Designed?

Can the study itself make participants vulnerable?

Researchers often begin vulnerability assessments by describing the participants: children, patients, employees, economically disadvantaged people, migrants, or people with impaired decision-making capacity. That approach can overlook another possible source of vulnerability sitting much closer to home: the protocol.

A participant may enter a study fully capable of making decisions and facing no unusual research-related disadvantage. Then the study recruits them through someone who controls their employment, asks for unnecessary identifying information about sensitive behavior, offers participation as the only route to something they need, or conducts an interview where others can overhear.

In these situations, vulnerability is not merely a characteristic discovered in the participant. Part of it may have been created by the way the research was designed.

Yes, research design can create or amplify vulnerability

Sometimes the ethical problem is not who you recruit but how you recruit and study them

Vulnerability can emerge from an interaction between people and research

CIOMS defines vulnerable persons as those who may have an increased likelihood of being wronged or incurring additional harm in research. Its guidance emphasizes characteristics and circumstances that produce vulnerability rather than treating vulnerability solely as a fixed property of particular groups.

The 2024 Declaration of Helsinki likewise recognizes factors producing vulnerability that may be fixed or contextual and dynamic. This contextual approach has an important implication: researchers need to examine not only what circumstances participants bring into research but also what circumstances the research creates.

A useful vulnerability assessment therefore asks two questions. What could make these participants more susceptible to harm or wrong before the study begins? And what features of this study could create or increase that susceptibility?

Recruitment can create vulnerability through authority

Consider a researcher who wants to recruit university employees. Simply being employed does not necessarily make participants vulnerable in every study. Now suppose their immediate supervisors personally invite them, repeatedly remind them to participate, and receive a list showing who enrolled.

The design has introduced a hierarchical relationship directly into recruitment.

CIOMS identifies subordinate relationships as a potential source of diminished voluntariness. People may agree because they expect favorable treatment or because they fear disapproval or retaliation if they refuse.

Researchers may sometimes reduce that vulnerability by changing who approaches participants, who knows their participation decision, or how recruitment is separated from relationships involving employment, education, healthcare, or services.

Researchers can create privacy vulnerability by collecting more data than they need

Imagine an anonymous survey about attitudes toward workplace technology. If the research question does not require names, employee numbers, exact job titles, precise work locations, or IP addresses, collecting them anyway creates information that could connect responses to individuals.

If the survey also asks participants to criticize supervisors, report misconduct, or describe stigmatized experiences, those identifiers can transform the consequences of a data breach.

The ethical problem is not solved merely by telling participants that disclosure is a risk. Researchers should first ask whether the identifying information needs to exist.

The setting can change what participation reveals

Where research occurs can itself disclose information.

Suppose a researcher interviews members of a stigmatized population in a room clearly identified for that study. Even if the interview data are stored securely, simply being seen entering the room may reveal something sensitive about a participant.

Similarly, calling a participant from a recognizable research center, leaving detailed voicemail messages, sending mail with revealing labels, or conducting interviews within hearing distance of relatives or colleagues can create exposure before the formal data-security plan becomes relevant.

For research involving stigma or legally sensitive information, confidentiality therefore begins with recruitment and contact procedures, not only with the database.

Incentive design can alter the conditions of choice

Payment for research participation is not inherently unethical. Participants may reasonably be compensated for time, inconvenience, expenses, or other contributions. But incentives form part of the environment in which consent occurs.

The Belmont Report distinguishes coercion from undue influence. Coercion involves an overt threat of harm used to obtain compliance, whereas undue influence can arise through an excessive, unwarranted, inappropriate, or improper reward or other overture. It also recognizes that an inducement ordinarily considered acceptable may operate differently when a prospective participant is especially vulnerable.

The design question is therefore not simply whether participants are paid. Researchers should examine the amount, structure, timing, conditions of payment, consequences of withdrawal, alternatives available to participants, and context in which the offer is made.

This becomes especially important when financial need may affect how an incentive is experienced.

Access to valued benefits can become part of the vulnerability

Money is not the only inducement that matters. Research may intersect with healthcare, educational credit, institutional privileges, services, or other things participants value.

OHRP uses the example of students being offered extra credit for research participation. If participation is the only way to earn that credit, the arrangement may create undue influence. Providing a comparable non-research alternative can reduce that concern.

The broader lesson is that researchers should examine what participation controls. If saying “no” means losing access to something participants reasonably need or value, the study may have changed the practical meaning of voluntary choice.

Study procedures can unnecessarily expose participants to harm

A protocol may ask participants to disclose traumatic experiences, illegal behavior, immigration status, sexual behavior, workplace misconduct, or other sensitive information. Sometimes those questions are necessary to answer the research question. Sometimes they are merely interesting.

The distinction matters ethically.

Every additional sensitive question can introduce burdens or consequences. Researchers should be able to explain why collecting the information is scientifically necessary and what protections correspond to its sensitivity.

The same principle applies to physical procedures, repeated assessments, travel requirements, lengthy interviews, digital tracking, biological samples, and other burdens. A procedure should not survive ethical scrutiny simply because it would produce an interesting additional variable.

Digital research can create vulnerabilities that are easy to overlook

Online and technology-mediated research can collect information beyond what participants consciously type into a form. Depending on the platform and configuration, researchers may encounter IP addresses, device information, timestamps, location data, contact information, account identifiers, or other metadata.

The relevant protections depend on the actual technology and data flow. Researchers should determine what information is collected, where it goes, who can access it, how long it is retained, and whether third-party platforms introduce additional privacy considerations.

A promise that a study is “anonymous” should therefore reflect the actual data architecture rather than the researcher's intention not to look at identifiers.

Researcher-created vulnerability can sometimes be removed rather than merely managed

This is perhaps the most practical consequence of viewing vulnerability contextually. If a design choice creates the problem, changing the design may be more effective than adding another warning to the consent form.

These are examples rather than universal prescriptions. The appropriate redesign depends on the study and governing requirements. The central principle is to consider whether vulnerability can be reduced at its source.

A low-risk survey becomes ethically different after a few design decisions

This is the practical value of understanding vulnerability as partly situational. Ethical protection can sometimes be achieved by changing the research environment rather than changing who is allowed to participate.

Design-created vulnerability is easy to miss when attention stays on participant characteristics

Audit the protocol for vulnerability before assigning it to the participant

When you identify a vulnerability, ask whether it would still exist if the study were designed differently. That question can reveal problems that a participant-focused assessment misses.

The goal is not to eliminate every possible research risk. Research often involves legitimate burdens and uncertainties. The more precise question is whether the protocol creates avoidable susceptibility to harm or wrong and whether the remaining vulnerability has appropriate protections.

Before finalizing the protocol, check whether the study creates vulnerability

Frequently asked questions about research-created vulnerability

Before protecting participants from vulnerability, make sure the protocol is not creating it

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.