Certificates of Confidentiality (CoC)
Purpose
This guidance is intended to help investigators understand how to use Certificates of Confidentiality and their limitations in protecting human research subjects.
What is a Certificate of Confidentiality?
A Certificate of Confidentiality (CoC) protects the privacy of research participants enrolled in biomedical, behavioral, clinical, or other types of health-related research that collect or use identifiable, sensitive information. With limited exceptions, investigators may not disclose names or any information, documents, or biospecimens containing identifiable, sensitive information. The CoC prohibits disclosure in response to legal demands, such as a subpoena.
When Is a Certificate of Confidentiality Required?
A CoC is automatically issued for many NIH-funded studies that collect or use identifiable, sensitive information.
The statute that governs Certificates of Confidentiality broadened the meaning of sensitive, identifiable information and focuses more directly on identifiability. Identifiable, sensitive information is information about an individual, gathered or used during biomedical, behavioral, clinical or other research, through which the individual is identified, or there is at least a very small risk that some combination of the information, a request for the information, and other available data sources could be used to determine the identity of an individual.
Identifiable, sensitive information includes but is not limited to name, address, social security or other identifying number; and fingerprints, voiceprints, photographs, genetic information, tissue samples, or data fields that when used in combination with other information may lead to identification of an individual.
Investigators should determine whether their study meets NIH criteria for automatic issuance.
Examples of research that may qualify:
- Biomedical, behavioral, clinical or other research, including exempt research, except where the information obtained is recorded in such a manner that human participants cannot be identified or the identity of the human participants cannot readily be ascertained, directly or through identifiers linked to the participants.
- The collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual.
- The generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human participants can be identified or the identity of the human participants can readily be ascertained.
- Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual.
Investigators who are uncertain whether their study is covered should consult the IRB or the funding agency.
How to obtain a Certificate of Confidentiality?
The process for obtaining a CoC depends on whether the research is funded by the National Institutes of Health (NIH) or another federal agency.
NIH-funded research
- Eligible research studies that are funded by NIH and involve identifiable, sensitive information are automatically deemed issued a Certificate under the NIH Policy on Certificates of Confidentiality.
- No separate application is required from the investigator.
- Investigators who wish to learn more about specific eligibility requirements should visit this link.
Non-NIH federally funded research
Non-NIH studies but funded by other federal agencies, investigators may need to:
- Check whether the funding agency participates in CoC issuance or has its own policy.
- Follow the sponsor's instructions
- Work with the institutional grants or compliance office, if required.
Non-federally funded research
Investigators and/or institutions engaged in non-federally funded research, in which identifiable, sensitive information is collected or used, are not required to obtain a Certificate. Investigators and/or institutions conducting biomedical, behavioral, clinical, or other research within the NIH mission in which identifiable, sensitive information is collected or used may request a Certificate of Confidentiality from NIH. Please consider the following procedures:
- Only apply for a CoC after the BYU IRB has approved the study.
- Include the IRB number and the title of the study.
- Be sure to use the BYU Institutional address.
All applicants who are not NIH-funded should apply using this link.
IRB Expectations
When submitting a study involving Certificate of Confidentiality (CoC), investigators should clearly describe the following:
IRB Application Section: Consent Documentation/Waivers
Investigators must inform participants of the protections and limitations of certificates of confidentiality. The consent form should include:
- A statement that research is protected by a Certificate of Confidentiality.
- A brief explanation of what it means when it is protected by CoC.
- Include the limitations of CoC.
The NIH provides Example Informed Consent Language for CoC’s that may be utilized.
Please note the following:
- For studies that were previously issued a Certificate, and notified participants of the protections provided by that Certificate, NIH does not expect participants to be notified that the protections afforded by the Certificate have changed, although IRBs may determine whether it is appropriate to inform participants.
- If part of the study cohort was recruited prior to issuance of the Certificate, but are no longer activity participating in the study, NIH does not expect participants consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted to be informed of the Certificate, although IRBs may determine whether it is appropriate to inform participants.
IRB Application Section: Confidentiality of Data
Explain that you've obtained (or plan to obtain) a Certificate of Confidentiality, what it protects against (compelled disclosure of identifiable research information in legal proceedings, such as court orders or subpoenas), and how it fits into your overall data protection plan alongside other safeguards like encryption or restricted access.
When Can Investigators Disclose Identifiable Participant Information Protected by a Certificate of Confidentiality?
When research is covered by a certificate of confidentiality, investigators:
1. May not disclose or provide, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
2. May not disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research.
3. May disclose information only when:
a. Required by Federal, State, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding.
b. Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual;
c. Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
d. Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human participants in research.
Investigators conducting research covered by a certificate of confidentiality, even if the research is not federally funded, must ensure that if identifiable, sensitive information is provided to other investigators or organizations, the other investigator or organization must comply with applicable requirements when research is covered by a certificate of confidentiality.