This list of Frequently Asked Questions will be updated as we receive additional questions and finalize the NIH statement on sharing research data. We encourage readers to check in regularly for updates.

1. What is a Certificate of Confidentiality?
   
   A Certificate of Confidentiality helps researchers protect the privacy of human research participants enrolled in biomedical, behavioral, clinical and other forms of sensitive research. Certificates protect against compulsory legal demands, such as court orders and subpoenas, for identifying information or identifying characteristics of a research participant.
   
   

2. Who may apply for a Certificate of Confidentiality?
   
   Any person engaged in research in which sensitive information is gathered from human research participants (or any person who intends to engage in such research) may apply for a Certificate of Confidentiality.
   
   

3. What kind of research is eligible for a Certificate?
   
   Any research project that collects personally identifiable, sensitive information and that has been approved by an IRB is eligible for a Certificate. Federal funding is not a prerequisite for a Certificate.
   
   

4. I am planning two different studies that will involve human subjects from two different populations. Both studies will collect sensitive information. Can I apply for one Certificate to cover both projects?
   
   A separate application is required for each research project for which a Certificate is desired. A certificate is generally issued to a research institution for a single project (not broad groups or classes of projects). However, projects that use the same sample of subjects but have different protocols may file for one Certificate since the subjects, whose identities the investigator wishes to protect, are the same.
   
   

5. I am planning a multi-site trial for a behavioral intervention for HIV. Does each site need a separate Certificate of Confidentiality?
   
   For multi-site projects, a coordinating center or lead institution can apply for and receive a Certificate on behalf of all member institutions. In the application for a Certificate, multi-site applicants must list each participating unit, its address, and project director. In addition, the lead site must indicate that it has on file a copy of the IRB approval and IRB-approved consent form from each site, which will be made available to the NIH upon request. The informed consent form for each site should contain appropriate language about the protections and limitations of the Certificate of Confidentiality.
   
   

6. What is meant by sensitive information?
   
   Sensitive information includes (but is not limited to) information relating to sexual attitudes, preferences, or practices; information relating to the use of alcohol, drugs, or other addictive products; information pertaining to illegal conduct; information that, if released, might be damaging to an individual's financial standing, employability, or reputation within the community or might lead to social stigmatization or discrimination; information pertaining to an individual's psychological well-being or mental health; and genetic information or tissue samples.
   
   

7. Can you give some examples of research projects that are eligible for a Certificate?
   
   Certainly. The following is an illustrative but not exhaustive list of research areas eligible for a Certificate:
   • Research on HIV, AIDS, and other STDs;
   • Studies that collect information on sexual attitudes, preferences, or practices;
   • Studies on the use of alcohol, drugs, or other addictive products;
   • Studies that collect information on illegal conduct;
   • Studies that gather information that if released could be damaging to a participant's financial standing, employability, or reputation within the community;
   • Research involving information that might lead to social stigmatization or discrimination if it were disclosed;
   • Research on participants' psychological well being or mental health;
   • Genetic studies, including those that collect and store biological samples for future use;
   • Research on behavioral interventions and epidemiologic studies.
   
   

8. What studies would NOT be eligible?
   
   Ineligible studies include projects that are
   • not research based,
   • not approved by an IRB in accordance with these guidelines,
   • not collecting sensitive information or information that might harm the research participants, or
   • not collecting personally identifiable information.
   
   

9. Is NIH required to give all who apply a Certificate of Confidentiality?
   
   No. No project is entitled to a Certificate; its issuance is discretionary.
   
   

10. What is the effect of a Certificate? What protection does it afford?
    
    Researchers can use a Certificate to avoid compelled "involuntary disclosure" (e.g., subpoenas) of names and other identifying information about any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. It does not protect against voluntary disclosures by the researcher, but those disclosures must be specified in the informed consent form. A researcher may not rely on the Certificate to withhold data if the participant consents in writing to the disclosure.
    
