Note the use of ‘additional’ here means, that a CoC should not be the only means used to protect the confidentiality of the research data (for additional information, reference ‘Approval Criteria #7’ in the Criteria for Institutional Review Board Approval).
Certificates of Confidentiality
Certificates of Confidentiality (CoC) are granted by Department of Health and Human Services (HHS) agencies in order to protect against compelled disclosure (e.g., subpoenas) of identifiable, sensitive research information.
Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for subjects, such as damage to their financial standing, legal standing, employability, insurability or reputation.
Typically, CoCs are requested when the research involves collection of sensitive information or involves subjects whose behaviors put them at risk, such as drug users or individuals involved in illegal behaviors.
Obtaining a CoC helps to minimize the risk to subjects by adding an additional level of protection to ensure the confidentiality of private information and the protection is permanent.
Anyone engaged in human subject research that involves the collection of sensitive information may apply for a CoC, it is not limited to federally supported research (as outlined below).
All studies funded wholly or in part by the National Institutes of Health (NIH), are automatically issued a CoC when the research involves collecting or using ‘identifiable, sensitive information’. This CoC is included as part of the Notice of Award (NoA). ‘Identifiable, sensitive information’ meaning information about an individual that is gathered or used during the course of research where: a) an individual is identifiable; or b) the combination of information could be used to identify an individual. This includes but is not limited to name, address, fingerprints, voiceprints, genetic information, and tissue samples. Note that the definition of ‘identifiable, sensitive information’, as provided in the policy, focuses on the indentifiability of the information collected/used, rather than the sensitivity of the information collected/used.
For projects not funded by the NIH, an NIH-issued CoC can be requested however, issuance of the CoC is at the discretion of the NIH. Eligibility depends on the nature of the research and the funding source.
Several agencies within HHS can issue their own CoCs. If the research is funded by the Centers for Disease Control and Prevention (CDC), Food & Drug Administration (FDA), Substance Abuse and Mental Health Services Administration (SAMSHA), Health Resources and Services Administration (HRSA), and Indian Health Service (IHS), contact the CoC coordinator at the corresponding agency for additional information.
Note:
- CoCs are not issued by the NIH for studies funded by the Agency for Healthcare Research & Quality (AHRQ) or Department of Justice (DOJ) as these agencies have their own privacy and confidentiality regulations.
- Studies operating under the authority of the FDA based on the existence of an Investigational New Drug (IND) or Investigational Device Exemption (IDE), should contact the relevant FDA CoC Coordinator (per FDA Center).
For all other research (funded by an HHS agency other than those listed above or when the research is unfunded or not federally funded), CoCs can be requested through the NIH’s online system. Note: When requesting the CoC on the website, the NIH requires the name, email and phone number of the University’s institutional official; this information can be found in Section 8 of the University’s Federalwide Assurance.
What am I responsible for if a CoC is issued?
As indicated by NIH guidance, Investigators are responsible for:
- Informing subjects that a CoC has been issued (language for doing so is available in the Research Subjects Review Board consent form templates;
- Upholding CoC protections in accordance with NIH policy;
- Informing investigators/institutions that they are responsible for upholding CoC protections when/if they receive a copy of identifiable, sensitive information or obtain biospecimens protected by a CoC; and
- Limiting the release of identifiable, sensitive information as described in the NIH policy.