Guidance for Certificates of Confidentiality (COC)
When conducting human subject research that involves sensitive identifiable information, the IRB may ask a
researcher to apply for a Certificate of Confidentiality (COC) for the project. Certificates of Confidentiality
are granted by the Department of Health and Human Services (DHHS) Institutes or Centers, and they are
intended to prevent researchers from being compelled to release research information (thereby protecting
the participating subjects’ privacy). Information about COC’s can be accessed at the NIH website called
the “Certificate of Confidentiality Kiosk. http://grants2.nih.gov/grants/policy/coc/ The NIH also has a
section of the kiosk for Frequently Asked Questions http://grants2.nih.gov/grants/policy/coc/faqs.htm
which contains a wealth of information about the Certificates and the process, and you are strongly
encouraged to read it. The information presented in this guidance is only a general summary of information.
This guidance will provide information on:
§ The purpose of COC
§ What is meant by “identifying characteristics”
§ What is meant by “sensitive information”
§ Examples of research projects that are eligible for a COC
§ How research may be affected
§ Time considerations in the COC application process
§ Deciding to which Institute or Center to apply
§ Instructions for preparing your COC application:
§ Instructions for preparing the consent document to accompany the COC application
§ Instructions for submitting the application to the IRB and DHHS Institute/Center
§ COC approval periods and renewals
§ How making changes in the research may affect your COC
§ Whom to contact if you need more information
Purpose of a COC
A COC assists researchers in protecting the privacy of human research participants enrolled in
biomedical, behavioral, clinical and other forms of sensitive research. Certificates protect against
compulsory legal demands, such as court orders and subpoenas, for identifying information or
identifying characteristics of a research participant.
What is meant by “identifying characteristics”?
Identifying characteristics include things such as:
o name;
o address;
o social security or other identifying number;
o fingerprints, voiceprints, photographs;
o genetic information or tissue samples; or
o any other item or combination of data about a research participant which could reasonably
lead, directly or indirectly by reference to other information, identifying a research subject.
What is meant by “sensitive information”
According to the NIH website, sensitive information includes (but is not limited to):
o information relating to sexual attitudes, preferences, or practices such as sodomy, incest,
sexual orientation, or sexual activity of minors;
o information relating to the use of alcohol, drugs, or other addictive products;
o information pertaining to criminal, illegal or controversial conduct;
o information that, if released, might be damaging to an individual's financial standing,
employability, or reputation within the community or might lead to social stigmatization or
discrimination;
o information pertaining to an individual's psychological well-being or mental health; and
o genetic information or tissue samples.
v 8/07
Examples of research projects that are eligible for a COC:
Examples of research are eligible for a Certificate are: research on HIV, AIDS, and other STDs;
studies that collect information on sexual attitudes, preferences, or practices; studies on the use of
alcohol, drugs, or other addictive products; studies that collect information on illegal conduct; studies
that gather information that if released could be damaging to a participant's financial standing,
employability, or reputation within the community; research involving information that might lead to
social stigmatization or discrimination if it were disclosed; research on participants' psychological
well being or mental health; genetic studies, including those that collect and store biological samples
for future use; research on behavioral interventions and epidemiologic studies.
Examples of genetic research projects that may need a COC:
Not all studies involving genetic testing will require a COC. Generally, the IRB may request the
investigator to apply for a COC when there is a reasonable likelihood during the time frame of the
study that the genetic results would reveal a susceptibility to a disease or drug interaction, or for
studies where there might be information learned that would not otherwise have been recorded in
the subject’s medical record.
For example, if testing is related to an already known diagnosis obtaining a COC would not generally
be required; however, if any of the following apply obtaining a COC may be requested:
o
o
o
unaffected family members are being tested or the test is intended to diagnose or
characterize risk of developing a disease in subjects who have not already been diagnosed;
characterizing risks of developing a disease in subjects who have not already been
diagnosed; or
there is a reasonably likelihood that the results of the tests could demonstrate a condition
that would be harmful or stigmatizing to the research subject if released.
