Certificates of Confidentiality

I. Summary
Certificates of Confidentiality (CoC) protect the privacy of subjects by limiting the disclosure of identifiable, sensitive information. NIH updated its policy for issuing CoCs, effective October 1, 2017. This update is a result of NIH’s need to implement Section 2012 of the 21st Century Cures Act, P.L. 114-255, enacted December 31, 2016. This law requires the Secretary of HHS to issue CoC to investigators or institutions who are engaged in federally funded biomedical, behavioral, clinical, or other research in which identifiable, sensitive information is collected. Certificates may also be issued if the research is not federally funded.

For studies that were previously issued CoC, and participants were notified of the protections provided by the CoC, NIH does not expect participants to be notified that the protections afforded by the CoC have changed. The IRB may determine whether it is appropriate to inform participants or require re-consent.

If part of the study cohort was recruited prior to issuance of the CoC, but are no longer actively participating in the study, NIH does not expect participants consented prior to the change in authority, or prior to the issuance of CoC, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted to be informed of the Certificate, although the IRBs may determine whether it is appropriate to inform participants.

CoCs protect research information by prohibiting certain disclosures and conditioning others upon consent from the subject. The protections and requirements of CoCs are outlined in 42 U.S.C. 241(d) and NIH policy (when applicable), and summarized below.

CoCs are obtained as follows:
- CoCs are issued automatically when research is conducted or supported by NIH and falls within the scope of the NIH policy.
- Research that is not funded by NIH (non-NIH research) may still have the protections afforded by CoCs through successful application to the NIH, FDA, or other authorized Federal agencies or departments. Additional information about CoCs and the application process for non-NIH research is available on the NIC CoC Website.
II. Definitions

The term “identifiable, sensitive information” means information that is about an individual and that is gathered or used during the course of biomedical, behavioral, clinical, or other research and—

(A) through which an individual is identified; or

(B) for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual.
III. Protection and Requirements
An investigator and institution issued CoC must:
- Abide by the requirements of the CoC
- Inform any sub-awardees that CoC is in place
- Inform others who receive a copy of protected information in the conduct of the research of the requirements of the CoC
- Inform research participants in the informed consent about the protections and limits to the CoC, using language approved by the ETSU or ETSU/VA IRB
When CoC is issued, whether automatically or under an approved application, the person(s) engaged in the research must not disclose or provide the name of a subject or any information, document, or biospecimen that contains identifiable, sensitive information about the subject and that was compiled for the purposes of the research:
1. In any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding, unless the disclosure is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
2. To any other person not connected with the research, unless:
  1. Required by Federal, State, or local laws (e.g., adverse event reporting to the FDA, transmissible disease reporting required under State law), but excluding proceedings as described in “1” above;
  2. Necessary for the medical treatment of the subject to whom the information, document, or biospecimen pertains and made with the consent of the subject;
  3. Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
  4. Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human subjects in research.
Additional Protections

Identifiable, sensitive information protected under CoC, and all copies thereof, are immune from the legal process, and shall not, without the consent of the of the individual to whom the information pertains, be admissible as evidence or used in any action, suit, or other judicial, legislative, or administrative proceeding.

Identifiable, sensitive information that has been collected under CoC, and all copies thereof, are protected for perpetuity.

Nothing in the rule (42 U.S.C. 241(d)) may be construed to limit the access of a subject to information about himself or herself collected during the research. When consent is obtained, the consent should inform subjects that CoC is in place and describe the protections and limitations
IV. NIH Policy
NIH funded studies:

Effective October 1, 2017, NIH will no longer accept applications for or issue paper Certificates of Confidentiality. Instead, investigators or institutions funded in whole or in part by NIH to conduct biomedical, behavioral, clinical, or other research in which identifiable, sensitive information is collected (“Covered Information”), are deemed to be issued CoC as a standard term and condition of award. Investigators and institutions issued CoC are required to protect the privacy of individuals who are the subjects of such research, and are covered by certain prohibitions on the disclosure of information, documents, or biospecimens that contain Covered Information collected or used in research. NIH’s new Policy on CoC’s is reflected in the October 1, 2017 revised NIH Grants Policy Statement. The NIH Policy on CoCs applies to “all biomedical, behavioral, clinical, or other research funded wholly or in part by the NIH, whether supported through grants, cooperative agreements, contracts, other transaction awards, or conducted by the NIH Intramural Research Program, that collects or uses identifiable, sensitive information” that was commenced or ongoing on or after December 13, 2016.

