resources > Toolkit > setting up

Certificates of Confidentiality

Certificates of Confidentiality (CoCs) protect the privacy of research participants by preventing the disclosure of identifiable and sensitive research information to anyone not directly involved in the research unless the participant provides consent or in other specific circumstances. 

Certificates of Confidentiality were created by Congressional act, making them a particularly strong safeguard against the disclosure of potentially identifiable data, including as part of lawsuits and subpoenas.

The definition of “identifiable, sensitive” information covered by CoCs is also particularly robust. The relevant U.S. Code (42 U.S.C. § 241(d)(4)), defines identifiable, sensitive information as “information that is about an individual and that is gathered or used during the course of research…and:

• Through which an individual is identified; or
• For which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual” (emphasis added).

The CoC protections cover all copies of information, documents, or biospecimens gathered or used by the investigator during the research, including copies that are shared for other research activities.

Obtaining a Certificate of Confidentiality

Since October 2017, NIH automatically gives CoCs to qualifying NIH-funded studies, though not to research programs more broadly. Several HHS agencies also issue CoCs. When a CoC has automatically been granted, information to this effect typically can be found in the research grant’s terms and conditions.

NIH will consider requests for CoCs for specific research projects that are not funded by NIH, if the project:

• Collects or uses identifiable, sensitive information, 
• Covers a topic that is within the NIH mission or HHS health-related research mission, 
• Covers research information that is collected, used, or stored in the US, and 
• Is conducted in accordance with 45 CFR 46 and relevant subparts (i.e, the regulations for the protection of human subjects in research), and all applicable federal, state, and local laws and regulations.

Investigators conducting non-NIH funded research can apply for a CoC through the NIH online CoC system.

University General Counsel offices should familiarize themselves with the applicability of, and the protections offered by, Certificates of Confidentiality. 

Researchers should consider whether their research projects could qualify for Certificates of Confidentiality, inquire with program officers at federal agencies about whether a CoC will be automatically granted,  and, where it is not, consider applying to NIH for a CoC before the research begins.

Resources:

• External user guide for CoCs – very thorough; walks you through the process of requesting a CoC from NIH
• CoC podcast – just under 11 minutes
• CoC request form through NIH
• CoC FAQs
• Example informed consent language for research covered by a CoC