How research may be affected
The IRB will allow most research projects that involve sensitive identifiable information to begin (or
continue) prior to having an approved Certificate of Confidentiality on file at the IRB, provided that
evidence of the submission to DHHS is submitted to the IRB (see instructions in “Submitting the
Application” below).
A few kinds of research may be deemed too sensitive to proceed without an approved COC in place.
In those rare cases, the IRB may require receipt of the approved Certificate before allowing the
research to begin. If you receive a document that states that receipt of an approved COC is
required in order for the IRB to issue final approval, please contact the IRB for further instructions.
Otherwise, please follow the instructions as listed below.
Time Considerations in the COC application process
DHHS suggests that applications for Certificates should be submitted at least three months prior to
the date on which enrollment of research subjects is expected to begin. Since IRB approval (or
approval pending receipt of the COC) is required before submitting the application, this means that
submitting to the IRB as early as possible to begin the review process is recommended.
Deciding to which Institute or Center to apply
1. If your research involves an IND (Investigational New Drug application) then you must apply to the
FDA for your Certificate of Confidentiality. If it does not involve an IND, and is sponsored by an
Institute or Center, you must apply to your sponsoring Institute for your Certificate.
2. If your project is not funded by a National Institute or Center, you may still apply for a COC from the
Institute or Center that handles the related area of scientific research. For instance, if you are to
v 8/07
conduct a project in which you will collect lung specimens for a repository, you would send your
COC application to the National Heart, Lung, and Blood Institute (NHLBI). If there is no Institute or
Center that has an area similar to your research area, you may submit your application to the central
COC resources at the DHHS—the NIMH. Their contact information is listed in #3.
3. If you have any doubt about where to send your application, contact the COC Central Resource
representatives at the NIMH, and ask which Institute or Center is appropriate place to send the
application. The list of COC representatives at each Institute and Center is available on their
website at http://grants2.nih.gov/grants/policy/coc/contacts.htm. If you need further assistance,
contact the IRB.
Instructions for preparing your COC application:
The COC “application” is not an actual form provided to you; it is simply a letter you write on Institutional
letterhead that contains the following information:
1. Name and address of applicant research institution. This is the institution with which the applicant
is affiliated and the recipient of grant support for the research, if any.
2. Sites where the research will be conducted and a brief description of the facilities available for the
conduct of the research. Please indicate if this is a multi-site project. The lead site of a multi-site
project should apply for a single Certificate to protect participants enrolled at all sites. However,
multi-site applicants must list each participating unit, its address, and project director. If any new
sites are added after the certificate is issued, the lead site should provide NIH with an updated list
and the cover letter should include a statement by the lead site that IRB approval has been given at
the new site and that the lead site is maintaining a copy of that approval (see item 5(b) below.)
3. Title of the research project. If the project title on the IRB form (see item 6 below) is different from
the title given here, the applicant must document that the IRB approval pertains to this project.
4. Source and number of the supporting grant, if applicable (e.g., NIMH, NIH, 1 R01 MH 12345-01;
ABC Foundation, Grant No. 123). If the NIH funds the project, please provide the name and
telephone number of the Project Officer at the funding center. If there is no support, type "None."
5(a). Requirement - A Certificate of Confidentiality will not be issued to an applicant conducting
research involving human subjects unless the project has IRB approval. If the applicant institution is
receiving DHHS funding for research involving human subjects, an OHRP-approved IRB for that
institution must approve the project for which a Certificate of Confidentiality is sought. For additional
information on OHRP and IRB assurances, see
http://www.hhs.gov/ohrp/assurances/assurances_index.html .
5(b). Documentation of IRB approval: Attach a copy of your IRB approval letter signed by an
authorized IRB representative. Approval must be current and unconditional, or conditioned only
upon the issuance of a Certificate of Confidentiality. If this is a multi-site project, the lead site must
maintain a copy of the IRB approval from each site, which must be made available to the NIH upon
request.
