Certificate of Confidentiality

A Certificate of Confidentiality (CoC) is designed to protect the privacy of human research subjects. 

For studies funded by the NIH:

Studies funded whole or in part by the NIH, and that involve collecting or using “identifiable, sensitive information” are automatically issued a CoC. This includes agencies that fall under the umbrella of the NIH.  A complete list can be found here in The NIH Almanac

For studies without NIH funding:

  • Studies funded by the CDC, SAMSHA HRSA, HIS: Investigators whose studies are funded whole or in part by these agencies are able to request a CoC by contacting the agency’s CoC Coordinator 
  • CoCs are not issued for studies funded by AHRQ or DOJ.
  • Studies not funded by any of the above but that are under the authority of the FDA operating under an IND or IDE can contact the FDA CoC Coordinator.
  • Any study not addressed above can request a CoC through the NIH’s online system.

Examples of “Identifiable sensitive information” include:

  • Biomedical, behavioral, clinical or other research including exempt research, except where the information is recorded in such a manner that human participants cannot be identified or the identity of the human participants cannot readily be ascertained, directly or through identifiers linked to the participants.
  • The collection or use of biospecimens that are identifiable to an individual or for which there are at least a very small risk that some combination of the biospecimen, a request for the biospecimen and other available data sources could be used to deduce the identity of an individual
  • The generation of individuals level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human participants can be identified or the identity of the human participants can readily be ascertained
  • Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data courses could be used to deduce the identity of an individual

What does it mean if a study is covered by a CoC?

Researchers may disclose information only when:

  • Required by Federal, State, or local laws (e.g., as required by the Federal Food Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State or local civil, criminal, administrative, legislative, or other proceeding
  • Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual;
  • Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
  • Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human participants in research
     

Researchers may not:

  • disclose or provide, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings, the name of such individual or any such information, document or biospecimen that contains identifiable, sensitive information about the individual an that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains to; or
  • disclose or provide to any other person not connected with the research, the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research

Informing participants:

When research is covered by a CoC, researchers must inform participants (for example, in the consent document) of the protections and limitations of CoCs

  • For studies that were previously issued a CoC, and notified participants of the protections provided by that Certificate, NIH does not expect participants to be notified that the protections afforded by the Certificate have changed although IRBs may determine whether it is appropriate to inform participants
  • If part of the study cohort was recruited prior to the issuance of a Certificate, but are not longer actively participating in the study, NIH does not expect participants consented prior to the change in authority or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificates have changed or that participants who were previously consented to be re-contacted to be informed of the Certificates, although IRBs may determine whether it is appropriate to inform participants

NIH Example Consent Language

Data Sharing:

Researchers conducting research covered by a CoC, even if the research is not federally funded, must ensure that if identifiable sensitive information is provided to other researchers or organizations, the other researcher or organization must comply with applicable requirements when research is covered by a CoC

Resources:

 

NIH Certificates of Confidentiality

v. 5/25/2021