National Institutes of Health

Policy and Procedure Changes for Certificates of Confidentiality

Issue Date: September 7, 2017

Effective Date: October 1, 2017 retroactive to research commenced or ongoing on or after December 13, 2016

Policy

Certificates of Confidentiality protect research information by prohibiting certain disclosures and conditioning others upon consent from the research participant. Until now, researchers had to apply to NIH for these Certificates when it was thought that this additional safeguard was necessary to minimize risks to research participants.

Policy Changes

  1. Certificates of confidentiality will now be issued automatically for applicable NIH awards as part of the award terms and conditions.
  1. NIH will no longer determine applicability; that is now the responsibility of the awardee institution and investigators. NIH has not yet provided formal guidance regarding whether the IRB can use any discretion in applying this policy. Information will be provided on the HRPP website once guidance is issued by NIH.
  1. Although Certificates are intended to prohibit disclosure of sensitive, identifiable information in response to legal demands, applicability has been broadened to include the following:
  • Human subjects research as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46), including research that is determined to be “exempt”. EXCEPTION: Human subjects research that is determined to be exempt from all or some of the requirements of 45 CFR 46 if the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
  • Research involving the collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual;
  • Research that involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of the human subjects can readily be ascertained as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46); or
  • Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual, as defined in subsection 301(d) of the Public Health Service Act.

Procedures for Researchers

  • NIH will no longer provide a paper certificate. The award itself may be used as confirmation that Certificate of Confidentiality protections are in place. If subpoenaed or otherwise asked to disclose individually identifiable data to people outside of the study team, please contact the OSU Human Research Protection Program.
  • The application process remains largely unchanged for those seeking a Certificate for projects not funded by NIH
  • Research participants already enrolled in applicable studies do not need to receive a notification or a new consent form.
  • Consent forms and protocols must be updated at the time of continuing review for applicable studies for which recruitment and/or enrollment is ongoing. The required language for the consent document can be found on the NIH website and will be updated soon on the HRPP website under “Suggested Language for Consent Forms”.
  • All new studies with NIH funding and potentially identifiable subject data or specimens must include relevant language in the protocol and consent documents

Prohibited Disclosures of Covered Information

For projects covered by a Certificate, the researcher shall not:

  • Disclose or provide, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
  • Disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research.

Permitted Disclosures of Covered Information

Disclosure of covered information is permitted only when:

  • Required by Federal, State, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding;
  • Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual;
  • Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
  • Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human subjects in research.

Contacts

Contact the Human Research Protection Program about project revisions and applicability

Contact OSRAA with questions about how and when to amend sub awards

Additional Information and Resources