Grants Policy


Updated: January 16, 2014

Applicants should read NIH's background information and instructions on Certificates of Confidentiality, which are available at See also Frequently Asked Questions NIH is authorized to issue this privacy protection, in its discretion, for important research within its mission areas. The purpose of this statutory authorization, in part, is to reduce impediments to biomedical/bio-behavioral research subject recruitment.

The Food and Drug Administration handles requests for Certificate of Confidentiality protection for studies that obtain an Investigational New Drug (IND)authorization or other FDA authorization. Projects with INDs or IDEs should apply to the FDA (Kevin Prohaska, D.O., M.P.H., Captain, U.S. Public Health Service Corps, Medical Officer, Division of Scientific Investigations,, 301-796-3707 OR Patricia Holobaugh, Bioresearch Monitoring Branch, HFM-664, Center for Biologics Evaluation and Research,, 301-827-6347).

The application should be written on the letterhead of the research applicant institution and submitted to the appropriate NIH Institute or Center (IC). If your research is funded by NIH, please submit your Certificate application to the Contact from the funding IC. If your research is not funded by NIH, your Certificate application will be reviewed by the IC that supports similar research. Please be aware that NIH Certificates of Confidentiality are issued for important research in its mission areas only. Investigators who are not funded by NIH are urged to contact the appropriate IC before submitting an application. For a list of NIH IC Certificate Contacts, see Some ICs use an online application process which is noted under the IC name on the Contacts List.

The application letter should include the following information.

1. Name and address of applicant research institution. This is the institution with which the applicant is affiliated and the recipient of grant support for the research, if there is any.

2. Sites where the research will be conducted and a brief description of the facilities available for the conduct of the research.
Please indicate if this is a multi-site project. The lead site of a multi-site project can apply for a single Certificate to protect participants enrolled at all sites. The information in the application for a multi-site study should generally pertain to the lead site. While multi-site applications do not need to list each participating unit, the lead site is expected to maintain a current listing of all participating sites and to make this available to NIH if requested. The lead site must also obtain the FWA numbers, copies of IRB approvals, and signed assurances from the participating sites and must ensure that the consent language for each appropriately describes the protections and limitations of the Certificate. The lead site should also work out a plan with the sites for carrying out the assurance and for determining how requests for identifiable data will be handled.

3. Title of the research project. If the project title on the IRB form (see item 5 below) is different from the title given here, the applicant must document that the IRB approval pertains to this project.

4. Source and number of the supporting grant, if applicable (e.g., National Institute of XYZ, NIH, 1 R01 XY 12345-01; ABC Foundation, Grant No. 123). If the NIH funds the project, please provide the name and telephone number of the Project Officer at the funding IC. If there is no support, type "None."

5(a). Requirement - A Certificate of Confidentiality will not be issued to an applicant conducting research involving human subjects unless the project has IRB approval. The approving IRB must be in compliance with applicable Federal requirements. If the applicant institution is receiving DHHS funding for research involving human subjects, an OHRP-approved IRB for that institution must approve the project for which a Certificate of Confidentiality is sought. For additional information on OHRP and IRB assurances, see

If the applicant institution does not receive DHHS funding for this research involving human subjects but has an IRB that complies with the requirements for IRBs imposed by another Federal agency, that IRB must approve the research. If the applicant institution does not have an IRB, the project should be reviewed by an IRB in accordance with 45 CFR Part 46.

5(b). Documentation of IRB approval: Attach letter or form signed by an authorized IRB representative. Approval must be current and unconditional, or conditioned only upon the issuance of a Certificate of Confidentiality and documented by a letter or form signed by an authorized IRB representative. If this is a multi-site project, the lead site must maintain a copy of the IRB approval from each site, which must be made available to the NIH upon request.

5(c). Documentation of IRB qualifications: For all projects, submit for the IRB that reviewed the project the assurance number assigned by OHRP or documentation that the IRB complies with the applicable Federal regulations governing research involving human subjects. If this is a multi-site project, the lead site must maintain the OHRP assurance number for the reviewing IRB at each site, which must be made available to the NIH upon request.

6. Name, title, mailing and email addresses, telephone and fax numbers of the Applicant as well as name and title of other key personnel. Also include a brief summary of the scientific training of the Applicant and key personnel. If this is a multi-site project, only information from the lead site should be submitted to the NIH. However, the lead site must collect and maintain this information for each site and make it available to the NIH upon request.

7. Beginning date and expected end date of the project. The Certificate will state the date upon which it becomes effective and the date upon which it expires. A Certificate of Confidentiality protects all information identifiable to any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. The protection afforded by the Certificate is permanent. If this project is not completed by the expiration date, the Applicant must submit a written request for an extension three months prior to the expiration date. Any such request must include a brief description of the reason for the extension, documentation of the most recent IRB approval, and the expected date for completion of the research project.

