CITI Social-Behavioral-Educational Researchers
A researcher is examining the quality of life for prisoners who are HIV-positive using surveys followed by interview. The IRB must ensure that:
Confidentiality of the prisoners' health status is maintained.
Must occur within 12 months of the approval date.
Continuing review of an approved protocol must occur within 12 months of the approval date even if no additional risks have been identified. Review by a convened IRB is not always required (for example, if the study was complete and in data analysis only). Any unanticipated problems must be addressed during the continuing review process, but the review must include other information such as the number of subjects accrued, any relevant recent literature, and a copy of the current consent form.
Data are made anonymous by
Destroying all identifiers connected to the data.
Which of the following is an example of how the principle of beneficence can be applied to a study employing human subjects?
Determining that the study has a maximization of benefits and a minimization of risks.
Which type of IRB review does not require an IRB approval but does require a determination by the IRB or an IRB designee?
Exempt
A researcher wishes to study generational differences in coping mechanisms among adults who experienced abuse as children. Adequate measures will be instituted to obtain informed consent and ensure that there is no breach of confidentiality. The most likely additional risk is that some subjects may:
Experience emotional or psychological distress.
According to the Belmont Report, the moral requirement that there be fair outcomes in the selection of research subjects, expresses the principle of:
Justice
Continuing review of an approved and ongoing study posing more than minimal risk that was initially approved by a convened IRB:
Must occur within 12 months of the approval date.
A graduate student wants to examine the effect of print media versus televised media on individuals' position on several social issues. The superintendent of a local work release facility, a family friend, will allow the graduate student access to the prison population to help her quickly accrue subjects. The student's IRB should:
Not approve this project because the prisoners are merely a population of convenience for the student.
The history of ethical regulations in human subjects research began with the
Nuremberg Code
Which of the following statements about the relationship between an institution and the institution's IRB(s) is correct?
Officials of the institution may overrule an IRB approval.
The research must pose no more than minimal risk.
One of the four criteria for waiving parental permission is that the research must pose no more than minimal risk. Although it may be appropriate to notify parents that the study is taking place, and many researchers do so, it is not required by the regulations when a waiver of parental permission has been approved. While children must provide assent to participate, depending upon the age of the children there are multiple strategies for accommodating children who do not want to participate other than alternate classroom activities. It is not required that an independent consultant approve waivers of parental permission.
The Belmont Report's principle of respect for persons incorporates at least two ethical convictions: first, that individuals should be treated as autonomous agents, and second, that:
Persons with diminished autonomy are entitled to protection.
The Belmont principle of beneficence requires that:
Potential benefits justify the risks of harm.
Nuremberg Code
Prior to the Nuremberg Code in 1949, the U.S. did not have a set of ethical regulations in human subjects research. The Nuremberg Code paved the way in creating the human subjects research guidelines and regulations we follow today.
In addition to pregnant women, fetuses, and neonates, another subpart of the HHS regulations provides additional protections for which of the following vulnerable populations?
Prisoners
Prisoners
Prisoners are provided additional protections in the HHS regulations. The HHS regulations do not have specific additional protections for elderly, for students, or for persons whose decision-making capabilities are impaired. Researchers may consider and the IRB may require additional safeguards for these populations.
A medical record is an example of:
Private information
As part of the consent process, the federal regulations require researchers to:
Provide potential subjects with information at the appropriate reading comprehension level.
Additional safeguards that may be included in a social and behavioral study may include:
Remove all direct identifiers from the data as soon as possible.
The researcher's failure to protect research subjects from deductive disclosure is the primary ethical violation in which of the following studies?
"Tastes, Ties, and Time (T3)" study (2006-2009)
Destroying all identifiers connected to the data.
Reporting data in aggregate form, while protecting the identity of subjects, does not make the data anonymous. Keeping keys in secure locations and requiring members of the research team to sign confidentiality agreements are methods for protecting identifiable information but they do not involve destroying all identifying information so that the link between identity and data is gone forever. The only way to render data entirely anonymous is to remove all identifying information from the data and completely disconnect any links between the subjects and data about the subjects.
In a longitudinal study that will follow children from kindergarten through high school and will collect information about illegal activities, which of the following confidentiality procedures would protect against compelled disclosure of individually identifiable information?
