03 · What You Need to Know
Research Harm Extends Far Beyond Physical Injury
Major Ethics Frameworks Explicitly Recognize Nonphysical Harm
The idea that research risk means bodily injury is inconsistent with established human-research ethics.
The Belmont Report describes risk as the possibility that harm may occur and explicitly identifies psychological, physical, legal, social, and economic harms as relevant to risk-benefit assessment. It warns researchers not to overlook nonphysical harms simply because psychological and physical pain or injury may be more immediately familiar.
Contemporary frameworks also emphasize interests that extend beyond bodily safety. The 2024 Declaration of Helsinki states that researchers involved in medical research have duties to protect participants' life, health, dignity, integrity, autonomy, privacy, and confidentiality.
Ethical assessment should therefore begin with the actual ways research could affect people rather than with a narrow checklist of possible injuries.
Psychological Harm Can Occur Without Physical Contact
Interviews, surveys, experiments, and observations can provoke distress, fear, shame, anxiety, grief, embarrassment, or other psychological effects.
This does not mean researchers should avoid every sensitive topic. Important research may concern trauma, discrimination, violence, bereavement, illness, sexuality, conflict, or other difficult experiences. Nor does every moment of discomfort constitute serious harm.
The ethical question is proportional: what psychological effects are reasonably foreseeable, how serious might they be, how likely are they, are they necessary for the research objective, and what safeguards are appropriate?
A brief uncomfortable question and an interview likely to trigger severe distress should not be treated as ethically equivalent simply because both involve “psychological risk.”
Loss of Privacy Can Be Harmful Even When the Data Are Accurate
Research can expose information that people reasonably expected to remain private. Depending on the study, this might concern health, finances, political activity, academic behavior, employment, relationships, immigration status, location, sexuality, illegal behavior, or other sensitive matters.
The ethical problem does not require the information to be false. Perfectly accurate information can be damaging when disclosed inappropriately.
Researchers should therefore ask not only whether data are scientifically useful, but whether collecting, linking, retaining, sharing, or publishing them creates risks that can be avoided or reduced.
Confidentiality Failures Can Create Secondary Harms
Privacy and confidentiality are related but different concerns. Privacy concerns access to people or information about them. Confidentiality concerns how information entrusted to researchers is subsequently handled.
Privacy
Concerns whether, when, and under what circumstances people or information about them are accessed or observed.
Confidentiality
Concerns how information obtained in the research relationship is protected from unauthorized or inappropriate disclosure.
A confidentiality breach can lead to consequences far beyond embarrassment. Sensitive information might affect employment, education, insurance where applicable, relationships, legal exposure, reputation, or personal safety.
The severity depends on the information, population, context, applicable law, and who receives the disclosure.
Re-identification Can Turn Apparently Anonymous Data Into a Risk
Removing names does not always make data anonymous.
Combinations of variables can sometimes identify a person indirectly, particularly in small populations or rich datasets. A participant described only by age, occupation, institution, unusual diagnosis, and location may be recognizable to people who know the setting even when the person's name never appears.
Qualitative quotations can create similar problems. A vivid quotation may contain enough contextual information for colleagues, relatives, classmates, or community members to recognize the speaker.
Ethical data protection therefore requires attention to identifiability in practice, not merely whether a spreadsheet contains a column labeled “Name.”
Social and Reputational Harm Can Affect Individuals and Groups
Research findings can alter how individuals or communities are perceived.
A participant identified as having engaged in academic misconduct could experience reputational consequences. A study reporting a high prevalence of a stigmatized behavior in a small community could affect that community even when no individual participant is identified.
This creates an important distinction between individual confidentiality and group-level consequences. Perfectly de-identified data can still support interpretations that stigmatize, stereotype, or disadvantage a population.
Researchers should not suppress legitimate findings simply because they may be uncomfortable. But they should consider how populations are characterized, whether conclusions are supported by the evidence, whether unnecessary identifying detail is included, and whether foreseeable group harms can be reduced without distorting the science.
Economic Harm Can Be a Research Risk
Research disclosures may affect employment, income, professional opportunities, business interests, or other economic circumstances.
Consider an employee who participates in a workplace study and criticizes management. If identifiable comments reach supervisors, the participant could face consequences even though the study involved nothing more physically dangerous than an interview.
