Somewhere near the end of a consent form, script, recruitment letter, or brochure, researchers usually state that they will keep information “confidential.” But how is this promise evaluated by the Institutional Review Board (IRB) and kept by the researchers? Given the researchers’ confidentiality plan, the IRB must assess the risks related to participation, including risks created by disclosure of any information shared by subjects, and determine whether the study will be able to provide the level of confidentiality promised to subjects. In clinical research, confidentiality often concerns access to medical records or inadvertent revelation of patient status or of diagnosis. In comparison, survey research may raise fewer flags. When investigators offer confidentiality, it has frequently seemed sufficient to note that the study team will provide a locked cabinet, coded files, or confidentiality statements.