A Certificate of Confidentiality (CoC) protects the confidentiality of research participants enrolled in biomedical, social, behavioral, clinical or other types of research that collect or use identifiable, sensitive information. With limited exceptions, investigators may not disclose names or any information, documents or biospecimens containing identifiable, sensitive information.

The CoC allows investigators to refuse to disclose identifying information on research participants in civil, criminal, administrative, legislative or other proceedings, whether federal, state or local. The CoC prohibits disclosure in response to legal demands, such as a subpoena.

A CoC is study-specific, nontransferrable and lasts in perpetuity. However, if an investigator has funding and the study continues after funding ends, new information collected may not be protected.

Covered Information

In a CoC, covered information includes names, documents, biospecimens or any other identifiable, sensitive information related to the protected research participant. In addition, if there is at least a very small risk that information, documents or biospecimens can be combined with other available data sources to determine the identity of an individual, then those sources are also protected by the CoC.

Information is considered identifiable and sensitive when it is gathered or used during research through which there is at least a small risk that some combination of the information, a request for the information and other available data sources could be used to determine the identity of an individual. Examples of identifiable, sensitive information include name, address, Social Security number or other identifying numbers, fingerprints, voiceprints, photographs, genetic information, tissue samples or data fields that when used in combination with other information may lead to the identification of an individual.

When to Use a CoC

The investigator, the funder or Brown’s Human Research Protection Program (HRPP) or Institutional Review Board (IRB) may determine that a CoC is necessary depending on the identifiable, sensitive information collected or used in the study and the potential impact it may have on participants should it be disclosed or confidentiality lost (e.g., potential damage to their financial standing, employability, insurability or reputation).

CoC Limitations

Investigators are not prevented from disclosing certain information about research participants, such as child abuse or a participant’s threatened violence to self or others. However, if investigators intend to make such disclosures, they must clearly inform participants through the consent process.

A CoC does not protect participants when they voluntarily disclose identifying information about themselves. A participant must consent to a disclosure for it to be used as evidence in the legal process.

All human subjects research studies receiving funding from the National Institutes of Health (NIH) or U.S. Centers for Disease Control and Prevention (CDC) — prime awardee or subrecipient — that collect or use identifiable, sensitive information are automatically issued a CoC by the NIH or CDC, respectively, as a term and condition of the award (i.e., 42 USC 241). 

Investigators will not need to request a CoC if they receive an NIH-sponsored or CDC-sponsored award or subaward for their study. Investigators will not receive a physical certificate.

The HRPP and IRB will assist investigators in making the appropriate determination as to whether the research they are conducting involves the collection or use of identifiable, sensitive information and is subject to the NIH CoC policy and deemed to be issued a certificate.

CoCs for NIH-Funded Research

The following sponsors require that investigators contact them directly to apply for a CoC. The NIH will not issue a CoC for research studies funded by these agencies. Investigators must have IRB approval or an exempt determination before requesting a CoC from these agencies.

• Agency for Healthcare Research and Quality (AHRQ)
• U.S. Department of Justice (DOJ)
• U.S. Food and Drug Administration (FDA) — For all studies operating under an Investigational New Drug (IND) or Investigational Device Exemption (IDE)
• Health Resources and Services Administration (HRSA)
• Indian Health Service (IHS)
• Substance Abuse and Mental Health Services Administration (SAMHSA)

If an agency requires application materials signed by Brown’s Institutional Official (IO) or the Brown IRB chair, please email the application materials to irb@brown.edu for signature routing. Signed assurances are typically returned within five business days.

If the research is funded by any other sponsor or is unfunded, investigators can request a CoC from the NIH by completing an online application. The study must have IRB approval or an exempt determination before submitting the application request.

The investigator must complete the CoC request in one session. There is no save option to return and complete the application at a later time. When you submit the application for verification, it will automatically route to the HRPP team for review by the IO and final submission.

When the CoC is approved, the principal investigator (PI) listed on the application and Brown’s IO will receive an email confirmation from the NIH CoC coordinator with a PDF copy of the CoC. Typically, the NIH processes CoC requests within one week after receiving the request.

NIH Certificate of Confidentiality Request

Information for Certificate of Confidentiality (CoC) Requests

Investigators must include CoC protection language in any consent process — written, online or verbal. Each agency may have its own sample language. Investigators should use the language provided by the agency that issued the CoC.

• Consent Forms for Research Participants
• NIH Example Informed Consent Language

If obtaining informed consent, investigators must inform participants about the protections afforded to them by the CoC and any exceptions to those protections.

Inform Collaborating Investigators

Incoming Data

If receiving identifiable, sensitive information or identifiable biospecimens from a collaborating investigator that is not covered by a CoC, Brown investigators must inform them that the information/biospecimens held by the collaborating investigator is protected by the new CoC issued to Brown and the collaborating investigator is equally subject to the CoC requirements.

Outgoing Data

If sharing identifiable, sensitive information or identifiable biospecimens with a collaborating investigator already covered by a CoC, Brown investigators must inform the collaborating investigator that the information/biospecimens from Brown now being maintained by the collaborating investigator must be protected by the collaborator’s CoC and Brown’s shared data is equally subject to the CoC requirements.

Maintain Data Confidentiality

Investigators must not disclose or share a participant’s identifiable, sensitive information, except under limited circumstances. This includes:

• no disclosure to any federal, state or local civil, criminal, administrative, legislative or other proceedings; and
• no sharing of research data to any person not engaged in the research study and/or not approved by Brown’s IRB to obtain, use, study or analyze.

Limited circumstances may apply if the investigator is required by other federal, state or local laws, such as for public health reporting of communicable diseases, or child or elder abuse reporting; voluntarily consented by the participant; or disclosure is necessary for the medical care and voluntary consent of the participant.

In the event that an investigator may have to break the study’s CoC due to limited circumstances, HRPP staff must be notified immediately so the appropriate steps can be taken by the University.

If an investigator is issued a CoC, Brown has several responsibilities and expectations:

Uphold CoC Protections 

Brown will protect participants’ identifiable, sensitive information from compelled disclosure, and support and defend the authority of the CoC against legal challenges.

Inform Collaborating Institutions

Incoming Data

If Brown receives identifiable, sensitive information or identifiable biospecimens from a collaborating institution that is not covered by a CoC, Brown must inform the collaborating institution. The information/biospecimens held by the collaborating institution is protected by the new CoC and the collaborating institution is equally subject to the CoC requirements.

Outgoing Data

If Brown shares identifiable, sensitive information or identifiable biospecimens with a collaborating institution that is already covered by a CoC, Brown must inform the collaborating institution. The information/biospecimens now being maintained by the collaborating institution must be protected by the CoC and Brown’s shared data is equally subject to the CoC requirements.