Securing a Certificate of Confidentiality
Experience emotional or psychological distress.
Subjects may experience emotional or psychological distress. The fact that the subjects have consented to participate in the study makes it unlikely that they would feel that their privacy was being invaded. Because confidentiality procedures have been built into the protocol it is also unlikely that the subjects might lose legal status or employment.
A general requirement for informed consent is that no informed consent may include any exculpatory language. Exculpatory language is that which waives or appears to waive any of the subject's legal rights or releases or appears to release those conducting the research from liability for negligence. Which of the following statements in a consent form is an example of exculpatory language?
Taking part in the research is voluntary, but if you choose to take part, you waive the right to legal redress for any research-related injuries.
According to the federal regulations, which of the following studies meets the definition of research with human subjects?
A cognitive psychologist enrolls undergraduate students for a computer-based study about the effect of mood on problem-solving behaviors.
A criterion for waiving informed consent is that, when appropriate, subjects are provided additional pertinent information after the study. In which of the following studies would it NOT be appropriate to provide subjects with information about missing elements of consent:
A study in which subjects were assigned to study activities based on an undesirable or unflattering physical characteristic as assessed by members of the research team.
According to the federal regulations, which of the following studies meets the definition of research with human subjects?
A study of twenty 4th grade classrooms in which researchers ask the schools to systematically vary the time of day reading is taught, and collect weekly assessments of reading comprehension for each child over a three-month period.
Justice
According to the Belmont Report, the moral requirement that there be fair outcomes in the selection of research subjects, expresses the principle of justice.
Per federal regulations, which of the following elements must be included in an informed consent document?
All foreseeable risks and discomforts.
Securing a Certificate of Confidentiality
Although data encryption, using pseudonyms, and waiving documentation of consent, provide data protection, the researcher can link individuals to their responses. Therefore, the data are vulnerable to subpoena in civil, criminal, and administrative court proceedings. Unless the researcher has a Certificate of Confidentiality, he or she may be compelled to release individually identifiable information about research subjects. The Certificate provides the highest level of protection.
"Tastes, Ties, and Time (T3)" study (2006-2009)
Although no students were identified by name in the T3 study, some data were specific enough to allow for re-identification of students by an outside researcher. This is an example of the failure to protect subjects from deductive disclosure of their identities. The primary ethical problems of the other studies include physical harms and unanticipated psychological harm.
Identify the example of when situation and time are key to assessing risk of harm in a research study:
Asking women if they have had an abortion
Asking women if they have had an abortion
Asking women if they have had an abortion would carry very different risks in a country where abortion is a routine medical practice, a country where it is illegal, and a country in which it is legal but the issue is fraught with religious and political controversy. Purchasing tobacco products is generally illegal for persons under 18 years of age, so any assessment of the risk for teenagers will have to consider that the research focuses on an illegal activity and is assessing the subject population, not situation and time. Similarly, a survey about sexually transmitted diseases would carry different risks for middle class suburban men, clergy, and gang members and is assessing risk through the idea of subject population, not situation and time. Research on the prevalence of harassment in different academic disciplines may stigmatize the community being studied in certain extreme cases, but the risk should be assessed as subject population, not situation and time either.
How can faculty researchers avoid undue influence of student subjects?
Avoid using their own students in their research
Neither Subpart C (Prisoners) nor Subpart D (Children) applies to juveniles in the correctional systems because wardens of juvenile prisoners (unlike those for adult prisoners) act in loco parentis for juvenile offenders. This statement is false because:
Both subparts apply, as these individuals are under the legal age of consent and are incarcerated
A researcher wants to do a web-based survey of college students to collect information about their sexual behavior and drug use. Direct identifiers will not be collected; however, IP addresses may be present in the data set. Risk of harm should be evaluated by:
Both the magnitude (or severity) and the probability (or likelihood) of harm.
Confidentiality of the prisoners' health status is maintained.
By participating in the research, it is possible that subjects will become publicly identified as HIV-positive. This breach of confidentiality could lead to negative consequences for the prisoner. One method for the investigator to preserve this confidentiality is to interview a larger sample of offenders, some who are HIV-positive and some who are not. While the survey should be validated and reliable, it does not have to be standardized. Because the research is behavioral only, there is no need for a medical doctor. The prison's HIV testing procedures are not part of the study.