The Belmont Report explicitly includes economic harm among the categories relevant to research risk assessment.
Legal Harm Can Also Matter
Research sometimes collects information about behavior that could expose participants to legal consequences. Depending on the jurisdiction and study, researchers may also face legal obligations concerning disclosure, reporting, records, or access to data.
Promises of confidentiality should therefore be accurate. Researchers should not tell participants that information “can never be disclosed” unless that promise is actually supportable under the applicable legal and institutional framework.
The appropriate protection depends on the jurisdiction and nature of the data, which is one reason researchers should verify current legal requirements rather than rely on generic ethics language copied from another project.
Loss of Autonomy Can Be Wrong Even When No Harm Follows
Ethics is not only about preventing harmful outcomes.
Suppose researchers deliberately withhold information that participants needed to make a meaningful decision about joining a study, even though the study ultimately causes no physical, psychological, social, or economic harm. There may still be an ethical problem because participants' autonomy was not adequately respected.
The Belmont Report treats respect for persons as a basic ethical principle independent of beneficence. Informed consent follows primarily from this principle.
This distinction matters because “nobody was harmed” is not a complete defense when the ethical concern is that people were denied an appropriate choice.
Coercion and Undue Influence Are Problems Before Harm Occurs
A student may feel unable to refuse a professor's research invitation. An employee may believe that declining a supervisor's study could affect their standing. A patient may misunderstand a physician's research invitation as necessary for continued care.
Even if everyone participates without experiencing any measurable adverse outcome, the recruitment process may still be ethically problematic if participation was not sufficiently voluntary.
Ethical assessment therefore considers the conditions under which choices are made, not merely the consequences observed afterward.
Deception Can Raise Ethical Questions Even When Participants Are Unharmed
Some research uses deception or incomplete disclosure for legitimate methodological reasons. That does not make all deception unethical, nor does scientific usefulness automatically justify it.
Researchers should consider whether withholding information is necessary, what risks it creates, whether participants are deprived of information material to their decision to participate, and whether debriefing is appropriate under the applicable ethical framework.
The ethical concern is partly about respect. A deception could be problematic even if participants later report no distress because the study manipulated their decision-making in a way that requires justification.
Justice Can Be Violated Without Anyone Being Individually Injured
Imagine researchers repeatedly recruit a disadvantaged population because it is inexpensive and easy to access, while the knowledge or interventions generated primarily benefit a more advantaged population.
No individual participant may experience identifiable harm. Yet the distribution of research burdens may still be unjust.
Belmont's principle of justice specifically asks who should receive the benefits of research and who should bear its burdens. It warns against systematically selecting populations because of easy availability, compromised position, or manipulability.
Ethical research therefore concerns patterns of fairness as well as individual outcomes.
Digital Research Makes Nonphysical Risk Especially Important
Digital research can involve social media posts, platform activity, location traces, browsing behavior, educational records, wearable-device data, images, online communities, or linked administrative datasets.
The absence of direct researcher-participant contact can create a false sense that such research is harmless. Yet rich digital data may reveal identities, relationships, routines, beliefs, health information, or behaviors that participants never expected researchers to infer.
Researchers should examine the context in which data were produced, expectations of privacy, identifiability, sensitivity, terms of access, applicable legal and institutional requirements, and consequences of linking information across sources.
Risk Includes Probability and Magnitude
A useful feature of Belmont's treatment of risk is its reminder that researchers need to consider both the probability of harm and its magnitude.
A very likely but trivial inconvenience differs from an extremely unlikely disclosure that could have severe consequences. Simply labeling both “low risk” can hide that distinction.
Risk assessment should therefore ask what could happen, how likely it is, how serious it would be, who would experience it, and what safeguards could change either the probability or the severity.
No Actual Harm Is Needed for a Risk to Have Been Unethical
Ethical evaluation should not depend entirely on hindsight.
If researchers store highly sensitive identifiable data without reasonable security and no breach happens, the fortunate outcome does not prove that the data practice was ethically sound. Similarly, coercive recruitment does not become acceptable because participants later report enjoying the study.
OHRP guidance recognizes that research-related problems may increase the risk of harm even when no actual harm ultimately occurs.
The relevant question is whether the decisions were ethically defensible given the foreseeable risks and obligations at the time, not merely whether researchers happened to avoid the worst outcome.
