What is required to protect the confidentiality of records that could identify subjects?

• A. They should be protected according to privacy rules and regulatory requirements.
• B. They should be disclosed to sponsors without consent.
• C. Confidentiality applies only to adult subjects.
• D. Confidentiality is not a regulatory requirement.

Answer: (A)

Protecting confidentiality means keeping any information that could identify a subject private and handling it under privacy laws and regulatory requirements. In practice, this involves restricting access to authorized personnel, using coded or de-identified data when possible, securing physical and electronic records, and sharing identifiable information only with subject consent or as required by the protocol, sponsor oversight, or regulatory authorities. This obligation applies to all subjects, including minors, and is a regulatory requirement in GCP. Disclosing identifiable records to sponsors without consent would violate confidentiality, and confidentiality is not optional or limited to adults.