Certificate of Confidentiality

Certificates of Confidentiality (COCs) are issued by the National Institutes of Health (NIH) to protect identifiable research information from forced disclosure. They allow the investigator and others who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level.

Identifying information is broadly defined as any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

By protecting investigators and institutions from being compelled to disclose information that would identify research subjects, Certificates of Confidentiality help achieve the research objectives and promote participation in studies by helping assure confidentiality and privacy to participants (source DHHS).

Why Might an Investigator Want to Apply for a COC?

A COC can be used for clinical, behavioral, biomedical, social, or other types of research that collect sensitive information. Research may be considered sensitive if disclosure of that information could have adverse consequences for the subject or damage their financial standing, employability, insurability, or reputation.

Examples of Information that May be Considered Sensitive

  • Information relating to sexual attitudes, preferences, or practices;
  • Information relating to the use of alcohol, drugs, or other addictive products;
  • Information pertaining to illegal conduct;
  • Information that if released could reasonably be damaging to an individual’s financial standing, employability, or reputation within the community;
  • Information pertaining to an individual’s psychological well-being or mental health;
  • Information about genetic information;
  • Information in other categories not listed may also be considered sensitive because of specific cultural or other factors, and protection can be granted in such cases upon appropriate justification and explanation

Does the IRB Require a COC for All Studies Collecting Sensitive Information?

There are certain instances where the information is so sensitive that the IRB feels it is in the best interest of the subject to apply for a COC.

However, in many cases, it might be sufficient to inform potential subjects of the possibility of forced disclosure of sensitive information to outside parties.

How to Apply for a Certificate of Confidentiality

First, you should identify if a COC is appropriate for your research. When the research is of a sensitive nature where the protection is judged necessary to achieve the research objectives, a certificate of confidentiality should be sought.

If the data being collected is considered sensitive and you wish to add this layer of additional protection to the data:

  1. Inform the IRB of your plans to apply for a COC in your IRB application.
  2. Submit two versions of your consent form. One version should not contain any language referring to holding a certificate of confidentiality. The other version should contain the language you plan to use regarding holding a certificate of confidentiality. Upon approval of your submission, the IRB will stamp the consent form that does not contain the COC language. You may use this consent form to get started with your research. The IRB will make a notation in your approval letter that the IRB approves the use of a COC.
  3. The investigator should then apply for a COC through NIH’s kiosk. Please note that the NIH requires verification of IRB approval and a signature from Kathryn Mellouk, who is the Institutional Official for the Charles River Campus IRB at BU.
  4. Once the COC is obtained, investigators should submit an amendment to the IRB to have the version of the consent form that includes COC language approved for use.

Informing Subjects of Protections Under a COC

Subjects should be informed of the protections afforded to them by the COC and any exceptions to those protections. Investigators should include language in the consent form that addresses the purpose of the COC and any limitations/exclusions.

Examples of language:
To help us protect your privacy, we have obtained a Certificate of Confidentiality from the National Institutes of Health. With this Certificate, the investigator cannot be forced to disclose information that may identify you, even by a court subpoena, in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings.

Exceptions: A Certificate of Confidentiality does not prevent investigator from voluntarily disclosing information about you, without your consent. For example, we will voluntarily disclose information about incidents such as child abuse, and intent to hurt yourself or others.

In addition, a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the investigator may not use the Certificate to withhold that information.

Finally, the Certificate may not be used to withhold information from the Federal government needed for auditing or evaluating Federally funded projects or information needed by the FDA.

A COC Does Not Abdicate PI Responsibilities

Certificates of Confidentiality do not take the place of good data security or clear policies and procedures for data protection which are essential to the protection of research participants’ privacy.

Investigators should take appropriate steps to safeguard research data and findings.

When a COC Might Not be Granted by the NIH

An application for a Certificate of Confidentiality does not guarantee that one will be issued. Research that might not be granted a COC:

  • Not research based
  • Not approved by an IRB operating under either an approved Federalwide Assurance issued by the Office of Human Research Protections or the approval of the Food and Drug Administration
  • Not collecting sensitive information or information that, if released publicly, might harm the research participants
  • Not collecting personally identifiable information, or
  • Not involving a subject matter that is within a mission area of the National Institutes of Health

External Resources

NIH Certificate of Confidentiality Kiosk (where investigators can get started with a COC application)
NIH Announces Statement on COCs