For more information on the new NIH CoC policy, please consult: https://grants.nih.gov/policy/humansubjects/coc/background-information.htm.

CoCs are automatically granted, and the requirements of such must be complied with, whenever a NIH-funded activity falls within the scope of the policy. Investigators and institutions are responsible for determining when a NIH-funded activity falls within the scope of the policy.

To determine if your NIH-funded research may now fall within the scope of the policy please evaluate the following questions:
- Question 1: Is the activity funded in whole or in part by NIH
- Question 2: Is the activity research?
- Question 3:
  1. Does the research involve Human Subjects as defined by 45 CFR Part 46?
  2. Are you collecting or using biospecimens that are identifiable to an individual as part of the research?
  3. If collecting or using biospecimens as part of the research, is there a small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual?
  4. Does the research involve the generation of individual level, human genomic data?
  5. Does the research involve any other information which is both identifiable and sensitive?
    
    Is an individual identified in the information? OR
    
    Is there at least a VERY SMALL RISK that a combination of the information, the request for information, and any other available data source can be used to identify an individual?
If you have answered YES to Question 1, Question 2, and at least one of the subsections to Question 3 you are likely subject to a Certificate of Confidentiality. Please contact the Office for the Protection of Human Research Subjects (IRB) if you have any questions regarding CoC, or your obligations under CoC, including what information to submit to the IRB.

NIH policy expands upon 42 U.S.C. 241(d) by explaining that NIH considers research in which identifiable, sensitive information is collected or used, to include:
1. Human subjects research as defined in 45 CFR 46, including research determined to be exempt (except for exempt research when the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects);
2. Research involving the collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual;
3. Research that involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of the human subjects can readily be ascertained as defined in 45 CFR 46; or
4. Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual, as defined in subsection 301(d) of the Public Health Service Act.
If NIH funding for a study will or has ended but the collection of new data from research participants will continue, the investigator must apply for an additional CoC for continuity of protections. If NIH funding has ended and all enrollment and data collection is complete, the data that was collected is permanently protected under the original CoC.
V. Non- NIH Research

Any person engaged in human subjects research that collects or uses identifiable, sensitive information may apply for CoC. For most research CoCs are obtained from NIH, an investigator may apply for CoC through the NIH Institute or Center funding research in a scientific area similar to the project. If the research is conducting a sensitive research project that is covered by the Agency for Healthcare Research and Quality (AHRQ) confidentiality statute (42 U.S.C. section 299c-3(c)) or the Department of Justice (DoJ) confidentiality statute (42 U.S.C. section 3789g), then CoC may not be needed.
VI. Responsibilities
1. PI responsibilities:
  1. The PI must evaluate non-NIH funded projects to determine if CoC should be requested. If requesting CoC from NIH for non-NIH-funded research, PI must submit the proposed consent form as part of the application.
  2. The PI is responsible for clearly representing in the IRB submission that CoC is in place, or that an application for CoC has been submitted.
  3. For studies that are already underway, the PI must submit a Modification Request xform to the IRB, along with updated consent language (if applicable), when CoC is applied for, or when automatically issued under the NIH policy. The IRB will determine if participants who were previously consented need to be contacted to be informed of the CoC or re-consented.
  4. The PI must ensure that the consent tells participants about the protections afforded by the CoC and any exceptions to that protection.
  5. The PI must ensure that any other language in the consent, such as in the section of confidentiality of records, is consistent with the protections of the CoC.
  6. If the study is subject to HIPAA, the PI must be sure that the HIPAA Authorization is consistent with the terms of the CoC.
  7. The PI is responsible for ensuring that research is conducted in accordance with the terms of the CoC and consent.
  8. The PI is responsible for ensuring that the CoC is valid at all times during the study. If, at any time during the course of the study, the CoC expires or is terminated, the PI must immediately submit a modification to the IRB to remove the CoC wording from the consent form, and if current participants are enrolled, to include a proposed letter informing current enrollees that data collected during the period of the lapse is not protected by the CoC. Once the modification is approved, the PI must inform currently enrolled subjects through the approved letter. In addition, the PI cannot enroll new subjects past the termination/expiration date of the CoC until the modification has been approved.
2. IRB Responsibilities:
  1. When reviewing research under CoC, the IRB reviewer(s) will evaluate whether the research plan is consistent with the obligations to protect information and specimens under CoC.
  2. When reviewing research under CoC, the IRB reviewer(s) must review the consent process to ensure that the consent tells participants about the protections afforded by the CoC and any exceptions to that protection. Sample consent language is in the IRB consent template and in this guidance document.
  3. When reviewing research under CoC, the IRB reviewer(s) must review the consent process to ensure that any other language in the consent, such as in the section of confidentiality of records, is consistent with the protections of the CoC.
  4. When reviewing research under CoC, if the study is subject to HIPAA, the IRB reviewer(s) must ensure that the HIPAA Authorization is consistent with the terms of the CoC.
  5. When non-NIH research is not under CoC, the IRB may require an investigator to apply for CoC if the research includes identifiable, sensitive information and the IRB determines that CoC is necessary to minimize risks and adequately protect subjects’ privacy and the confidentiality of subjects’ information or specimens.
  6. The IRB shall consider the following parameters in making its determination of the need for CoC: nature of the research activities, characterization of the disease/disorder, age/gender/ethnicity of the subject population, social/legal implications of the results of the research, effect of the results of the research on the individual subject, his/her family, and the local community, and the risks to the subject and his/her family regarding the possibility of loss of confidentiality regarding the research and its results.
  7. When the CoC application is pending, the IRB may condition final approval upon its receipt.
VIIII. Sample Consent Language
Language in the consent must describe:
- The protections of the CoC
- The limitations of the CoC
- The exceptions to the CoC
Investigators may revise the language to meet the needs of the research participants and to reflect the subject matter of the study. However, all the basic points noted below must still be included in any revised language.