Avoid using their own students in their research
By recruiting students from other classes, faculty researchers can minimize the potential of undue influence. Students from the faculty's own classroom may feel coerced to participate so to protect them, students who do not have any courses with the faculty should be recruited when possible.
A therapist at a free university clinic treats elementary school children with behavior problems who are referred by a social service agency. She is also a doctoral candidate who proposes using data she has and will collect about the children for a case-based research project. Which of the following statements about parental permission is correct?
The parents of the children might feel pressure to give permission to the therapist to use their children's data so that she will continue to provide services to their children.
A researcher asks an IRB to waive the requirement for parental permission for a study conducted in schools because the nature of the research requires participation of all the children present in classrooms on the day the research will take place. Assuming that the basic research design could be approved by the IRB and the school, which of the following requirements must be met before an IRB could waive parental permission?
The research must pose no more than minimal risk.
When a focus group deals with a potentially sensitive topic, which of the following statements about providing confidentiality to focus group participants is correct?
The researcher cannot control what participants repeat about others outside the group.
One of your subjects is half way through a study of an investigational antidepressant that is injected weekly. The drug requires a taper-down regimen, that is, it should not be stopped abruptly. You learn that the subject will be admitted to prison next week prior to the next scheduled injection. What is the appropriate response for the researcher?
The researcher should contact prison authorities about the medical issue , and report the events to the IRB of record.
The study in the 4th grade classrooms
The study in the 4th grade classrooms about the relationship between the time of day reading is taught and reading comprehension does meet the definition of research with human subjects. The study is designed to contribute to generalizable knowledge about student performance and the research question can only be answered using a systematic investigation. Information collected by the playground designer does not involve any information about human subjects even though it does involve interaction between the designer and school staff. An analysis of aggregate data doesn't involve interactions with living individuals nor the collection of private identifiable data. An economic feasibility study will gather information from people with relevant information and expertise but does not meet the definition of research with human subjects, because the intention of the study is to answer "about what" questions rather than "about whom" questions.
A researcher wants to observe preschoolers at a local public playground to evaluate levels of cooperation. The researcher will not interact with the children or record information in such a manner that the identity of the subjects can be readily ascertained. Which of the following statements is true?
This research would be eligible for exemption because the researcher is not interacting with the children and the playground is a public setting.
Exempt research is
research with human subjects. However, it is "exempt" from the provisions stated in Title 45, Part 46, Subpart A (the Common Rule). Federal guidance recommends that investigators not be allowed to self-determine whether a study qualifies for exemption. Therefore, exempt studies generally are reviewed and determined by the IRB, or its representative. Expedited and Full/Convened Board reviews both require IRB approval.
The Belmont principle of beneficence requires
that potential benefits justify the risks of harm.
This study would qualify as not human subjects because
the data that the student is collecting does not meet the definition of human subjects research as stated by federal regulations. She is not collecting any information about the store owners, but her study mainly seeks to find information about the items in the store.
Belmont Report
provides the ethical framework for the federal regulations designed to protect human research subjects.
According to the federal regulations, which of the following studies meets the definition of research with human subjects?
A developmental psychologist videotapes interactions between groups of toddlers and their caregivers to determine which intervention methods most effectively manage aggression.
Which of the following constitutes both a breach of confidentiality (the research data have been disclosed, counter to the agreement between researcher and subjects) and a violation of subjects' privacy (the right of the individuals to be protected against intrusion into their personal lives or affairs)?
A faculty member makes identifiable data about sexual behavior available to graduate students, although the subjects were assured that the data would be de-identified.
Taking part in the research is voluntary, but if you choose to take part, you waive the right to legal redress for any research-related injuries.
A statement in a consent form that says that subjects who agree to take part in the research waive their legal rights constitutes exculpatory language. Statements about the voluntary nature of consent, about the possible need to remove subjects from a study in order to protect their welfare, and statements about providing referrals do not waive subjects' rights.
Not approve this project because the prisoners are merely a population of convenience for the student.
Factors such as the level of risk and proposed facility are irrelevant if the prison population is simply a population of convenience as it is in this case. Research taking place in prisons must be material to the lives of the prisoners. Therefore, according to the regulations, an IRB could not approve this protocol.
