What is a Certificate of Confidentiality (CoC)?
A Certificate of Confidentiality (CoC) is issued by the National Institutes of Health (NIH) or the Food and Drug Administration (FDA) to protect identifiable research information from forced disclosure. Researchers will need to apply for a CoC for non-federally funded research. A CoC is designed to protect the privacy of research participants enrolled in biomedical, behavioral, clinical, or other types of health-related research that collect or use identifiable, sensitive information. Any investigator engaged in research in which sensitive information is gathered from human subjects (or any person who intends to engage in such research) may apply for a CoC.
Why is a CoC important?
A CoC may be granted for studies collecting information that, if disclosed, could have adverse consequences for study subjects or damage their financial standing, access to resources, employability, insurability, or reputation. With limited exceptions, researchers may not disclose names or any information, documents, or biospecimens containing identifiable, sensitive information. The CoC prohibits disclosure in response to legal demands, such as a subpoena.
What is identifiable, sensitive information?
The statute that governs the CoC broadens the meaning of sensitive, identifiable information and focuses directly on identifiability. Identifiable, sensitive information is information about an individual, gathered or used during biomedical, behavioral, clinical, or other research, through which the individual may be identified (e.g., name, social security number, medical record).
Identifiable information includes a combination of different data points that could be used to determine the identity of an individual through a request for the information and a combination with other available data sources (e.g., zip code, job title, and age). Identifiable, sensitive information includes but is not limited to name, address, social security, or other identifying number; and fingerprints, voiceprints, photographs, video, genetic information, tissue samples, or data fields that when used in combination with other information may lead to the identification of an individual.
What are examples of identifiable sensitive information?
Research can be considered “sensitive” if it involves the collection of:
- Information in a subject’s medical record (e.g., research on HIV, AIDS, and STDs);
- Information that could lead to social stigmatization or discrimination;
- Information about sexual engagement, attitudes, preferences, or practices;
- Information about personal use of alcohol, drugs, or other addictive products;
- Information about illegal or illicit conduct;
- Information that could damage an individual’s financial standing, educational or resource access, employability, or reputation within the community;
- Information about a subject's psychological well-being or mental health;
- Genetic studies, including those that collect and store biological samples for future use;
- Research on behavioral interventions and epidemiologic studies.
What are the researcher’s responsibilities under a Certificate of Confidentiality (CoC)?
Investigators or an institution issued a CoC shall not:
- Disclose or provide information covered by the CoC, in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings; or
- Disclose or provide CoC covered information to any person not connected with the research for which the CoC is issued.
Investigators or an institution issued a CoC should:
- Inform participants about the CoC protections;
- Inform other institutions and investigators receiving a copy of the CoC about the CoC’s protections; and
- Protect participants’ identifiable, sensitive information from compelled disclosure and support and defend the authority of the Certificate against legal challenges.
Is the researcher responsible for informing research participants of a CoC?
- When a researcher is issued a CoC and the researcher will be obtaining informed consent from participants, the National Institute of Health (NIH) expects that the subjects will be told about protections afforded by the CoC and any exceptions to those protections.
- Additionally, the researcher should be prepared to answer any questions proposed by subjects about a CoC including its purpose in research and why it was obtained.
In what situations may CoC covered information be disclosed?
- Required by other federal, state, or local laws, such as for public health reporting of communicable diseases, or child or elder abuse reporting;
- Made with the consent of the subject; or
- Made for the purposes of scientific research that is compliant with human subjects’ regulations.
If the study is funded by the National Institute of Health (NIH), do I need to request a CoC?
No, eligible research studies that are funded by NIH are automatically issued a CoC under the NIH CoC Policy.
Does the NIH issue CoCs for research involving identifiable, sensitive information funded by other Health and Human Services (HHS) operating divisions?
Several non-NIH HHS agencies, including the Center for Disease Control and Prevention (CDC), the Food and Drug Administration (FDA), Health Resources and Services Administration (HRSA), Substance Abuse and Mental Health Services Administration (SAMHSA), and Indian Health Service (HIS), issue CoCs.
Summary
Researchers should note, a CoC might appear to override city or state law reporting requirements, but at this time it is unclear whether a court would agree with CoC protections. Teachers College Institutional Review Board (TC IRB) has resolved this uncertainty by voluntarily complying with city and state disclosure and reporting laws as a matter of policy. CoCs do not preclude our voluntary compliance with laws requiring reports of suspected abuse, infectious disease, or other events, provided that researchers disclose this information in a study consent form.
By protecting investigators and institutions from being compelled to disclose information that would identify research subjects, CoCs offer researchers a pathway to achieve the research objectives and promote participation in studies by protecting the subject's privacy and confidentiality. If you have questions regarding the Certificate of Confidentiality (CoC) process, please contact IRB@tc.edu.
Resources
CoC Mailbox: NIH-CoC-Coordinator@mail.nih.gov
NIH Institutional Assurance Statement
NIH Frequently Asked Questions (FAQ