Frequently Asked Questions on Certificates of Confidentiality
This list of Frequently Asked Questions will be updated as we receive additional questions and finalize the NIH statement on sharing research data. We encourage readers to check in regularly for updates.
March 15, 2002:
- What is a Certificate of Confidentiality?
A Certificate of
Confidentiality helps researchers protect the privacy of human research
participants enrolled in biomedical, behavioral, clinical and other forms of
sensitive research. Certificates protect against compulsory legal demands,
such as court orders and subpoenas, for identifying information or identifying
characteristics of a research participant.
- Who may apply for a Certificate of Confidentiality?
person engaged in research in which sensitive information is gathered from
human research participants (or any person who intends to engage in such
research) may apply for a Certificate of Confidentiality.
- What kind of research is eligible for a Certificate?
research project that collects personally identifiable, sensitive information
and that has been approved by an IRB is eligible for a Certificate. Federal
funding is not a prerequisite for a Certificate.
- I am planning two different studies that will involve human subjects
from two different populations. Both studies will collect sensitive
information. Can I apply for one Certificate to cover both projects?
A separate application is required for each research project for which
a Certificate is desired. A certificate is generally issued to a research
institution for a single project (not broad groups or classes of projects).
However, projects that use the same sample of subjects but have different
protocols may file for one Certificate since the subjects, whose identities
the investigator wishes to protect, are the same.
- I am planning a multi-site trial for a behavioral intervention for HIV.
Does each site need a separate Certificate of Confidentiality?
multi-site projects, a coordinating center or lead institution can apply for
and receive a Certificate on behalf of all member institutions. In the
application for a Certificate, multi-site applicants must list each
participating unit, its address, and project director. In addition, the lead
site must indicate that it has on file a copy of the IRB approval and
IRB-approved consent form from each site, which will be made available to the
NIH upon request. The informed consent form for each site should contain
appropriate language about the protections and limitations of the Certificate
- What is meant by sensitive information?
information includes (but is not limited to) information relating to sexual
attitudes, preferences, or practices; information relating to the use of
alcohol, drugs, or other addictive products; information pertaining to illegal
conduct; information that, if released, might be damaging to an individual's
financial standing, employability, or reputation within the community or might
lead to social stigmatization or discrimination; information pertaining to an
individual's psychological well-being or mental health; and genetic
information or tissue samples.
- Can you give some examples of research projects that are eligible for a
Certainly. The following is an illustrative but not
exhaustive list of research areas eligible for a Certificate:
- Research on HIV, AIDS, and other STDs;
- Studies that collect information on sexual attitudes, preferences, or
- Studies on the use of alcohol, drugs, or other addictive products;
- Studies that collect information on illegal conduct;
- Studies that gather information that if released could be damaging to a
participant's financial standing, employability, or reputation within the
- Research involving information that might lead to social stigmatization
or discrimination if it were disclosed;
- Research on participants' psychological well being or mental health;
- Genetic studies, including those that collect and store biological
samples for future use;
- Research on behavioral interventions and epidemiologic studies.
- What studies would NOT be eligible?
include projects that are
- not research based,
- not approved by an IRB in accordance with these guidelines,
- not collecting sensitive information or information that might harm the
research participants, or
- not collecting personally identifiable information.
- Is NIH required to give all who apply a Certificate of
No. No project is entitled to a Certificate; its
issuance is discretionary.
- What is the effect of a Certificate? What protection does it
Researchers can use a Certificate to avoid compelled
"involuntary disclosure" (e.g., subpoenas) of names and other identifying
information about any individual who participates as a research subject (i.e.,
about whom the investigator maintains identifying information) during any time
the Certificate is in effect. It does not protect against voluntary
disclosures by the researcher, but those disclosures must be specified in the
informed consent form. A researcher may not rely on the Certificate to
withhold data if the participant consents in writing to the disclosure.
