NIH sponsored research that involves collecting or using identifiable, sensitive information is automatically issued a Certificate of Confidentiality (CoC). This policy applies to research activities involving biomedical, behavioral, clinical, or other research and an affirmative response to any of the following questions:
- Does the research involve Human Subjects?
- Are you collecting or using biospecimens that are identifiable to an individual as part of the research?
- If collecting or using biospecimens as part of the research, is there a small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual?
- Does the research involve the generation of individual level, human genomic data?
Investigators can visit the NIH CoC for more information
The NIH provides suggested language for research issued a CoC which can be included in the Privacy & Confidentiality of the consent form:
This research is covered by a Certificate of Confidentiality from the National Institutes of Health. The researchers with this Certificate may not disclose or use information, documents, or biospecimens that may identify you in any federal, state, or local civil, criminal, administrative, legislative, or other action, suit, or proceeding, or be used as evidence, for example, if there is a court subpoena, unless you have consented for this use. Information, documents, or biospecimens protected by this Certificate cannot be disclosed to anyone else who is not connected with the research except, if there is a federal, state, or local law that requires disclosure (such as to report child abuse or communicable diseases but not for federal, state, or local civil, criminal, administrative, legislative, or other proceedings, see below); if you have consented to the disclosure, including for your medical treatment; or if it is used for other scientific research, as allowed by federal regulations protecting research subjects.
[Use the following language as applicable] The Certificate cannot be used to refuse a request for information from personnel of the United States federal or state government agency sponsoring the project that is needed for auditing or program evaluation by [THE AGENCY] which is funding this project or for information that must be disclosed in order to meet the requirements of the federal Food and Drug Administration (FDA). You should understand that a Certificate of Confidentiality does not prevent you from voluntarily releasing information about yourself or your involvement in this research. If you want your research information released to an insurer, medical care provider, or any other person not connected with the research, you must provide consent to allow the researchers to release it.
[Language such as the following should be included if researcher intends to disclose information covered by a Certificate, such as potential child abuse, or intent to hurt self or others in response to specific federal, state, or local laws.] The Certificate of Confidentiality will not be used to prevent disclosure as required by federal, state, or local law of [list what will be reported, such as child abuse and neglect, or harm to self or others].
[Language such as the following should be included if researcher intends to disclose information covered by a Certificate, with the consent of research participants.] The Certificate of Confidentiality will not be used to prevent disclosure for any purpose you have consented to in this informed consent document [restate what will be disclosed, such as including research data in the medical record].
For research not sponsored by the NIH or Health and Human Services, investigators can request a CoC from the NIH.