Policy & Compliance

Timely Information, Questions and Answers, and Resources

Updated: January 16, 2014

Applicants should read NIH's background information and instructions on Certificates of Confidentiality, which are available at https://grants.nih.gov/grants/policy/coc/background.htm. See also Frequently Asked Questions https://grants.nih.gov/grants/policy/coc/faqs.htm.

Applicants should submit a letter to the Certificate Coordinator for their NIH Institute or Center (NIH IC) or the Warren Grant Magnuson Clinical Center on the letterhead of the Applicant's IC. The application letter should contain the following information.

1. Name, title, email address, telephone and fax numbers, and NIH affiliation (Institute/Division and Laboratory or Branch) of the Applicant as well as name and title of other key personnel. Also include a brief summary of the scientific training of the Applicant and key personnel. If this is a multi-site project, only information for the NIH Applicant and key staff should be submitted. However, the Applicant must collect and maintain this information for key personnel at other sites should the NIH wish to review it.

2.Sites where the research will be conducted and a brief description of facilities available for the conduct of the research.
Please indicate if this is a multi-site project. If all or part of the study will be conducted outside the NIH Clinical Center, then the Applicant, as the lead site can apply for a single Certificate to protect research participants enrolled at all sites. The information in the application for a multi-site study should generally pertain to the lead site. While multi-site applications do not need to list each participating unit, the intramural lead site is expected to maintain a current listing of all participating sites and to make this available to NIH if requested. The lead site must also obtain the FWA numbers, copies of IRB approvals, and signed assurances from the participating sites and must ensure that the consent language for each appropriately describes the protections and limitations of the Certificate.

3. Title of the project. If the project title on the IRB form (see item 5 below) is different from the title of the project, the applicant must document that the IRB approval pertains to this project.

4(a). Requirement - A Certificate of Confidentiality will not be issued to an applicant conducting intramural research involving human subjects unless the project has IRB approval and that IRB is in compliance with the requirements of the DHHS Office of Human Research Protections (OHRP).

4(b). Documentation of IRB approval: Attach letter or form signed by an authorized IRB representative. Approval must be current and unconditional, or conditioned only upon the issuance of a Certificate of Confidentiality and documented by a letter or form signed by an authorized IRB representative. If this is a multi-site project, the lead site must maintain a copy of the IRB approval from each site, which must be made available to the NIH upon request.

4(c). Documentation of IRB qualifications: Submit for the NIH IRB that reviewed the project the assurance number assigned by OHRP. If this is a multi-site project that includes sites receiving DHHS grant or contract support, then the intramural lead site must maintain the OHRP assurance number for the reviewing IRB at each site, which must be made available to the NIH upon request.

5. Beginning date and expected end date of the project. The Certificate will state the date upon which it becomes effective and the date upon which it expires. A Certificate of Confidentiality protects all information identifiable to any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. The protection afforded by the Certificate is permanent. If this project is not completed by the expiration date, the Applicant must submit a written request for an extension three months prior to the expiration date. Any such request must include a brief description of the reason for the extension, documentation of the most recent IRB approval, and the expected date for completion of the research project.

6. Concise description of project aims and research methods (1-2 paragraphs, omit background). This section should include a brief description of procedures for the collection and storage of identifying information as well as the number of subjects to be included in the study, the source from which they will be recruited, and a description of the study population (e.g., gender, age, race, etc.) If changes are made to the project aims or methods during the course of the study, the Applicant should contact the Certificate Coordinator who issued the Certificate. That person will determine if the Certificate can be modified or if the Applicant will need to submit an amended application.

7. A description of means used to protect subjects' identities (i.e., participants are coded by numbers not names, linking information is kept in locked files, identifiers will be destroyed when the study completed, etc.)

8. Reasons for requesting a Certificate of Confidentiality (e.g., will collect sensitive information, identifying information on research participants, etc.)

9. Informed consent forms for subjects who will be participating in the study, as approved by the IRB (attach copy). The informed consent form must include a description of the protections and limitations of the Certificate of Confidentiality, including the circumstances in which the investigators plan to voluntarily disclose identifying information about research subjects (e.g., child abuse, harm to self or others, etc.) Sample language is provided below. If significant changes are made to the informed consent form, the Applicant should contact the Certificate Coordinator who issued the Certificate and submit a copy of the revised consent form. If this is a multi-site project, the lead site must indicate that it has on file a copy of the informed consent form as approved by the IRB for each site, which will be made available to the NIH upon request.

10. All research in which a controlled drug or drugs will be administered must submit a copy of the Drug Enforcement Administration Certificate of Registration (BND Form 223) under which the research project will be conducted.

11. If the research project is testing for reportable communicable diseases, the applicant must submit information relating to its compliance with State reporting laws, as specified in the August 9, 1991 memorandum from the Assistant Secretary for Health (https://grants.nih.gov/grants/policy/coc/cd_policy.htm).


The following assurances are required and the following information should be included in the Certificate application letter, which must be signed by the PI and the Scientific Director of the Institute.

The Institute receiving the Certificate of Confidentiality agrees to use it to protect against the compelled disclosure of personally identifiable information and to support and defend the authority of the Certificate against legal challenges.

Personnel involved in the conduct of the research will comply with all the requirements of 45 CFR Part 46 "Protection of Human Subjects."

This Certificate of Confidentiality will not be represented as an endorsement of the project by the DHHS or NIH or used to coerce individuals to participate in the research project.

All research participants will be informed that a Certificate has been issued, and they will be given a description of the protection provided by the Certificate.

Any research subject entering the project after expiration or termination of the Certificate will be informed that the protection afforded by the Certificate does not apply to them.

___________________________          __________________________

Signature of Principal Investigator              Signature of Scientific Director

Informed Consent

When a researcher obtains a Certificate of Confidentiality, the research subjects must be told about the protections afforded by the certificate and any exceptions to that protection. That information should be included in the informed consent form. Examples of appropriate language follow. Researchers may adapt the language to the needs of the research participants and to the subject matter of the study. However, the language used must cover the basic points.

Researchers should also review the language about confidentiality and data security that is routinely included in consent forms to be certain that it is consistent with the protections of the Certificate of Confidentiality.


To help us protect your privacy, we have obtained a Certificate of Confidentiality from the National Institutes of Health. The researchers can use this Certificate to legally refuse to disclose information that may identify you in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings, for example, if there is a court subpoena. The researchers will use the Certificate to resist any demands for information that would identify you, except as explained below.

The Certificate cannot be used to resist a demand for information from personnel of the United States Government that is used for auditing or evaluation of Federally funded projects or for information that must be disclosed in order to meet the requirements of the federal Food and Drug Administration (FDA). 

You should understand that a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the researchers may not use the Certificate to withhold that information.

[The researchers should include language such as the following if they intend to make voluntary disclosure about things such as child abuse, intent to hurt self or others, or other voluntary disclosures.] The Certificate of Confidentiality will not be used to prevent disclosure to state or local authorities of [list what will be reported, such as child abuse and neglect, or harm to self or others].

This page last updated on December 21, 2012 
Content Manager: hardyan@mail.nih.gov 
Technical Issues: E-mail OER Webmaster