- How long does a Certificate's protection last?
who participate as research subjects (i.e., about whom the investigator
maintains identifying information) in the specified research project during
any time the Certificate is in effect are protected permanently.
- In what situations may personally identifiable information protected by
a Certificate be disclosed?
Personally identifiable information
protected by a Certificate may be disclosed under the following circumstances:
- Voluntary disclosure of information by study participants themselves or
any disclosure that the study participant has consented to in writing, such
as to insurers, employers, or other third parties;
- Voluntary disclosure by the researcher of information on such things as
child abuse, reportable communicable diseases, possible threat to self or
others, or other voluntary disclosures provided that such disclosures are
spelled out in the informed consent form;
- Voluntary compliance by the researcher with reporting requirements of
state laws, such as knowledge of communicable disease, provided such
intention to report is specified in the informed consent form (see
Attachment D, which sets forth PHS policy on reporting of communicable
- Release of information by researchers to DHHS as required for program
evaluation or audits of research records or to the FDA as required under the
federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.)
- What does identifying characteristic mean?
characteristics include things such as: name, address, social security or
other identifying number, fingerprints, voiceprints, photographs, genetic
information or tissue samples, or any other item or combination of data about
a research participant which could reasonably lead, directly or indirectly by
reference to other information, to identification of that research subject.
- To whom should I apply for a Certificate of Confidentiality?
If NIH funds the research project for which you would like a
Certificate, you may apply through the funding Institute. However, even if
your research is not supported with NIH funding, you may apply for a
Certificate through the NIH Institute or Center (IC) funding research in a
scientific area similar to your project. Contact information is available on
the NIH website at the Certificates of
- What if I am not sure to which NIH Institute I should apply?
If you are uncertain which Institute or Center you should contact for
a Certificate of Confidentiality, you can contact one of the Central
Certificate resources listed on the NIH website at the Certificates of
- May I apply for a Certificate if the Federal government does not fund
my research project?
Yes. A Certificate of Confidentiality can be
awarded whether or not a research project is federally funded.
- When should I apply for a Certificate?
application for a Certificate of Confidentiality is submitted after the
Institutional Review Board (IRB) responsible for its review approves the
research project (because IRB approval or approval conditioned upon issuance
of a Certificate of Confidentiality is a prerequisite for issuance of a
Certificate). Since the informed consent form should include language
describing the Certificate and any voluntary disclosures specified by the
investigator, the Applicant could tell the IRB that they are applying for a
Certificate of Confidentiality and have included appropriate language in the
informed consent form. Applications for Certificates should be submitted at
least three months prior to the date on which enrollment of research subjects
is expected to begin.
- What if there is a significant change in my research project after a
Certificate is issued?
If a significant change in your research
project is proposed after a Certificate is issued, you must inform the
Certificate Coordinator of the Institute issuing the certificate by submitting
an amended application for a Certificate of Confidentiality (in the same form
and manner as your original application for a Certificate).
- What do you mean by significant changes?
changes include: major changes in the scope or direction of the research
protocol, changes in personnel having major responsibilities in the project,
or changes in the drugs to be administered (if any) and the persons who will
- What happens once I submit an amended application?
applications will be reviewed by the NIH Institute issuing the certificate and
either approved or disapproved. If an amended application is approved, an
amended Certificate of Confidentiality will be issued. If an amended
application is disapproved, you will be notified that adoption of the proposed
significant change(s) will result in prospective termination of the original
Certificate. Any termination of a Certificate of Confidentiality is operative
only with respect to the identifying characteristics of individuals who began
their participation as research subjects after the effective date of such
- What if my research project extends beyond the expiration date on the
If you determine that the research project for which
you have received a Certificate of Confidentiality will extend beyond the
expiration date on the Certificate, you may submit a written request for
extension of the date. This request should be submitted to the NIH Institute
issuing the certificate at least three months prior to the Certificate's
expiration. It must include an explanation of the reasons for requesting an
extension (e.g., new subjects continue to be enrolled in the project), a
revised estimate of the date for completion of the project, documentation of
the Institutional Review Board's most recent approval for the project, and a
copy of the consent form which should include language explaining the
Certificate's protections, specify any voluntary disclosures, and clearly
state any other limitations. If your request is approved, an amended
Certificate will be issued.