5(c). Documentation of IRB qualifications: For all projects, submit for the IRB that reviewed the
project the assurance number assigned by OHRP or documentation that the IRB complies with the
applicable Federal regulations governing research involving human subjects. If this is a multi-site
project, the lead site must maintain the OHRP Federal Wide Assurance (“FWA”) number for the
reviewing IRB at each site, which must be made available to the NIH upon request.
UT Southwestern’s FWA Number is 00005087
v 8/07
6. Name, title, mailing and email addresses, telephone and fax numbers of the Applicant as well as
name and title of other key personnel. Also include a brief summary of the scientific training of the
Applicant and key personnel. If this is a multi-site project, only information from the lead site should
be submitted to the NIH. However, the lead site must collect and maintain this information for each
site and make it available to the NIH upon request.
7. Beginning date and expected end date of the project. The Certificate will state the date upon
which it becomes effective and the date upon which it expires. A Certificate of Confidentiality
protects all information identifiable to any individual who participates as a research subject (i.e.,
about whom the investigator maintains identifying information) during any time the Certificate is in
effect. The protection afforded by the Certificate is permanent. NOTE: If this project is not
completed by the expiration date, the Applicant must submit a written request for an
extension three months prior to the expiration date. Any such request must include a brief
description of the reason for the extension, documentation of the most recent IRB approval,
and the expected date for completion of the research project.
8. Concise description of project aims and research methods (1-2 paragraphs, omit background).
This section should include a brief description of procedures for the collection and storage of
identifying information as well as the number of subjects to be included in the study, the source from
which they will be recruited, and a description of the study population (e.g., gender, age, race, etc.) If
significant changes are made to the project aims or methods during the course of the study, the
Applicant should contact the Certificate Coordinator who issued the Certificate. That person will
determine if the Certificate can be modified or if the Applicant will need to submit an amended
application.
9. A description of means used to protect subjects' identities (i.e., subjects are coded by numbers
not names, linking information is kept in locked files, identifiers will be destroyed when the study is
completed, etc.)
10. Reasons for requesting a Certificate of Confidentiality (e.g., will collect sensitive information,
identifying information on subjects, etc.) Include brief description of sensitive and identifying
information to be collected.
11. Informed consent forms for human subjects, as approved by the IRB (attach copy). The informed
consent form must include a description of the protections and limitations of the Certificate of
Confidentiality, including the circumstances in which the investigators plan to disclose voluntarily
identifying information about research participants (e.g., child abuse, harm to self or others, etc.) If
significant changes are made to the informed consent form, the Applicant should contact the
Certificate Coordinator who issued the Certificate and submit a copy of the revised consent
form. If this is a multi-site project, the lead site must indicate that it has on file a copy of the consent
form as approved by the IRB from each site, which will be made available to the NIH upon request.
12. Research not funded by NIH in which drugs will be administered to human subjects must provide
the following additional information:
• Identification of drugs to be administered;
• Description of methods for administration of these drugs, including a statement of dosages;
• Evidence that individuals who will receive the drugs are authorized to do so under applicable
Federal and State law.
13. All research in which a controlled drug or drugs will be administered must submit a copy of the
Drug Enforcement Administration Certificate of Registration (BND Form 223) under which the
research project will be conducted.
v 8/07
14. If the research project is testing for reportable communicable diseases, the applicant must
submit information relating to its compliance with State reporting laws as specified in the August 9,
1991 memorandum from the Assistant Secretary for Health
http://grants.nih.gov/grants/policy/coc/cd_policy.htm .
Assurances
The following assurances are required and the following information should be inserted verbatim into
the Certificate application letter. Both the PI and the Institutional Official must sign this letter:
•
This institution agrees to use the Certificate of Confidentiality to protect against the
compelled disclosure of personally identifiable information and to support and defend the
authority of the Certificate against legal challenges.
•
The institution and personnel involved in the conduct of the research will comply with the
applicable Federal regulation for the protection of human subjects or, if no such Federal
regulation is otherwise applicable, they will comply with 45 CFR Part 46.
•
This Certificate of Confidentiality will not be represented as an endorsement of the project by
the DHHS or NIH or used to coerce individuals to participate in the research project.