Respect for persons
Humphreys collecting data for the Tearoom Trade study while posing as a lookout is an example of a violation of the principle of respect for persons. Respect for persons requires that subjects freely choose to participate in research (voluntariness) and that they are adequately informed about a study (informed consent).
The researcher should contact prison authorities about the medical issue , and report the events to the IRB of record.
If a human subject who is involved in ongoing research becomes a prisoner during the course of the study, the researcher must notify the IRB promptly and take appropriate steps for the safety of the subject. While the specific details are not known, the subject's health is of concern here rather than ongoing data collection. However, research activities - including the use of the study drug -- may continue but the medical aspects need to be directly addressed. Because it appears that the subject cannot be removed from the study without the possibility of increased risk of harm, additional protections are required. Although the specific details are not known, the researcher should take an active role in ensuring that the subject's health is protected. The other answers are not sufficient in this case.
Officials of the institution may overrule an IRB approval.
If an IRB has disapproved a protocol, that disapproval may not be overturned by an institutional official or anyone at that institution, such as a department chair. However, an IRB-approved protocol may be subject to other reviews at the institution and may be disapproved (overruled).
A study in which subjects were assigned to study activities based on an undesirable or unflattering physical characteristic as assessed by members of the research team.
If subjects were to learn that the research team assigned them to study conditions based on undesirable or unflattering physical characteristics, the knowledge that their appearance was judged negatively by the research team could be very distressing and, therefore, it would not be appropriate to inform subjects after the study about how they were assigned. Informing subjects about the actual research procedures in the other studies would be unlikely to cause them harm.
A researcher's study uses a dataset of prisoner demographic characteristics. This dataset includes criminal history data that predates incarceration and includes data on disciplinary behavior while in prison. There is no interaction with prisoners. The researcher claims, and the IRB chair agrees, that the study is exempt from IRB review. This decision:
Is wrong because 46.104 states that research conducted in prisons is not exempt if the subject population is only prisoners.
The researcher cannot control what participants repeat about others outside the group.
It is not possible for a researcher to promise confidentiality in a focus group setting. Participants may choose to repeat sensitive information outside the group setting even if they have signed confidentiality agreements. This is true even if the participants know each other. Using pseudonyms in the report does not remove concerns about what group members might say outside the group.
A faculty member makes identifiable data about sexual behavior available to graduate students, although the subjects were assured that the data would be de-identified.
No agreements were made regarding confidentiality with the subjects who were unknowingly audio-taped; whose interactions were recorded, or whose cocaine use was revealed by another. Therefore, there was no breach of an agreement about confidentiality, but the subjects' right to decide who can access their personal information was violated. If a researcher told subjects that only he or she would have access to identifiable data and then gives identifiable data to others that action constitutes a breach of confidentiality and a violation of privacy - the subjects' right to control who has access to personal information.
According to federal regulations, the expedited review process may be used when the study procedures pose:
No more than minimal risk and the research activities fall within regulatory categories identified as eligible.
A master's degree candidate needs to conduct a research project for her master's thesis. She is interested in the types of junk food available to the public. She plans on going to the local convenience stores and asking the owners what types of junk food the store normally stocks and which are the biggest sellers. Identifiers will not be collected. This study would fall under which of the following?
Not Human Subjects
What statement about risks in social and behavioral sciences research is most accurate:
Risks are specific to time, situation, and culture.
Is wrong because 46.104 states that research conducted in prisons is not exempt if the subject population is only prisoners.
Research conducted in prisons is not exempt under 46.104 if the subject population only includes prisoners. For research governed by the Common Rule, the exemptions at 46.104 (Protection of Human Subjects 2018) "do not apply to research subject to Subpart C, except for research aimed at involving a broader subject population that only incidentally includes prisoners." This means that the research does not include only prisoner subjects or aim to recruit prisoners as subjects. The research questions being answered also do not involve prisoners. It does allow that the research may happen to include a prisoner subject (or a subject who becomes a prisoner) and the prisoner subject's data may still be used without IRB approval for Subpart C. Although expedited review of prisoner research is permitted, OHRP strongly discourages the use of expedited review procedures as an acknowledgement of the vulnerability of prisoners as a class. The other answers are incorrect because they assume that an IRB can use an exempt status for prisoner research. The study could qualify for expedited review, but OHRP strongly discourages the use of expedited review procedures as an acknowledgement of the vulnerability of prisoners as a class.