    

11. How long does a Certificate's protection last?
    
    Individuals who participate as research subjects (i.e., about whom the investigator maintains identifying information) in the specified research project during any time the Certificate is in effect are protected permanently.
    
    

12. In what situations may personally identifiable information protected by a Certificate be disclosed?
    
    Personally identifiable information protected by a Certificate may be disclosed under the following circumstances:
    • Voluntary disclosure of information by study participants themselves or any disclosure that the study participant has consented to in writing, such as to insurers, employers, or other third parties;
    • Voluntary disclosure by the researcher of information on such things as child abuse, reportable communicable diseases, possible threat to self or others, or other voluntary disclosures provided that such disclosures are spelled out in the informed consent form;
    • Voluntary compliance by the researcher with reporting requirements of state laws, such as knowledge of communicable disease, provided such intention to report is specified in the informed consent form (see Attachment D, which sets forth PHS policy on reporting of communicable diseases); or
    • Release of information by researchers to DHHS as required for program evaluation or audits of research records or to the FDA as required under the federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.)
    
    

13. What does identifying characteristic mean?
    
    Identifying characteristics include things such as: name, address, social security or other identifying number, fingerprints, voiceprints, photographs, genetic information or tissue samples, or any other item or combination of data about a research participant which could reasonably lead, directly or indirectly by reference to other information, to identification of that research subject.
    
    

14. To whom should I apply for a Certificate of Confidentiality?
    
    If NIH funds the research project for which you would like a Certificate, you may apply through the funding Institute. However, even if your research is not supported with NIH funding, you may apply for a Certificate through the NIH Institute or Center (IC) funding research in a scientific area similar to your project. Contact information is available on the NIH website at the Certificates of Confidentiality Kiosk.
    
    

15. What if I am not sure to which NIH Institute I should apply?
    
    If you are uncertain which Institute or Center you should contact for a Certificate of Confidentiality, you can contact one of the Central Certificate resources listed on the NIH website at the Certificates of Confidentiality Kiosk.
    
    

16. May I apply for a Certificate if the Federal government does not fund my research project?
    
    Yes. A Certificate of Confidentiality can be awarded whether or not a research project is federally funded.
    
    

17. When should I apply for a Certificate?
    
    Generally, an application for a Certificate of Confidentiality is submitted after the Institutional Review Board (IRB) responsible for its review approves the research project (because IRB approval or approval conditioned upon issuance of a Certificate of Confidentiality is a prerequisite for issuance of a Certificate). Since the informed consent form should include language describing the Certificate and any voluntary disclosures specified by the investigator, the Applicant could tell the IRB that they are applying for a Certificate of Confidentiality and have included appropriate language in the informed consent form. Applications for Certificates should be submitted at least three months prior to the date on which enrollment of research subjects is expected to begin.
    
    

18. What if there is a significant change in my research project after a Certificate is issued?
    
    If a significant change in your research project is proposed after a Certificate is issued, you must inform the Certificate Coordinator of the Institute issuing the certificate by submitting an amended application for a Certificate of Confidentiality (in the same form and manner as your original application for a Certificate).
    
    

19. What do you mean by significant changes?
    
    Significant changes include: major changes in the scope or direction of the research protocol, changes in personnel having major responsibilities in the project, or changes in the drugs to be administered (if any) and the persons who will administer them.
    
    

20. What happens once I submit an amended application?
    
    Amended applications will be reviewed by the NIH Institute issuing the certificate and either approved or disapproved. If an amended application is approved, an amended Certificate of Confidentiality will be issued. If an amended application is disapproved, you will be notified that adoption of the proposed significant change(s) will result in prospective termination of the original Certificate. Any termination of a Certificate of Confidentiality is operative only with respect to the identifying characteristics of individuals who began their participation as research subjects after the effective date of such termination.
    