8. Concise description of project aims and research methods (1-2 paragraphs, omit background). This section should include a brief description of procedures for the collection and storage of identifying information as well as the number of subjects to be included in the study, the source from which they will be recruited, and a description of the study population (e.g., gender, age, race, etc.) If significant changes are made to the project aims or methods during the course of the study, the Applicant should contact the Certificate Coordinator who issued the Certificate. That person will determine if the Certificate can be modified or if the Applicant will need to submit an amended application.

9. A description of means used to protect subjects' identities (i.e., subjects are coded by numbers not names, linking information is kept in locked files, identifiers will be destroyed when the study is completed, etc.)

10. Reasons for requesting a Certificate of Confidentiality (e.g., will collect sensitive information, identifying information on subjects, etc.) Include brief description of sensitive and identifying information to be collected.

11. Informed consent forms for human subjects, as approved by the IRB (attach copy). The informed consent form must include a description of the protections and limitations of the Certificate of Confidentiality, including the circumstances in which the investigators plan to disclose voluntarily identifying information about research participants (e.g., child abuse, harm to self or others, etc.) Sample language is provided below. If significant changes are made to the informed consent form, the Applicant should contact the Certificate Coordinator who issued the Certificate and submit a copy of the revised consent form. If this is a multi-site project, the lead site must indicate that it has on file a copy of the consent form as approved by the IRB from each site, which will be made available to the NIH upon request.

12. Research not funded by NIH in which drugs will be administered to human subjects must provide the following additional information:

  • Identification of drugs to be administered;
  • Description of methods for administration of these drugs, including a statement of dosages;
  • Evidence that individuals who will receive the drugs are authorized to do so under applicable Federal and State law.

13. All research in which a controlled drug or drugs will be administered must submit a copy of the Drug Enforcement Administration Certificate of Registration (BND Form 223) under which the research project will be conducted.

14. If the research project is testing for reportable communicable diseases, the applicant must submit information relating to its compliance with State reporting laws as specified in the August 9, 1991 memorandum from the Assistant Secretary for Health (


The following assurances are required and the following information should be inserted verbatim into the Certificate application letter. Both the PI and the Institutional Official must sign this letter. The name, title, and address of the Institutional Official should be typed below the signature.

This institution agrees to use the Certificate of Confidentiality to protect against the compelled disclosure of personally identifiable information and to support and defend the authority of the Certificate against legal challenges.

The institution and personnel involved in the conduct of the research will comply with the applicable Federal regulation for the protection of human subjects or, if no such Federal regulation is otherwise applicable, they will comply with 45 CFR Part 46.

This Certificate of Confidentiality will not be represented as an endorsement of the project by the DHHS or NIH or used to coerce individuals to participate in the research project.

All subjects will be informed that a Certificate has been issued, and they will be given a description of the protection provided by the Certificate.

Any research participant entering the project after expiration or termination of the Certificate will be informed that the protection afforded by the Certificate does not apply to them.


Signature of Principal Investigator

Signature of Institutional Official


Name and Title of Institutional Official



Address of Institutional Official

Informed Consent

When a researcher obtains a Certificate of Confidentiality, the research subjects must be told about the protections afforded by the certificate and any exceptions to that protection. That information should be included in the informed consent form. Examples of appropriate language follow. Researchers may adapt the language to the needs of the research participants and to the subject matter of the study. However, the language used must cover the basic points.

Researchers should also review the language about confidentiality and data security that is routinely included in consent forms to be certain that it is consistent with the protections of the Certificate of Confidentiality.


To help us protect your privacy, we have obtained a Certificate of Confidentiality from the National Institutes of Health. The researchers can use this Certificate to legally refuse to disclose information that may identify you in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings, for example, if there is a court subpoena. The researchers will use the Certificate to resist any demands for information that would identify you, except as explained below.

The Certificate cannot be used to resist a demand for information from personnel of the United States Government that is used for auditing or evaluation of Federally funded projects or for information that must be disclosed in order to meet the requirements of the federal Food and Drug Administration (FDA). 

You should understand that a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the researchers may not use the Certificate to withhold that information.

[The researchers should include language such as the following if they intend to make voluntary disclosure about things such as child abuse, intent to hurt self or others, or other voluntary disclosures.] The Certificate of Confidentiality will not be used to prevent disclosure to state or local authorities of [list what will be reported, such as child abuse and neglect, or harm to self or others].

This page last updated on December 21, 2012 
Content Manager: 
Technical Issues: E-mail OER Webmaster