Risks are specific to time, situation, and culture.
Research in the social and behavioral sciences sometimes does pose risks to subjects. Risks can be time, situation, and context specific. What may be a socially sensitive issue or topic at a given time and/or place may not be so at another time and/or place. The risk of emotional distress cannot be managed by anonymizing data, but rather by developing a plan to respond to the distress should it occur. Risks must always be minimized to the extent possible, regardless of the potential for benefit.
No more than minimal risk and the research activities fall within regulatory categories identified as eligible.
Research is eligible for expedited review when it poses no more than minimal risk to the participants and when all the activities fall within categories identified as eligible. Studies with more than minimal risk do not qualify for expedited review even if the subjects are adults, the sponsor is in a hurry, or the study replicates previously approved research.
Provide potential subjects with information at the appropriate reading comprehension level.
Researchers must provide information to subjects in a manner that facilitates comprehension. Therefore, the material must be written at the appropriate reading comprehension level. Researchers may not impose penalties for non-participation because to do so would violate the ethical principle of respect for persons. In some circumstances it may be appropriate to ask subjects to discuss the research with their families before making a decision about whether to participate, but it is not a regulatory requirement. Finally, researchers are not required to provide a list of the IRB members who reviewed the research.
Which of the following are the three principles discussed in the Belmont Report?
Respect for Persons, Beneficence, Justice
The three principles discussed in the Belmont Report are
Respect for Persons, Beneficence, Justice.
Humphreys collecting data for the Tearoom Trade study under the pretense that he was a lookout is an example of a violation of the principle of:
Respect for persons
Both the magnitude (or severity) and the probability (or likelihood) of harm.
Risk must be determined by assessing both the magnitude (or severity) and the probability (or likelihood) of harm. Both elements must be considered. Although the probability that an individual subject could be identified is low, the magnitude of the possible harm is high given the sensitivity of the information.
A professor at Big State University is writing a biography about Bill Gates and conducting oral histories with all of Bill Gates' friends, family members, and business acquaintances. The researcher submits the research proposal to the institution's IRB. What action can he expect by the IRB?
The IRB will not review this study because it is not research as defined by the federal regulations.
Which of the following studies is linked most directly to the establishment of the National Research Act in 1974 and ultimately to the Belmont Report and federal regulations for human subject protection?
The Public Health Service Study of Untreated Syphilis
The Public Health Service Study of Untreated Syphilis
The Public Health Service Study of Untreated Syphilis is linked most directly to the establishment of the National Research Act in 1974 and ultimately to the Belmont Report and federal regulations for human subject protection.
A waiver of the requirement for documentation of informed consent may be granted when:
The only record linking the subject and the research is the consent document and the principal risk is a breach of confidentiality.
The principle of beneficence
The principle of beneficence includes the obligation of researchers to strive to do no harm and to maximize benefits and minimize harms. "Persons are treated in an ethical manner not only by respecting their decisions and protecting them from harm, but also by making efforts to secure their well-being" (The National Commission 1979). The principle of beneficence can be applied to a study employing human subjects by determining that the study has a maximization of benefits and a minimization of risks. Providing detailed information during consent and ensuring persons with diminished autonomy are protected would be examples of applying the principle of respect for persons. Ensuring the selection of subjects is equitable is an example of applying the principle of justice.
The only record linking the subject and the research is the consent document and the principal risk is a breach of confidentiality.
The requirement to document informed consent can be waived if the only record linking the subject and the research is the consent document and the principal risk is a breach of confidentiality. The requirement may also be waived if the study poses no more than minimal risk to subjects and involves no procedures for which written consent is normally required outside of the research context. With regard to non-English speakers, if documentation is required, investigators must provide informed consent materials in the subjects' language. If a researcher anticipates that subjects might be embarrassed by questions, this concern should be addressed in the consent process. Finally, identifying secure storage space for consent forms is an investigator's responsibility.
According to the federal regulations, research is eligible for exemption, if:
The research falls into one of eight categories of research activity described in the regulations.
There was neither a violation of privacy nor a breach of confidentiality.
