Where does confidentiality collide?

The property that information is not disclosed to unauthorised individuals, processes, or devices. FIPS 199 fixed it in 2004 as the first of three federal security objectives, beside integrity and availability. Bell and LaPadula's 1973 model made it a lattice rule (no subject reads above its clearance and no subject writes below it) so that a proof about the state machine is a proof about secrecy. Diffie and Hellman's 1976 paper moved confidentiality off the trusted machine altogether: two parties who have never met can agree a key over a public channel, so the secret lives in the mathematics rather than the perimeter. What distinguishes this meaning is that confidentiality is a property of a system, verified by a model or a cipher, and it holds whether or not anyone owes anyone a duty.[1][2][3]

Unit

A data object or channel, across all subjects that could access it

Recovery means

Not applicable, a disclosed secret is disclosed; rotate keys, revoke access, and reclassify

Measured by

Security categorization level; access-control policy compliance; cryptographic strength

Two related constructs. A lawyer's duty of confidentiality under ABA Model Rule 1.6 forbids revealing information relating to a client's representation, whatever its source, and binds the lawyer everywhere; the attorney–client privilege is the narrower evidentiary rule that lets a client refuse to disclose confidential communications in court. A trade secret is information that derives independent economic value from not being generally known and that its owner has taken reasonable measures to keep secret, the definition the Uniform Trade Secrets Act fixed in 1979 and the Defend Trade Secrets Act adopted for federal civil claims in 2016. What distinguishes this meaning is that confidentiality is an obligation on a person or a status of information that a court will enforce, and it is lost by disclosure, not by a cipher failing.[4][5][6]

Unit

A duty between a professional and a client; or a body of information and its owner

Recovery means

Not applicable, once generally known, a secret is no longer a trade secret; the remedy is damages or an injunction

Measured by

Disciplinary findings under Rule 1.6; judicial findings on the elements of a trade secret

The clinician's obligation not to disclose what a patient reveals in the course of care. The Hippocratic Oath fixed the norm in antiquity (what is seen or heard in treatment that ought not be spoken abroad will be kept secret) and the HIPAA Privacy Rule of 2000 turned it into a regulatory floor for protected health information in the United States. Tarasoff set the limit in 1976: a therapist who learns that a patient poses a serious danger to an identifiable person has a duty to protect that person, and confidentiality yields. Beauchamp and Childress treat confidentiality as a prima facie rule derived from respect for autonomy and from the trust that makes disclosure to a clinician possible. What distinguishes this meaning is that confidentiality is a duty owed by a healer to a patient, is justified by what it makes possible, and is overridden when the harm to a third party is grave enough.[7][8][9][10]

Unit

A clinician–patient relationship, across the record of care

Recovery means

Not applicable, a breach is remedied by notification, discipline, and restored trust, not by restoring the secret

Measured by

Privacy Rule compliance; breach notifications; disciplinary and malpractice findings

The researcher's undertaking that what a participant discloses will not be traced back to them by anyone outside the study. The Belmont Report of 1979 placed it under respect for persons and beneficence, and every consent form since has promised it. Kaiser's 2009 analysis of qualitative interviewing separated it from anonymity: the researcher usually knows exactly who said what, so the promise is about what will be published and how it will be disguised, and thick description can betray a respondent to anyone who knows the setting. What distinguishes this meaning is that confidentiality is a promise made at consent, kept by the researcher's practice of de-identification, and tested against the small worlds in which participants live.[11][12]

Unit

A participant's data, from collection to publication

Recovery means

Not applicable, a deductive disclosure cannot be undone; the criterion is whether the promise was kept

Measured by

Consent-form terms; de-identification practices; re-identification risk in published excerpts

The property that publishing statistics from a dataset reveals a bounded amount about any one record in it. Statistical disclosure control, set out by Hundepool and colleagues in 2012, is the older toolkit: suppress small cells, coarsen categories, swap and perturb records, and measure the risk that a table or microdata file lets an intruder re-identify someone. Dwork's 2006 definition of differential privacy replaced the intruder model with a guarantee: a randomised mechanism is ε-differentially private if its output distribution changes by at most a factor of e^ε when any one person is added to or removed from the data. Dwork and Roth's 2014 monograph fixed the composition theorems that let ε be spent across many queries. What distinguishes this meaning is that confidentiality is a number attached to a mechanism, holds against any adversary with any side information, and is bought with measurable loss of accuracy.[13][14][15]

Unit

A release mechanism applied to a dataset, against a worst-case adversary

Recovery means

Not applicable, the privacy budget is spent and does not return

Measured by

Privacy loss ε and δ; re-identification risk; cell-suppression counts; utility loss

A reporter's promise not to reveal the identity of a person who supplied information, and the legal question whether a court can compel the reporter to break it. Branzburg v. Hayes held in 1972 that the First Amendment gives reporters no privilege to refuse a grand-jury subpoena, though Justice Powell's concurrence left room for case-by-case balancing that lower courts have used since. Fargo's 2006 survey showed that most states responded with shield statutes whose scope (who is a journalist, what is covered, and when the shield yields) varies widely, and that federal proposals have had to choose among those models. What distinguishes this meaning is that confidentiality is a promise the journalist makes on their own authority, that the law may or may not honour, and that is kept by a willingness to go to jail.[16][17]

Unit

A reporter–source relationship, tested by a subpoena

Recovery means

Not applicable, a revealed source is revealed; the criterion is whether the promise held

Measured by

Subpoenas quashed or enforced; contempt citations; scope of the applicable shield statute