and here is the law
https://www.law.cornell.edu/uscode/text/42/241
https://www.law.cornell.edu/uscode/text/42/241
d) Protection of privacy of individuals who are research subjects
(1)
(A) If a person is engaged in biomedical, behavioral, clinical, or other research, in which identifiable, sensitive information is collected (including research on mental health and research on the use and effect of alcohol and other psychoactive drugs), the Secretary, in coordination with other agencies, as applicable—
(i) shall issue to such person a certificate of confidentiality to protect the privacy of individuals who are the subjects of such research if the research is funded wholly or in part by the Federal Government;
(1)
(A) If a person is engaged in biomedical, behavioral, clinical, or other research, in which identifiable, sensitive information is collected (including research on mental health and research on the use and effect of alcohol and other psychoactive drugs), the Secretary, in coordination with other agencies, as applicable—
(i) shall issue to such person a certificate of confidentiality to protect the privacy of individuals who are the subjects of such research if the research is funded wholly or in part by the Federal Government;
Comment