Office of Human Research Ethics SOP 2601: Certificate of Confidentiality

Title

Office of Human Research Ethics SOP 2601: Certificate of Confidentiality

1. Certificate of Confidentiality

Certificates of Confidentiality are issued by the National Institutes of Health (NIH) to protect identifiable research information from forced disclosure. They allow the investigator and others who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. A CoC does not protect against voluntary disclosures by the investigator, but those disclosures must be specified in the informed consent form. A investigator may not use the Certificate to withhold data if the participant consents in writing to the disclosure.

Generally, any research project that collects personally identifiable, sensitive information and that has been approved by an IRB operating under either an approved Federal‐Wide Assurance issued by OHRP or the approval of the FDA is eligible for a Certificate. Federal funding is not a prerequisite for an NIH‐issued Certificate, but the subject matter of the study must fall within a mission area of the National Institutes of Health, including its Institutes, Centers and the National Library of Medicine.

1.1 Statutory Basis for Protection

Protection against compelled disclosure of identifying information about subjects of biomedical, behavioral, clinical, and other research is provided by the Public Health Service Act §301(d), 42 U.S.C. §241(d):

"The Secretary may authorize persons engaged in biomedical, behavioral, clinical, or other research (including research on mental health, including research on the use and effect of alcohol and other psychoactive drugs) to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals."

1.2 Usage

Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation. By protecting investigators and institutions from being compelled to disclose information that would identify research subjects, CoCs help achieve the research objectives and promote participation in studies by assuring confidentiality and privacy to subjects.

Any investigator engaged in research in which sensitive information is gathered from human subjects (or any person who intends to engage in such research) may apply for a CoC. Research can be considered "sensitive" if it involves the collection of:

1. Research on HIV, AIDS, and STDs;
2. Information about sexual attitudes, preferences, practices;
3. Information about personal use of alcohol, drugs, or other addictive products;
4. Information about illegal conduct;
5. Information that could damage an individual's financial standing, employability, or reputation within the community;
6. Information in a subject's medical record that could lead to social stigmatization or discrimination; or
7. Information about a subject's psychological well‐being or mental health.
8. Genetic studies, including those that collect and store biological samples for future use;
9. Research on behavioral interventions and epidemiologic studies.

This list is not exhaustive. Investigators contemplating research on a topic that might qualify as sensitive should contact the IRB Office for help in applying for a certificate.

In the consent process and form, investigators should tell research subjects that a CoC is in effect. Subjects should be given a fair and clear explanation of the protection that it affords, including the limitations and exceptions noted above. Every research project that includes human research subjects should explain how identifiable information will be used or disclosed, regardless of whether or not a CoC is in effect.

1.3 Limitations

The protection offered by a Certificate of Confidentiality is not absolute. A CoC protects research subjects only from legally compelled disclosure of their identity. It does not restrict voluntary disclosures by subjects or investigators.

For example, a CoC does not prevent investigators from voluntarily disclosing to appropriate authorities such matters as child abuse, a subject's threatened violence to self or others, or from reporting a communicable disease. However, if investigators intend to make such disclosures, this should be clearly stated in the consent process and the form which research subjects are asked to sign.

In addition, a Certificate of Confidentiality does not authorize the person to whom it is issued to refuse to reveal the name or other identifying characteristics of a research subject if

1. The subject (or, if he or she is legally incompetent, his or her legal guardian) consents, in writing, to the disclosure of such information;
2. Authorized personnel of the Department of Health and Human Services (DHHS) request such information for audit or program evaluation, or for investigation of DHHS grantees or contractors and their employees; or
3. Release of such information is required by the federal Food, Drug, and Cosmetic Act or regulations implementing that Act.

1.4 Application Procedures

Any person engaged in research collecting sensitive information from human research subjects may apply for a Certificate of Confidentiality. For most research, Certificates are obtained from NIH. If NIH funds the research project, the investigator may apply through the funding Institute. However, even if the research is not supported with NIH funding, the investigator may apply for a Certificate through the NIH Institute or Center funding research in a scientific area similar to the project.

If the research is conducting a sensitive research project that is covered by the Agency for Healthcare Research and Quality (AHRQ) confidentiality statute (42 U.S.C. section299a-1(c) entitled “Limitation on Use of Certain Information”) or the Department of Justice (DoJ) confidentiality statute (42USC section 3789g), then a CoC is not required.

If there is an Investigational New Drug Application (IND) or an Investigational Device Exemption (IDE), the sponsor can request a CoC from the FDA.

For more information, see the NIH Certificates of Confidentiality Kiosk.

Contact Information

Policy Contact

Name: Carley Emerson
Title:  Director 
Unit: Office of Human Research Ethics (OHRE)
Email: carley_emerson@unc.edu