Certificate of Confidentiality From NIH

What is a Certificate of Confidentiality?

A Certificate of Confidentiality (CoC) is issued by the National Institutes of Health (NIH) to safeguard the privacy of research study participants by protecting identifiable research information from forced disclosure. A CoC allows investigators and others who have access to research records to refuse to disclose identifying information in any civil, criminal, administrative, legislative or other proceeding, whether at the federal, state or local level. More background information and FAQs are available on the NIH website.

Procedures/FAQs

Policy Change Effective October 1, 2017: Under the updated policy, NIH-funded researchers will no longer have to request a CoC, nor will they receive an actual certificate. The CoC will be issued automatically to NIH-funded grants, cooperative agreements, contracts and intramural research projects research funded wholly or in part by the NIH that collects or uses identifiable, sensitive information.

How does this new policy affect already approved/ongoing studies?

All partly or wholly funded NIH research ongoing on or after December 12, 2016, will also be covered by a CoC and by this new policy. For research funded by one of NIH's sister HHS agencies that issue CoCs to their awardees (HRSA, CDC, SAMHSA), the investigator should contact the agency about obtaining this protection through the agency.

Note: Investigators are required to ensure that other investigators or collaborating institutions whom they share identifiable sensitive information with are notified that they are also subject to the disclosure restrictions even if they are not funded by NIH.

NIH definition of sensitive information

The CoC policy and 42 U.S. Code §241(d) defines identifiable, sensitive information as information that is about an individual and that is gathered or used during the course of research where the following may occur:

  • Through which an individual is identified; or
  • For which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identify of an individual.
CoC not automatically granted for non-NIH funded research; CoC application system currently disabled (updated May 2025)

As it is not guaranteed that the system will resume, the UCSF IRB will not approve CoC language in consent forms for non-NIH funded studies until NIH issues the CoC.  When a CoC is granted for non-NIH funded research, a Modification Form with a revised consent form attached AND proof NIH issued the COC will need to be submitted to the IRB. This only affects non-NIH funded studies where a CoC is planned to be obtained from NIH.

Do Certificates of Confidentiality expire?

If your research is funded by the NIH, it automatically receives a certificate of confidentiality.  

This type of CoC is funding-based.  When the funding ends, so does the protection provided by the CoC.  If your study is continuing to collect sensitive information about participants, you should then obtain a CoC through the application process described below. If you choose not to apply for a new CoC and you are continuing to enroll or need to reconsent participants, information about the CoC must be removed from the consent form(s).  CoCs obtained through the online application do not expire until the research data is no longer being used.

A non-funding related CoC obtained after January 12, 2021 through the application process https://grants.nih.gov/policy/humansubjects/coc/for-research-not-funded-by-NIH.htm#additional_information  does not expire "until the collection or use of sensitive identifiable data concludes". 

CoCs obtained prior to Jan 2021 would have expired within a year, and NIH no longer allows renewal of those historic CoCs.  Instead, please submit the online application. 

If you have questions, please contact the NIH directly at [email protected]

CoC Application Procedures for Non-Federally Funded Research

As noted above, the NIH CoC application system for non-NIH funded research is currently unavailable. In the event that this system becomes available again, the following procedures should be followed:

  • Only apply for the certificate for an already approved study.  The NIH is not able to make certifications when there is not yet an actual study.
  • Be sure to include the IRB number in the same field as the title for the study
  • Be sure to use the main UCSF address (505 Parnassus Ave., SF, CA 94143) as the institutional address - they want this to be uniform.  Any other UCSF address would be included under "performance site" addresses

CoC IRB Submission Procedures

The instructions below describe how/when to submit the consent form to the IRB based on the status of your study.

1. The PI obtains IRB approval of a consent form that includes the CoC wording. 

If your study is funded by NIH so that you will automatically receive a CoC:

Incorporate the Certificate wording into the consent form accompanying your initial IRB Application.

If NIH funding is anticipated but has not been awarded, or new NIH funding is obtained during the course of the study:

Do not add the language. Instead, submit a modification form to provide final details of funding when received. This modification should also include a revised consent form incorporating the Certificate wording. For studies with new NIH funding, the Certificate of Confidentiality question in the study application should also be changed to “yes.”

If your study is not funded by the NIH, and you will be applying to the NIH for a certificate after initial IRB approval:

Answer the “Certificate of Confidentiality” question in the Study Application “yes,” but do not incorporate the Certificate wording into the consent form.

Include a note in the “Extra Confidentiality Measures” section of the application or another appropriate place that you plan to apply for a CoC from NIH after initial IRB approval.

After you receive confirmation from the NIH that you have an approved CoC, submit a modification including a modified consent form that includes the Certificate wording, and documentation from the NIH that the CoC has been obtained. 

The consent form initially approved by the IRB can be used until you obtain the Certificate. Subjects who enroll before the Certificate is issued will still be protected by it if they participate in the study during any time the Certificate is in effect.

2.  To obtain a Certificate of Confidentiality (Updated April 2020): 

Step 1: Go to this link: https://grants.nih.gov/policy/humansubjects/coc/request-certificate.htm and click on “Access NIH Certificate of Confidentiality System”  

Step 2: Fill out these 6 questions and click "Next"

Step 3: Fill out the next application questions that comes up. [please note: you will be asked to provide the following information, including the Institutional Official’s contact info. It is: Brian Smith, [email protected], 415.514.2080

Do not submit until your study is approved.

  • [UCSF IRB #(XX-XXXXX)] + Research Project Title
  • Project Start Date
  • Project End Date  [must be a date a few weeks ahead of application date- NIH won't approve if they receive a date prior to their review]
  • Project Description
  • Name of Institution 
  • Institution Address [505 Parnassus Ave., San Francisco, CA 94143]
  • Name of Institutional Official (Brian Smith)
  • Email Address of Institutional Official ([email protected])
  • Phone Number of Institutional Official (415.514.2080)
  • Performance Site Name
  • Performance Site Address
  • Name of PI
  • Other Key Personnel
  • List any drugs that will be administered in this study, including method of administration and dosage (e.g. Phenobarbital 50 mg 2 times daily)

   Add Drug name [if applicable, upload proof of DEA controlled substance registration in field provided]

Step 4: Click “Submit for Verification”

Step 5: Wait to hear back from NIH.

Once submitted, the NIH will send an e-mail to the Institutional Official, Brian Smith, for verification. Please do not contact Brian Smith with questions about your application. The information will be verified and confirmed to NIH, and NIH will contact you. We anticipate providing an update on the status within a week.

NIH contact info: [email protected]

Consent Form Wording

When a researcher obtains a CoC, the research subjects must be told about the protections afforded by the certificate and any exceptions to those protections. The IRB-approved consent form should include the Suggested Consent Language Describing the CoC Protections from NIH.

Step 1 in the Procedures section describes how/when to add this wording to your study, based on the study status.

Resources

  • Guidance on Certificate of Confidentiality: This memo provides information about CoCs, which federal agencies may issue to researchers to protect subjects' privacy, and highlights good data management practices in cases where identifiable research information is commingled with other data. 

Last updated: