Note the use of ‘additional’ here means, that a CoC should not be the only means used to protect the confidentiality of the research data (for additional information, reference ‘Approval Criteria #7’ in the Criteria for Institutional Review Board Approval).
Certificates of Confidentiality
Certificates of Confidentiality (CoC) are granted by Department of Health and Human Services (HHS) agencies in order to protect against compelled disclosure (e.g., subpoenas) of identifiable, sensitive research information.
Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for subjects, such as damage to their financial standing, legal standing, employability, insurability or reputation.
Typically, CoCs are requested when the research involves collection of sensitive information or involves subjects whose behaviors put them at risk, such as drug users or individuals involved in illegal behaviors.
Obtaining a CoC helps to minimize the risk to subjects by adding an additional level of protection to ensure the confidentiality of private information and the protection is permanent.
Anyone engaged in human subject research that involves the collection of sensitive information may apply for a CoC; it is not limited to federally supported research (as outlined below).
All studies funded wholly or in part by the National Institutes of Health (NIH), are automatically issued a CoC when the research involves collecting or using ‘identifiable, sensitive information’. This CoC is included as part of the Notice of Award (NoA). ‘Identifiable, sensitive information’ meaning information about an individual that is gathered or used during the course of research where: a) an individual is identifiable; or b) the combination of information could be used to identify an individual. This includes but is not limited to name, address, fingerprints, voiceprints, genetic information, and tissue samples. Note that the definition of ‘identifiable, sensitive information’, as provided in the policy, focuses on the identifiability of the information collected/used, rather than the sensitivity of the information collected/used.
Examples of research automatically covered by a CoC include:
- Biomedical, behavioral, clinical, or other research, including exempt research, except where the data or information obtained is recorded in a manner that does not identify or readily ascertain, directly or through identifiers linked to the subject.
- The collection or use of biospecimens that are identifiable to an individual for which there is a risk that some combination of the biospecimen, a request for a biospecimen, and other available data sources could be used to identify a subject.
- The generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a way that a research subject can be identified, or their identity readily ascertained.
- Any other research that involves information for which there is a risk, as determined by current scientific practice or statistical methods, that some combination of the information, a request for information, and other available sources of data could deduce the subject’s identity.
For projects not funded by the NIH, an NIH-issued CoC can be requested however, issuance of the CoC is at the discretion of the NIH. Eligibility depends on the nature of the research and the funding source.
Several agencies within HHS can issue their own CoCs. If the research is funded by the Centers for Disease Control and Prevention (CDC), Food & Drug Administration (FDA), Substance Abuse and Mental Health Services Administration (SAMSHA), Health Resources and Services Administration (HRSA), and Indian Health Service (IHS), contact the CoC coordinator at the corresponding agency for additional information.
Note:
- CoCs are not issued by the NIH for studies funded by the Agency for Healthcare Research & Quality (AHRQ) or Department of Justice (DOJ) as these agencies have their own privacy and confidentiality regulations.
- Studies operating under the authority of the FDA based on the existence of an Investigational New Drug (IND) or Investigational Device Exemption (IDE), should contact the relevant FDA CoC Coordinator (per FDA Center).
For all other research (funded by an HHS agency other than those listed above or when the research is unfunded or not federally funded), CoCs can be requested through the NIH’s online system. Note: When requesting the CoC on the website, the NIH requires the name, email and phone number of the University’s institutional official; this information can be found in Section 8 of the University’s Federalwide Assurance.
What am I responsible for if a CoC is issued?
As indicated by NIH guidance, Investigators are responsible for:
- Informing subjects that a CoC has been issued (language for doing so is available in the Research Subjects Review Board consent form templates).
- Upholding CoC protections in accordance with NIH policy, which includes to:
- Not disclose or provide, in any federal, State, or local civil, criminal, administrative, legislative, or other proceeding, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
- Not disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research.
- Informing investigators/institutions that they are responsible for upholding CoC protections when/if they receive a copy of identifiable, sensitive information or obtain biospecimens protected by a CoC, regardless of whether or not the study is NIH-funded.
- Limiting the release of identifiable, sensitive information as described in the NIH policy, when:
- Required by federal, state, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to state and local health departments), excluding instances of disclosure in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding.
- Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual.
- Consent of the individual to whom the information, document, or biospecimen pertains; or
- For the purposes of other scientific research that is in compliance with applicable federal regulations governing the protection of human participants in research.