NIH and Certificates of Confidentiality

On October 1, 2017, the National Institutes of Health (NIH) updated its policy for issuing Certificates of Confidentiality.

Certificates of Confidentiality are issued by the NIH, and they protect the privacy of research participants enrolled in biomedical, behavioral, clinical, or other research. With limited exceptions, researchers may not disclose names or any information, documents, or biospecimens containing identifiable, sensitive information. The Certificate prohibits disclosure in response to legal demands, such as a subpoena.

Under the new policy, the investigator will not need to apply for a Certificate. All eligible research studies that are funded by NIH are automatically issued a certificate under the NIH Policy on Certificates of Confidentiality.

Additional information regarding the policy can be found on an FAQ page on the NIH website.

To determine if a study (which is conducted or supported by NIH) qualifies for a Certificate of Confidentiality, the investigator must answer the following question:

  • Is the activity biomedical, behavioral, clinical, or other research?
    • ☐ YES
    • ☐ NO

If the answer to the above question is “NO”, then this study will not be issued a Certificate of Confidentiality by the NIH. If the answer is “YES”, the investigator must consider the questions below:

  • Does the research involve Human Subjects as defined by 45 CFR 46?
  • Are you collecting or using biospecimens that are identifiable to an individual as part of the research?
  • If collecting or using biospecimens as part of the research, is there a small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual?
  • Does the research involve the generation of individual level, human genomic data?

If the answer to any one of the four questions above is “YES”, then this NIH policy will apply and will be considered to have a Certificate of Confidentiality by the NIH.

If a study is covered under this policy, the consent form must include language about the protections and exceptions allowed with the Certificate. The NIH has updated the required consent form language. Note: A consent form with the applicable language must be included with the IRB submission.

The new Expedited/Full Board CRC IRB Application has been revised to address this new policy.

If you have any questions regarding the new NIH policy regarding certificates of confidentiality, please contact the IRB Director, Cynthia Monahan, at cmonahan@bu.edu or 617-353-6345.

Information For...