Skip to main content

Certificates of Confidentiality

On September 7, 2017, NIH issued its Notice of Changes to NIH Policy for Issuing Certificates of Confidentiality which is effective October 1, 2017. The agency’s policy on Certificates of Confidentiality (CoCs) was updated to comply with Section 2012 of the 21st Century Cures Act, Privacy Protection for Human Research Subjects, which amends the Public Health Service Act with respect to the certificates. Although CoCs are intended to prohibit disclosure of sensitive, identifiable information in response to legal demands, applicability has been broadened to include the following:

  • Human subjects research as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46), including exempt research except for human subjects research that is determined to be exempt from all or some of the requirements of 45 CFR 46 if the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
  • Research involving the collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual;
  • Research that involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of the human subjects can readily be ascertained as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46); or
  • Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual, as defined in subsection 301(d) of the Public Health Service Act.

Effective October 1, 2017, certificates of confidentiality will issue automatically for applicable NIH awards as part of the award terms and conditions. NIH will not determine applicability, that is now the responsibility of the awardee institution and investigators.   Also, NIH will no longer provide a paper certificate. The award itself may be used as confirmation that CoC protections are in place. The policy applies to research commenced or ongoing on or after December 13, 2016. The NIH CoC website has now been updated and includes updated consent language and FAQs.

With respect to ongoing studies, it is our understanding from emails and discussions with NIH staff that participants in ongoing studies do not have to be re-consented and that consent forms can be updated at continuing review.  “Neither the NIH Policy on Certificates of Confidentiality nor subsection 301(d) expect participants consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted to be informed of the Certificate, although IRBs may determine whether it is appropriate to inform participants.”  However, the associated question asks "If part of my cohort was recruited prior to issuance of the Certificate but they are no longer actively participating in the study, do I need to re-consent them?"  We have asked NIH staff whether the second part of that sentence, “but they are no longer actively participating in the study” should be omitted from the question or whether the answer should indicate that consent forms can be revised at continuing review.  It is also our understanding that sub-award agreements do not have to be amended until the next funding cycle but that is not clear from the website/FAQs.

 Institutions and investigators can also send questions to: NIH CoC Coordinator.