•
All subjects will be informed that a Certificate has been issued, and they will be given a
description of the protection provided by the Certificate.
•
Any research participant entering the project after expiration or termination of the Certificate
will be informed that the protection afforded by the Certificate does not apply to them.
__________________________
Signature of Principal Investigator
_______________________
Signature of Institutional Official
Angela Wishon, J. D.
Vice President for Research Administration
Instructions for preparing the consent document to accompany the COC application:
1. For the consent form, do NOT use the suggested consent language provided on the Certificate
of Confidentiality Kiosk website. Please use the standard UT Southwestern language outlined in
the Consent Form Template.
Submitting the application to the IRB and the DHHS Institute/Center:
1. After preparing your COC application, place a cover memo on it that indicates that it is a COC
application that is being submitted for the signature of the Institutional Official. Submit the memo,
the application form (signed by the PI), and copies of the consent document(s) to the IRB office.
After reviewing the application, the IRB will forward it to the Institutional Official for signature. If you
haven’t received it previously, the IRB will also release your project approval at this point. Only if
your project is of such a sensitive nature that the IRB requires that you receive your COC prior to
starting will you receive an approval letter conditioned on the receipt of the COC and not have any
consent forms released to you at this time.
2. The IRB will notify you when the application has been signed.
v 8/07
3. Include a copy of the signed IRB approval letter that is printed on IRB letterhead. If the IRB office
did not generate a signed letter for you previously (not all projects receive signed letters), contact the
IRB to have one created for you prior to sending in your application.
4. Send your completed COC application packet to the appropriate DHHS Institute or Center address.
5. Once you receive your approved Certificate, or notification that the COC was denied, please submit
a copy of the approved certificate or denial letter to the IRB office.
COC approval periods, renewals, and changes
In your COC application, you will be asked to indicate the beginning date and expected end date of
the project. The Certificate you receive will state the date upon which it becomes effective and the
date upon which it expires. A Certificate of Confidentiality protects all information identifiable to any
individual who participates as a research subject (i.e., about whom the investigator maintains
identifying information) during any time the Certificate is in effect. The protection afforded by the
Certificate is permanent.
NOTE: If you determine that the research project for which you have received a Certificate of
Confidentiality will extend beyond the expiration date on the Certificate, you may submit a written
request for extension of the date. This request should be submitted to the DHHS Institute/Center
issuing the certificate at least three months prior to the Certificate's expiration. It must include an
explanation of the reasons for requesting an extension (e.g., new subjects continue to be enrolled in
the project), a revised estimate of the date for completion of the project, documentation of the
Institutional Review Board's most recent approval for the project, and a copy of the consent form
which should include language explaining the Certificate's protections, specify any voluntary
disclosures, and clearly state any other limitations. If your request is approved, an amended
Certificate will be issued.
How making changes in the research may affect your COC
If a significant change in your research project is proposed after a Certificate is issued, you must
inform the Certificate Coordinator of the Institute issuing the certificate by submitting an amended
application for a Certificate of Confidentiality (in the same form and manner as your original
application for a Certificate). Significant changes include: major changes in the scope or direction of
the research protocol, changes in personnel having major responsibilities in the project, or changes
in the drugs to be administered (if any) and the persons who will administer them.
Amended applications will be reviewed by the NIH Institute issuing the certificate and either
approved or disapproved. If an amended application is approved, an amended Certificate of
Confidentiality will be issued. If an amended application is disapproved, you will be notified that
adoption of the proposed significant change(s) will result in prospective termination of the original
Certificate. Any termination of a Certificate of Confidentiality is operative only with respect to the
identifying characteristics of individuals who began their participation as research subjects after the
effective date of such termination.
Whom to contact if you need more information
• UT Southwestern’s IRB (214) 648-3060
• Certificate Coordinators at the various Centers and Institutes. They are all listed on the NIH’s COC
Kiosk website at http://grants2.nih.gov/grants/policy/coc/contacts.htm .
v 8/07