A Certificate of Confidentiality (CoC) is issued by the National Institutes of Health (NIH) or the Food and Drug Administration (FDA) to protect identifiable research information from forced disclosure. A CoC is designed to protect the privacy of research participants enrolled in biomedical, behavioral, clinical, or other types of health-related research that collect or use identifiable, sensitive information. NIH-funded research is automatically enrolled in the CoC program. Researchers will need to apply for a CoC for non-federally funded research.
A CoC may be granted for studies collecting information that, if disclosed, could have adverse consequences for study subjects or damage their financial standing, access to resources, employability, insurability, or reputation. With limited exceptions, researchers may not disclose names or any information, documents, or biospecimens containing identifiable, sensitive information. CoCs prohibit disclosure in response to legal demands, such as a subpoena.
When a Certificate of Confidentiality is obtained, the research subjects must be told about the protections afforded by the Certificate and any exceptions to that protection (e.g., reports of suspected abuse or infectious disease) with that information included on the informed consent form. Researchers may adapt the consent form language to the needs of research participants, but should also align the document with the suggested language below.
- “To help us protect your privacy, we have obtained a Certificate of Confidentiality (CoC) from the National Institutes of Health (NIH). If there is a court subpoena, the researcher(s) can use this Certificate to legally refuse to disclose information that may identify you in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings [list any exceptions]
- The Certificate of Confidentiality will not be used to prevent disclosure to state or local authorities of [list what will be reported, such as child abuse and neglect, or harm to self or others].
- “The Certificate cannot be used to resist a demand for information from personnel of the United States federal or state government agency sponsoring the project that will be used for auditing or program evaluation of agency-funded projects or for information that must be disclosed in order to meet the requirements of the federal Food and Drug Administration (FDA).”
- “As a study participant, a Certificate of Confidentiality (CoC) does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, medical care provider, or other person obtains your written consent to receive research information, then the researchers will not use the Certificate to withhold that information.”
Researchers should ensure all confidentiality and data security statements on all participant materials match the protections outlined on the Certificate of Confidentiality and the intentions of the researchers to use these protections, as necessary.