In addition, the standard language about confidentiality in the consent must be reviewed by both the PI and the IRB to ensure that is consistent with the protections of the Certificate of Confidentiality and the intentions of the researchers and institutions to use these protections as necessary.

Suggested consent language for any study covered by a NIH CoC (modify as needed if CoC is granted by another federal agency):

This research is covered by a Certificate of Confidentiality from the National Institutes of Health. The researchers with this Certificate may not disclose or use information, documents, or biospecimens that may identify you in any federal, state, or local civil, criminal, administrative, legislative, or other action, suit, or proceeding, or be used as evidence, for example, if there is a court subpoena, unless you have consented for this use. Information, documents, or biospecimens protected by this Certificate cannot be disclosed to anyone else who is not connected with the research except, if there is a federal, state, or local law that requires disclosure (such as to report child abuse or communicable diseases but not for federal, state, or local civil, criminal, administrative, legislative, or other proceedings, see below); if you have consented to the disclosure, including for your medical treatment; or if it is used for other scientific research, as allowed by federal regulations protecting research subjects.

Do not use the highlighted reference “see below” unless you are including language from the following paragraph.

Also use the following language as applicable:

The Certificate cannot be used to refuse a request for information from personnel of the United States federal or state government agency sponsoring the project that is needed for auditing or program evaluation by (insert name of the agency) which is funding this project or for information that must be disclosed in order to meet the requirements of the federal Food and Drug Administration (FDA). You should understand that a Certificate of Confidentiality does not prevent you from voluntarily releasing information about yourself or your involvement in this research. If you want your research information released to an insurer, medical care provider, or any other person not connected with the research, you must provide consent to allow the researchers to release it.

Also use the following language if researcher intends to disclose information covered by a Certificate, such as potential child abuse, or intent to hurt self or others in response to specific federal, state, or local laws:

The Certificate of Confidentiality will not be used to prevent disclosure as required by federal, state, or local law of (list what will be reported, such as child abuse and neglect, or harm to self or others).

Also use the following language if researcher intends to disclose information covered by a Certificate, with the consent of research participants:

The Certificate of Confidentiality will not be used to prevent disclosure for any purpose you have consented to in this informed consent document (insert statement(s) that restate what will be disclosed, such as including research data in the medical record).

VA Studies:

Contact the VA R&D office for information about applicability to VA studies.

Sources:
https://grants.nih.gov/grants/guide/notice-files/NOT-OD-17-109.html
https://humansubjects.nih.gov/coc/index
https://www.law.cornell.edu/uscode/text/42/241

IRB Guidance regarding Certificates of Confidentiality (CoC)