Who Sees Your Health Data in an IBD Clinical Trial?

Health data in an IBD clinical trial may be seen by authorized study-site staff, the sponsor and its representatives, laboratories, monitors, auditors, ethics reviewers, and regulators, as described in the consent form. Access should be limited to purposes and safeguards that apply to the study. The FDA informed consent guidance requires disclosure of how records identifying a participant will be kept confidential. Ask which data remain identifiable, which are coded, where they are transferred, how long they are kept, and what continues after withdrawal.

Identifiable, coded, and de-identified data

Identifiable data contain information that directly identifies you. Coded data replace direct identifiers with a code while a separate key can link the code back to you. HHS guidance explains that coded information can still be considered individually identifiable when investigators can access the key, while information may fall outside that definition when investigators cannot readily ascertain identity under specified controls in coded-information guidance.

De-identified data have identifying elements removed under the applicable standard, but privacy risk should still be described honestly. Ask who holds the code key, who can request re-identification, and what happens during a medical emergency. Avoid treating coded and anonymous as interchangeable terms.

Who may review the study record

The site needs identifiable information to schedule care, verify eligibility, administer treatment, and report health events. Sponsors and monitors may review records to check protocol compliance, safety, and data quality. The FDA monitoring guidance connects monitoring with participant protection and reliable study data. Regulators may inspect covered records under their authority.

The consent form should identify categories of authorized reviewers and explain confidentiality protections. Ask whether outside vendors manage electronic diaries, imaging, laboratories, travel, or payments and what information each receives. An Institutional Review Board reviews privacy and participant protections but does not become your clinical care team. Ask how suspected privacy incidents are reported and investigated.

Medical records and information outside the site

Screening and follow-up may require access to gastroenterology records, medication history, hospitalizations, procedures, or laboratory results. Ask which date range and record types the authorization covers, whether access continues after treatment ends, and how new records are requested. The HIPAA Privacy Rule summary explains federal protections for covered health information in the United States, while research rules and local law may add separate requirements.

Cross-border studies can transfer coded information to sponsors, laboratories, or data centers in other countries. Ask where data are stored, which legal protections apply, and whether the consent offers any optional data uses. Record access for the main trial can differ from optional future research.

Genetic analysis and future research

Blood, stool, biopsy, and other samples can generate health and genetic information. The consent form should distinguish tests required for the current protocol from optional storage or future research. HHS broad-consent materials explain that identifiable information and biospecimens may be stored, used, and shared for future studies under broad consent.

Ask whether whole-genome sequencing may occur, whether commercial organizations can receive samples or data, whether results return to you, and whether you can decline future research while joining the main trial. The NIH consent resource for secondary research provides sample language for storage and sharing choices, including voluntary participation and withdrawal.

What withdrawal changes

Leaving an FDA-regulated trial generally does not remove data already collected from the study database, according to FDA data-retention guidance. New data collection, continued medical-record access, future contact, and sample use can be separate questions. Ask the site to explain each one in writing.

Privacy review should happen before consent and again if the study changes. Create a simple data map showing what is collected, who receives it, where it goes, how it is coded, how long it remains, and which optional uses you accepted. That map provides a clearer answer than a broad assurance that information will be kept confidential.

Keep the authorization and privacy pages with the signed consent form. If the study adds a vendor, new country, genetic analysis, or future-use proposal, ask whether fresh consent or authorization is required. The FDA consent guidance treats informed participation as an ongoing communication process. Data choices should remain understandable throughout that process, especially when treatment ends but record retention or sample research continues.

Ask for a current privacy contact and keep any notices that describe a change in data access, storage, or sharing.