    

21. What if my research project extends beyond the expiration date on the Certificate?
    
    If you determine that the research project for which you have received a Certificate of Confidentiality will extend beyond the expiration date on the Certificate, you may submit a written request for extension of the date. This request should be submitted to the NIH Institute issuing the certificate at least three months prior to the Certificate's expiration. It must include an explanation of the reasons for requesting an extension (e.g., new subjects continue to be enrolled in the project), a revised estimate of the date for completion of the project, documentation of the Institutional Review Board's most recent approval for the project, and a copy of the consent form which should include language explaining the Certificate's protections, specify any voluntary disclosures, and clearly state any other limitations. If your request is approved, an amended Certificate will be issued.
    
    

22. What is the researcher's responsibility to participants regarding a Certificate of Confidentiality?
    
    When a researcher obtains a Certificate of Confidentiality, the subjects must be told about protections afforded by the Certificate and any exceptions to those protections - i.e., the circumstances in which the investigators plan to disclose, voluntarily, identifying information about research participants (e.g., child abuse, harm to self or others, etc.). This information should be included in the informed consent form unless a research subject is no longer actively participating in the project so amendment of the informed consent would be impractical The researchers should eliminate provisions in consent form templates that may be inconsistent with the Certificate protections (such as references to disclosures required by law, since the Certificate enables researchers to resist disclosures that would otherwise be compelled by law). In addition, researchers may not represent the Certificate as an endorsement of the research project by the DHHS or use it in a coercive manner when recruiting subjects
    
    

23. Has the legality of Certificates been challenged?
    
    There have been very few reported court cases. In 1973, the certificate's authority was upheld in the New York Court of Appeals. The U.S. Supreme Court declined to hear the case.
    
    

24. What should an investigator do if legal action is brought to release personally identifying information protected by a certificate?
    
    The researcher should immediately inform the Certificate Coordinator who issued the Certificate and seek legal counsel from his or her institution. The Office of the NIH Legal Advisor is willing to discuss the regulations with the researcher's attorney.
    
    

25. I am collecting data from subjects recruited in a foreign country. Can I get a Certificate of Confidentiality?
    
    Yes, if the data are maintained within the U.S. If the data are maintained only in the foreign country, a Certificate of Confidentiality would not be effective.
    
    

26. I am an intramural scientist working on a clinical HIV study at the NIH. If the Federal Privacy Act applies to my research, do I still need a Certificate of Confidentiality?
    
    Yes, because the Federal Privacy Act does not protect identifying information if disclosure is ordered by a court of competent jurisdiction. Moreover, there are other exceptions to the protection afforded by the Privacy Act.
    
    

27. I'm conducting a longitudinal study. I just got a Certificate of Confidentiality. Part of my cohort was recruited prior to issuance of the Certificate, but they are no longer actively participating in the study. What do I do?
    
    In the informed consent form, you should tell subjects who are still actively involved in your study that the Certificate is in effect. If subjects are no longer actively participating in the project, an amendment to the informed consent form would be impractical.
    
    

28. I'm conducting a sensitive research project that is covered by the AHRQ confidentiality statute. Should I also apply to the NIH for a Certificate of Confidentiality?
    
    No. You should not apply for an NIH Certificate if your study is covered by AHRQ statute.
    
    

29. You indicate that both the PI and the Institutional Official must sign the application for a Certificate. What do you mean by "Institutional Official"?
    
    The authorized institutional official is the individual named by the applicant organization who is authorized to act for that organization and assumes on behalf of the institution the obligations imposed by assurances as well as obligations imposed by the Federal laws, regulations, requirements and other conditions that apply to grant applications and awards.
    
    

30. Does the Privacy Rule preclude the need for Certificates of Confidentiality?
    
    No. Certificates of Confidentiality offer an important protection for the privacy of research study participants by protecting identifiable health information from forced disclosure (e.g., by court order). While the Privacy Rule does establish protections for covered entities' use and disclosure of PHI, it permits use or disclosure in response to certain judicial or administrative orders. Therefore, researchers/contractors may obtain Certificates of Confidentiality to protect them from being forced to disclose information that would have to be disclosed under the Privacy Rule.