The subjects' privacy has not been violated because the identity of subjects was not included in the file. The confidentiality of the data has not been breached because the data could not be linked to identifiers. Therefore, the correct answer is that there was neither a violation of privacy nor a breach of confidentiality. The release of aggregate data with no identifiers does not constitute a violation of privacy or a breach of confidentiality.
A researcher leaves a research file in her car while she attends a concert and her car is stolen. The file contains charts of aggregated numerical data from a research study with human subjects, but no other documents. The consent form said that no identifying information would be retained, and the researcher adhered to that component. Which of the following statements best characterizes what occurred?
There was neither a violation of privacy nor a breach of confidentiality.
Both subparts apply, as these individuals are under the legal age of consent and are incarcerated
This population is considered doubly vulnerable due to their age and status as prisoners. Both subparts need to be carefully considered. There is no in loco parentis status for prisoners. Having a warden give consent would violate the basic tenets of informed consent. The regulations also prohibit the involvement of staff in prisoner selection for research. Parental signatures are not required.
The IRB will not review this study because it is not research as defined by the federal regulations.
This proposal is obtaining data from human subjects, but this project is not research since it is not "a systematic investigation including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge." This project will not be reviewed by the IRB.
The parents of the children might feel pressure to give permission to the therapist to use their children's data so that she will continue to provide services to their children.
When a care provider becomes a researcher, both the child clients and their parents may not feel free to choose not to participate in the provider's study. A researcher who is also a care provider needs to be very clear that a decision not to participate in a study, or to allow records to be used, will not affect the care provided in the future. The fact that the therapist has access to her clients' records as a clinician does not entitle her to use information in the records for research purposes without parental permission and child assent. A school authority's permission to conduct the research does not replace the need for permission or assent. Finally, the children's right to choose cannot be overridden in the pursuit of an indeterminate community interest.
Remove all direct identifiers from the data as soon as possible.
When a possible disclosure of subjects' responses is the primary source of potential harm, collecting data anonymously may provide the best protection and removing direct identifiers is an additional safeguard. The other responses are additional safeguards, but refer to studies that may involve investigational drugs or are biomedical and not social behavioral.
The study of passenger lists is
a study of individuals who are no longer living. A human subject is a living individual. Questioning individuals to acquire data about the number of newly diagnosed HIV cases is asking "about what" questions rather than "about whom" questions. Conducting a linguistic analysis of comments posted on a public blog involves neither interaction with individuals nor collecting private identified information and thus does not meet the definition of research with human subjects. The study proposed by the developmental psychologist does meet the definition of research with human subjects. It involves interactions with living individuals and is designed to contribute to a field of knowledge.
The federal regulations require
all foreseeable risks and discomforts must be included in an informed consent.
Research is only eligible for exemption if
all the activities associated with the research fall into one of eight categories of activities described in the federal regulations. The regulations do allow some research with children to be exempt (although institutional policy may not). The duration of the study and the experience of the researcher are not criteria for determining eligibility for exemption.
A cognitive scientist studying the effect of moods on problem-solving behaviors is
asking a research question and is interacting with living individuals. Questioning a superintendent of schools to acquire data about the ethnic composition of a school system is asking "about what" questions rather than "about whom" questions. (If a study proposed interviewing the superintendent of public schools about his or her experience in the field of education or about his or her perceptions about the current problems within the school system and possible solutions, the questions would become "about whom.") Analyses of public behavior such as writing for a blog or a newspaper do not meet the definition because there is no interaction or intervention with a human subject and no collection of private information. Finally, in the class exercise described, the intention is pedagogical (to learn how to conduct and interview) rather than to answer a research question.
The Belmont Report's principle of respect for persons incorporates at least two ethical convictions:
first, that individuals should be treated as autonomous agents, and second, that persons with diminished autonomy are entitled to protection. Persons with diminished autonomy should not be excluded from participating in research, because then they would be excluded from receiving the benefits of research. The Belmont Report does not limit persons with diminished autonomy with participating in greater than minimal risk research. The Belmont Report also does not limit persons involved in research from benefitting financially.
Private information includes
information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects. 45 CFR 46.102(e). A medical record is considered private because it includes identifiable information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public. A medical record is not considered public information, nor is it considered a behavior.