Update: US researchers CAN guarantee privacy post-Dobbs

The two previous posts described my concerns about the NIH Certificate of Confidentiality exceptions post-Dobbs; the vagueness of the "federal, state, or local laws" "limited circumstances" formulation is troubling, since it seems that it could apply to something like a state-level prosecution for pregnancy termination.

I am happy to relay that the "federal, state, or local laws" exemption is clarified in the "When can Information or Biospecimens Protected by a Certificate of Confidentiality be Disclosed?" section of the What is a Certificate of Confidentiality? | grants.nih.gov site: 

[update 7 June 2023: the NIH website has changed a bit, but the key text below is still present, now under section  4.1.4 Confidentiality > 4.1.4.1 Certificates of Confidentiality]

"Disclosure is permitted only when: 

• Required by Federal, State, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding;  [emphasis mine]
• Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual; 
• Made with the consent of the individual to whom the information, document, or biospecimen pertains; or 
• Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human subjects in research."

The highlighted clause is the key clarification: the "federal, state, or local laws" exemption would not apply to something like a state-level prosecution for pregnancy termination, because that would be a criminal proceeding. And our data isn't only protected from criminal proceedings, but from civil, administrative, legislative, and others as well.

I am relieved by this exclusion, and encourage all universities and groups covered by the Certificate to include it, not only the "*Disclosure of identifiable, sensitive information (i.e., information, physical documents, or biospecimens) protected by a Certificate of Confidentiality must be done when such disclosure is required by other applicable Federal, State, or local laws." formulation. 

While I am relieved by this exclusion and find it sufficient guarantee that our participants' data is protected from disclosure, we will continue to minimize the amount of pregnancy-related information we collect, and use indirect phrasing in our screening questions whenever possible. Privacy and sensitivity are always important, but are especially critical now in the United States and when reproduction is involved.

UPDATE 16 September 2022: Many universities already use the longer (with the exclusion) explanation on their HRPO websites when describing the Certificate of Confidentiality protections. A google search for "excluding instances of disclosure in any Federal, State" found many, including Michigan State University, the University of Pittsburgh, the University of Washington, Virginia Commonwealth University, and North Dakota State University. Hopefully these examples can serve as templates for other institutions.

The NIH's example consent language also includes it: "This research is covered by a Certificate of Confidentiality from the National Institutes of Health. This means that the researchers cannot release or use information, documents, or samples that may identify you in any action or suit unless you say it is okay. They also cannot provide them as evidence unless you have agreed. This protection includes federal, state, or local civil, criminal, administrative, legislative, or other proceedings. An example would be a court subpoena."

UPDATE 28 September 2022: Washington University in St. Louis changed the Certificate of Confidentiality description to include the exclusion.