The University of Texas at Dallas

Certificates of Confidentiality

Certificates of Confidentiality (CoC) are issued by the National Institutes of Health (NIH) to protect identifiable, sensitive information participant information collected in the course of a research study.

Identifiable, sensitive information is defined as information that is about an individual and that is gathered or used during the course of research where the following may occur:

  • Through which an individual is identified; or
  • For which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identify of an individual.

How does a Certificate of Confidentiality Protect My Data?

The CoC adds an additional layer of protection for maintaining confidentiality of a participant’s private information. Under a CoC, researchers are not allowed to disclose a participant’s name or any item, document or biospecimen that contains identifiable information. Information protected by a CoC is immune from the legal process and is not admissible as evidence. Data collected under a CoC is protected in perpetuity. These permanent CoC protections also extend to all copies of this information.

How can I obtain a Certificate of Confidentiality?

NIH Funded Studies

Effective October 1, 2017, CoCs are automatically issued for all new and non-competing NIH-funded studies that collect identifiable, sensitive information. A physical certificate is no longer issued by NIH, instead the CoC is included in the terms and conditions of the award.

The CoC policy applies to NIH funded:  

  • Grants 
  • Cooperative Agreements
  • R&D Contracts 
  • Other Transaction Awards 
  • NIH’s own intramural research 

Non-NIH Funded Studies

A CoC can be requested for non-NIH funded research, however issuance is at the discretion of the NIH. Studies will be considered if the research involves the following: a) human subjects research, b) collection or use of identifiable, sensitive information, c) a topic within the NIH mission.

NIH Mission

NIH’s mission is to “seek fundamental knowledge about the nature and behavior of living systems and the application of that knowledge to enhance health, lengthen life, and reduce illness and disability.”

Investigator Responsibilities

When a CoC is obtained, additional language that informs participants about the CoC protections as well as any exceptions to those protections.

Sample language:

This research is covered by a Certificate of Confidentiality from the National Institutes of Health. This means that the researchers cannot release or use information, documents, or samples that may identify you in any action or suit unless you say it is okay. They also cannot provide them as evidence unless you have agreed.  This protection includes federal, state, or local civil, criminal, administrative, legislative, or other proceedings. An example would be a court subpoena.

There are some important things that you need to know.  The Certificate DOES NOT stop reporting that federal, state or local laws require. Some examples are laws that require reporting of child or elder abuse, some communicable diseases, and threats to harm yourself or others.  The Certificate CANNOT BE USED to stop a sponsoring United States federal or state government agency from checking records or evaluating programs. The Certificate DOES NOT stop disclosures required by the federal Food and Drug Administration (FDA).  The Certificate also DOES NOT prevent your information from being used for other research if allowed by federal regulations.

Researchers may release information about you when you say it is okay. For example, you may give them permission to release information to insurers, medical providers or any other persons not connected with the research.  The Certificate of Confidentiality does not stop you from willingly releasing information about your involvement in this research. It also does not prevent you from having access to your own information.

Protect Information

Investigators should not disclose information protected by a CoC to any person who is not connected with the research. If a request or court order is received, please contact the HSP Office.  

However, information may be released under limited circumstances such as:

  • If required by law (reporting of child or elder abuse, etc.);
  • If the participants consent to the release of information;
  • For purposes of scientific research that is compliant with human subjects’ regulations

Inform collaborators

Investigators / institutions who receive any CoC protected data are also subject to the protections and disclosure restrictions of the CoC. Therefore, they must be informed about the CoC and their requirements.