Certificate of Confidentiality

Certificates of Confidentiality or CoC, protect the privacy of research subjects by prohibiting disclosure of identifiable, sensitive research information to anyone not connected to the research except when the subject consents or in a few other specific situations.

NIH funded researchers whose institutions determine that their research involves collecting or using identifiable, sensitive information are automatically deemed to be issued a CoC through their award.

Several Department of Health and Human Services (HHS) agencies (CDC, FDA, HRSA, IHS, SAMSHA) issue CoC for research they fund or that are subject to FDA jurisdiction. Researchers can request a CoC from NIH for health-related studies that are not funded by NIH or another HHS agency that issues CoC. Appropriate issuance of a CoC is determined by NIH.

For the purposes of CoC, the term “identifiable, sensitive information” means information about an individual that is gathered or used during biomedical, behavioral, clinical, or other research, where an individual is identified; or for which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual.

For the purposes of the CoC, NIH automatically covers by a certificate of confidentiality research in which identifiable, sensitive information is collected or used, such as:

• Biomedical, behavioral, clinical, or other research, including exempt research, except where the information obtained is recorded in such a manner that human participants cannot be identified or the identity of the human participants cannot readily be ascertained, directly or through identifiers linked to the participants.
• The collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual.
• The generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human participants can be identified, or the identity of the human participants can readily be ascertained.
• Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual.
• Researchers may also apply for a certificate of confidentiality for non-federally funded research.

What researchers may or may not disclose under a CoC:

When a study is covered by a CoC:

• Researchers may not disclose or provide, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
• Researchers may not disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research.
• Researchers are permitted to disclose information under the following circumstances:
• Required by Federal, State, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding;
• Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual;
• Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
• Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human subjects in research.

Researchers conducting research covered by a certificate of confidentiality, whether or not federally funded, must ensure that if identifiable, sensitive information is provided to other researchers or organizations, regardless of whether or not the research is federally funded, the other researcher or organization must comply with applicable requirements when research is covered by a certificate of confidentiality.

Researchers Responsibility in Informing Participants of CoC:

When research is covered by a certificate of confidentiality, researchers must inform participants (for example, in the consent document) of the protections and limitations of certificates of confidentiality.

For studies that were previously issued a Certificate, and participants were notified of the protections provided by that Certificate, NIH does not expect participants to be notified that the protections afforded by the Certificate have changed, although IRBs may determine whether it is appropriate to inform participants.

If part of the study cohort was recruited prior to issuance of the Certificate, but are no longer actively participating in the study, NIH does not expect participants consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted to be informed of the Certificate, although IRBs may determine whether it is appropriate to inform participants.

How to obtain a CoC for a research study?

For non-federally funded research, instructions for submitting a electronic application for CoC are available on the NIH website How to Apply for Certificate of Confidentiality

Applicable Regulations and Guidance:

1. NIH Certificates of Confidentiality
2. How to Apply for Certificate of Confidentiality

Reference to Other Policies:

1. Informed Consent

Attachments:

1. None

If you find errors in this document, contact [email protected]