Certificate of Confidentiality From NIH


What is a Certificate of Confidentiality?


Consent Form Wording


What is a Certificate of Confidentiality?

Certificate of Confidentiality (CoC) is issued by the National Institutes of Health (NIH) to safeguard the privacy of research study participants by protecting identifiable research information from forced disclosure. A CoC allows investigators and others who have access to research records to refuse to disclose identifying information in any civil, criminal, administrative, legislative or other proceeding, whether at the federal, state or local level. More background information and FAQs are available on the NIH website.

UCSF Contact Information: If you have any questions, contact Karen Simpkins at 415-476-9134.


Policy Change Coming October 1, 2017: Under the updated policy, NIH-funded researchers will no longer have to request a CoC, nor will they receive an actual certificate. The CoC will be issued automatically to NIH-funded grants, cooperative agreements, contracts and intramural research projects research funded wholly or in part by the NIH that collects or uses identifiable, sensitive information. Learn more about the new policy and read the NIH blog on these changes. We'll update our website as more info becomes available.​

How does this new policy affect already approved/ongoing studies?

All partly or wholly funded NIH research ongoing on or after December 12, 2016, will also be covered by a CoC and by this new policy. For research funded by one of NIH's sister HHS agencies that issue CoCs to their awardees (HRSA, CDC, SAMHSA), the investigator should contact the agency about obtaining this protection through the agency.

Note: Investigators are required to ensure that other investigators or collaborating institutions whom they share identifiable sensitive information with are notified that they are also subject to the disclosure restrictions even if they are not funded by NIH.

Is re-consent required?

Re-consent is not required for participants currently enrolled in ongoing studies. For ongoing studies that did not have a CoC and now receive one as part of the new policy, please turn in a revised consent form at the time of your next modification or continuing review. Include the wording described below.

In the interim, provide enrolled participants with this IRB-provided handout that describes the protections afforded by the certificate and any exceptions to those protections.

CoC not automatically granted for non-federally funded research; continue to submit CoC applications to NIH

NIH will continue to consider requests for Certificates for non-federally funded research in which identifiable, sensitive information is collected or used. Follow the procedures below to apply for a CoC.

NIH definition of sensitive information

Sensitive information includes (but is not limited to) information relating to sexual attitudes, preferences, or practices; information relating to the use of alcohol, drugs, or other addictive products; information pertaining to illegal conduct; information that, if released, might be damaging to an individual's financial standing, employability, or reputation within the community or might lead to social stigmatization or discrimination; information pertaining to an individual's psychological well-being or mental health; and genetic information or tissue samples.

CoC Application Procedures for Non-Federally Funded Research: NIH will continue to consider requests for Certificates for non-federally funded research in which identifiable, sensitive information is collected or used. Please note that these procedures may change as NIH implements the new policy described above. The NIH Certificate of Confidentiality Kiosk explains the submission process to NIH, so please use the kiosk info and follow the steps below. 

NIH has a online application system for all CoC requests. You will fill out the CoC application and attach the required documents in the online system. CoCs are issued by the individual NIH Institutes/Centers (ICs), and you will need to know to which NIH IC you are applying.

Note: When seeking to amend or extend an existing certificate, please contact the issuing IC staff to determine if the online system can be used for this purpose.

1. The PI obtains IRB approval of a consent form that includes the CoC wording (see sample wording below). The links below describe how/when to submit the consent form to the IRB based on the status of your study.

If you are submitting a new study to the IRB and know you are going to apply for a CoC

Incorporate the Certificate wording into the consent form accompanying your IRB Application. Bear in mind that applications for Certificates must be submitted to the NIH at least three months prior to the date on which enrollment is expected to begin.

If you need to start enrolling subjects on a new study before a CoC will be granted by NIH

Certificates must be submitted to the NIH at least three months prior to the date on which enrollment is expected to begin. If you will not have that much time following IRB approval, submit a consent form without the Certificate wording in your IRB Application and tell the IRB in section 1.8 of the Initial Review Submission Packet that you plan to apply for a Certificate.

After you get IRB approval to begin your study, you can submit a modified consent form with the Certificate wording. When the modification is approved, you can apply to the NIH.

The consent form initially approved by the IRB can be used until you obtain the Certificate. Subjects who enroll before the Certificate is issued will still be protected by it if they participate in the study during any time the Certificate is in effect.

If the IRB suggests you consider obtaining a CoC for your new study

Address the suggestion in your submission response. After you obtain IRB approval, you can submit a modification adding the Certificate wording to your consent form and use the modified consent form in your Certificate application.

If you already have IRB approval and decide you want to apply for a CoC

Submit a modified consent form that includes the Certificate wording to the IRB first. Apply for the Certificate after the modification is approved.

2. The PI uploads the following documents in the online CoC application system.

a. Current IRB approval letter.
b. IRB-approved consent form.
c. A signed assurance document using this assurance template. Include the study title and IRB number on this document. The Institutional Official signature block should read:

Brian Smith
Associate Vice Chancellor
Research Infrastructure and Operations
Institutional Official
University of California, San Francisco
3333 California St.
San Francisco, CA 94118

3. The PI will:

a. Keep current records of correspondence with agency and IRB.
b. Inform the NIH of any modifications or changes to the IRB protocol or consent form.
c. Submit these changes to the NIH.
d. Be responsible for submitting these changes and maintaining the expiration date.

4. The IRB office will:

a. Have the Institutional Official or designated official sign the CoC.
b. File the signed copy.
c. Mail the original to the PI.

5. NIH will:

a. Review the CoC and provide correspondence of approval or disapproval to both the PI and Institutional official.
b. The IRB will then file this information.

Consent Form Wording

When a researcher obtains a CoC, the research subjects must be told about the protections afforded by the certificate and any exceptions to those protections. The IRB-approved consent form should include appropriate wording from the Certificate of Confidentiality Application OR from the IRB Guidelines: 

Sensitive research information/Certificate of Confidentiality: To help us protect your privacy, we have obtained a Certificate of Confidentiality from the National Institutes of Health. With this Certificate, the researchers cannot be forced to disclose information that may identify you, even by a court subpoena, in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings.

Exceptions: A Certificate of Confidentiality does not prevent researchers from voluntarily disclosing information about you, without your consent. For example, we will voluntarily disclose information about incidents such as child abuse, and intent to hurt yourself or others. In addition, a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the researchers may not use the Certificate to withhold that information. Finally, the Certificate may not be used to withhold information from the Federal government needed for auditing or evaluating Federally funded projects or information needed by the FDA.

Step 1 in the Procedures section describes how/when to add this wording to your study, based on the study status.