If my mechanic wants to publish a paper on wear-and-tear on 4 cylinder engines using just the information he gleaned from doing work on cars that I (and others) paid him for, he has caused zero damage to me versus just doing the work on my car.
The same applies here. Patients come in for treatment, and they provide exactly the same questions as if they weren't doing research.
Private information about my mental health is much more personal and sensitive than the wear of my car's engine. Handling that data to an untrained student intent on publishing a paper can cause plenty of harm.
I agree, though, that this study could have been done more easily by accessing the patients' records post-facto. But it's not the IRB's fault that the experiment could have been designed better.
Yes, mental health information is personal and sensitive, but it looks like the IRB didn't even address patient privacy, it was instead something that came out of a later audit.
[edit]
Also it seems that post-facto experiments are being encouraged over controlled trials, which seems the opposite of what you want from an experimenters point of view.
More privacy protections were enforced later according to the account, but the very first protection of them all is asking for consent to use the data. That's what I was getting to. Consent to use your responses to treat you is different from consent to use them for research.
If my mechanic wants to publish a paper on wear-and-tear on 4 cylinder engines using just the information he gleaned from doing work on cars that I (and others) paid him for, he has caused zero damage to me versus just doing the work on my car.
The same applies here. Patients come in for treatment, and they provide exactly the same questions as if they weren't doing research.