- What is the researcher's responsibility to participants regarding a
Certificate of Confidentiality?
When a researcher obtains a Certificate of Confidentiality, the subjects must be told about protections afforded by the Certificate and any exceptions to those protections - i.e., the circumstances in which the investigators plan to disclose, voluntarily, identifying information about research participants (e.g., child abuse, harm to self or others, etc.). This information should be included in the informed consent form unless a research subject is no longer actively participating in the project so amendment of the informed consent would be impractical The researchers should eliminate provisions in consent form templates that may be inconsistent with the Certificate protections (such as references to disclosures required by law, since the Certificate enables researchers to resist disclosures that would otherwise be compelled by law). In addition, researchers may not represent the Certificate as an endorsement of the research project by the DHHS or use it in a coercive manner when recruiting subjects
- Has the legality of Certificates been challenged?
have been very few reported court cases. In 1973, the certificate's authority
was upheld in the New York Court of Appeals. The U.S. Supreme Court declined
to hear the case.
- What should an investigator do if legal action is brought to release
personally identifying information protected by a certificate?
researcher should immediately inform the Certificate Coordinator who issued
the Certificate and seek legal counsel from his or her institution. The Office
of the NIH Legal Advisor is willing to discuss the regulations with the
- I am collecting data from subjects recruited in a foreign country. Can
I get a Certificate of Confidentiality?
Yes, if the data are
maintained within the U.S. If the data are maintained only in the foreign
country, a Certificate of Confidentiality would not be effective.
- I am an intramural scientist working on a clinical HIV study at the
NIH. If the Federal Privacy Act applies to my research, do I still need a
Certificate of Confidentiality?
Yes, because the Federal Privacy
Act does not protect identifying information if disclosure is ordered by a
court of competent jurisdiction. Moreover, there are other exceptions to the
protection afforded by the Privacy Act.
- I'm conducting a longitudinal study. I just got a Certificate of
Confidentiality. Part of my cohort was recruited prior to issuance of the
Certificate, but they are no longer actively participating in the study. What
do I do?
In the informed consent form, you should tell subjects
who are still actively involved in your study that the Certificate is in
effect. If subjects are no longer actively participating in the project, an
amendment to the informed consent form would be impractical.
April 10, 2002:
- I'm conducting a sensitive research project that is covered by the AHRQ
confidentiality statute. Should I also apply to the NIH for a Certificate of
No. You should not apply for an NIH Certificate
if your study is covered by AHRQ statute.
- You indicate that both the PI and the Institutional Official must sign
the application for a Certificate. What do you mean by "Institutional
The authorized institutional official is the individual
named by the applicant organization who is authorized to act for that
organization and assumes on behalf of the institution the obligations imposed
by assurances as well as obligations imposed by the Federal laws, regulations,
requirements and other conditions that apply to grant applications and awards.
July 21, 2003:
- Does the Privacy Rule preclude the need for Certificates of Confidentiality?
No. Certificates of Confidentiality offer an important protection for the privacy of research study participants by protecting identifiable health information from forced disclosure (e.g., by court order). While the Privacy Rule does establish protections for covered entities' use and disclosure of PHI, it permits use or disclosure in response to certain judicial or administrative orders. Therefore, researchers/contractors may obtain Certificates of Confidentiality to protect them from being forced to disclose information that would have to be disclosed under the Privacy Rule.
The Law, Science & Public
Health Law Site
The Best on the WWW Since 1995!
Copyright as to non-public domain materials
See DR-KATE.COM for home hurricane and disaster preparation
See WWW.EPR-ART.COM for photography of southern Louisiana and Hurricane Katrina
Professor Edward P. Richards, III, JD, MPH - Webmaster