What is a Certificate of Confidentiality?
A Certificate of Confidentiality (CoC) is issued by the National Institutes of Health (NIH) to safeguard the privacy of research study participants by protecting identifiable research information from forced disclosure. A CoC allows investigators and others who have access to research records to refuse to disclose identifying information in any civil, criminal, administrative, legislative or other proceeding, whether at the federal, state or local level. More background information and FAQs are available on the NIH website.
Procedures
Policy Change Effective October 1, 2017: Under the updated policy, NIH-funded researchers will no longer have to request a CoC, nor will they receive an actual certificate. The CoC will be issued automatically to NIH-funded grants, cooperative agreements, contracts and intramural research projects research funded wholly or in part by the NIH that collects or uses identifiable, sensitive information.
How does this new policy affect already approved/ongoing studies?
All partly or wholly funded NIH research ongoing on or after December 12, 2016, will also be covered by a CoC and by this new policy. For research funded by one of NIH's sister HHS agencies that issue CoCs to their awardees (HRSA, CDC, SAMHSA), the investigator should contact the agency about obtaining this protection through the agency.
Note: Investigators are required to ensure that other investigators or collaborating institutions whom they share identifiable sensitive information with are notified that they are also subject to the disclosure restrictions even if they are not funded by NIH.
Is re-consent required?
Re-consent is not required for participants currently enrolled in ongoing studies. For ongoing studies that did not have a CoC and now receive one as part of the new policy, please turn in a revised consent form at the time of your next modification or continuing review. Include the wording described below.
In the interim, provide enrolled participants with this IRB-provided handout that describes the protections afforded by the certificate and any exceptions to those protections.
CoC not automatically granted for non-federally funded research; continue to submit CoC applications to NIH
NIH will continue to consider requests for Certificates for non-federally funded research in which identifiable, sensitive information is collected or used. Follow the procedures below to apply for a CoC.
NIH definition of sensitive information
The CoC policy and 42 U.S. Code §241(d) defines identifiable, sensitive information as information that is about an individual and that is gathered or used during the course of research where the following may occur:
- Through which an individual is identified; or
- For which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identify of an individual.
CoC Application Procedures for Non-Federally Funded Research: NIH will continue to consider requests for Certificates for non-federally funded research in which identifiable, sensitive information is collected or used.
- Only apply for the certificate for an already approved study. The IRB is not able to make certifications when there is not yet an actual study.
- Be sure to include the IRB number in the same field as the title for the study
- Be sure to use the main UCSF address (505 Parnassus Ave., SF, CA 94143) as the institutional address - they want this to be uniform. Any other UCSF address would be included under "performance site" addresses
Do Certificates of Confidentiality expire?
If your research is funded by the NIH, it automatically receives a certificate of confidentiality.
This type of CoC is funding-based. When the funding ends, so does the protection provided by the CoC. If your study is continuing to collect sensitive information about participants, you should then obtain a CoC through the application process described below. If you choose not to apply for a new CoC and you are continuing to enroll or need to reconsent participants, information about the CoC must be removed from the consent form(s). CoCs obtained through the online application do not expire until the research data is no longer being used.
A non-funding related CoC obtained after January 12, 2021 through the application process https://grants.nih.gov/policy/humansubjects/coc/for-research-not-funded-by-NIH.htm#additional_information does not expire "until the collection or use of sensitive identifiable data concludes".
CoCs obtained prior to Jan 2021 would have expired within a year, and NIH no longer allows renewal of those historic CoCs. Instead, please submit the online application.
If you have questions, please contact the NIH directly at NIH-COC-Coordinator@mail.nih.gov
1. The PI obtains IRB approval of a consent form that includes the CoC wording. The links below describe how/when to submit the consent form to the IRB based on the status of your study.
Incorporate the Certificate wording into the consent form accompanying your IRB Application. Bear in mind that applications for Certificates must be submitted to the NIH at least three months prior to the date on which enrollment is expected to begin.
Certificates must be submitted to the NIH at least three months prior to the date on which enrollment is expected to begin. If you will not have that much time following IRB approval, submit a consent form without the Certificate wording in your IRB Application and tell the IRB in section 1.8 of the Initial Review Submission Packet that you plan to apply for a Certificate.
After you get IRB approval to begin your study, you can submit a modified consent form with the Certificate wording. When the modification is approved, you can apply to the NIH.
The consent form initially approved by the IRB can be used until you obtain the Certificate. Subjects who enroll before the Certificate is issued will still be protected by it if they participate in the study during any time the Certificate is in effect.
Address the suggestion in your submission response. After you obtain IRB approval, you can submit a modification adding the Certificate wording to your consent form and use the modified consent form in your Certificate application.
Submit a modified consent form that includes the Certificate wording to the IRB first. Apply for the Certificate after the modification is approved.
2. To obtain a Certificate of Confidentiality (Updated April 2020):
Step 1: Go to this link: https://grants.nih.gov/policy/humansubjects/coc/request-certificate.htm and click on “Access NIH Certificate of Confidentiality System”
Step 2: Fill out these 6 questions and click "Next"
Step 3: Fill out the next application questions that comes up. [please note: you will be asked to provide the following information, including the Institutional Official’s contact info. It is: Brian Smith, Brian.Smith@ucsf.edu, 415.514.2080
Do not submit until your study is approved.
- [UCSF IRB #(XX-XXXXX)] + Research Project Title
- Project Start Date
- Project End Date [must be a date a few weeks ahead of application date- NIH won't approve if they receive a date prior to their review]
- Project Description
- Name of Institution
- Institution Address [505 Parnassus Ave., San Francisco, CA 94143]
- Name of Institutional Official (Brian Smith)
- Email Address of Institutional Official (Brian.Smith@ucsf.edu)
- Phone Number of Institutional Official (415.514.2080)
- Performance Site Name
- Performance Site Address
- Name of PI
- Other Key Personnel
- List any drugs that will be administered in this study, including method of administration and dosage (e.g. Phenobarbital 50 mg 2 times daily)
Add Drug name [if applicable, upload proof of DEA controlled substance registration in field provided]
Step 4: Click “Submit for Verification”
Step 5: Wait to hear back from NIH.
Once submitted, the NIH will send an e-mail to the Institutional Official, Brian Smith, for verification. Please do not contact Brian Smith with questions about your application. The information will be verified and confirmed to NIH, and NIH will contact you. We anticipate providing an update on the status within a week.
NIH contact info: NIH-CoC-Coordinator@mail.nih.gov
Consent Form Wording
When a researcher obtains a CoC, the research subjects must be told about the protections afforded by the certificate and any exceptions to those protections. The IRB-approved consent form should include the Suggested Consent Language Describing the CoC Protections from NIH.
Step 1 in the Procedures section describes how/when to add this wording to your study, based on the study status.
Resources
- Guidance on Certificate of Confidentiality
- This memo provides information about CoCs, which federal agencies may issue to researchers to protect subjects' privacy, and highlights good data management practices in cases where identifiable research information is commingled with other data.