Investigators and institutions have several responsibilities associated with the CoC, including: 1) informing participants about the CoC, 2) not releasing participants identifiable, sensitive information except under limited circumstances, 3) upholding the CoC protections, and 4) informing investigators and institutions receiving a copy of protected information about the CoC protections. Read more about these responsibilities below.
1. Inform participants.
Investigators that are deemed issued or non-NIH-funded investigators that are, after request, issued a CoC from NIH and will obtain informed consent need to inform the participants about the CoC protections and any exceptions to the CoC protections.
See sample consent language regarding CoCs.
Note: Use of this sample language is not required. Investigators may use any language that satisfies the requirements for informing participants about CoC protections.
2. Do not release participant’s identifiable sensitive information except under limited circumstances.
Identifiable, sensitive information covered by a CoC must not be disclosed or provided:
- In any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding OR
- To any other person not connected with the research.
Limited circumstances when the investigator and institution may release participant’s identifiable sensitive information:
- If required by other Federal, State, or local laws, such as for public health reporting of communicable diseases or child or elder abuse reporting*
- If the participant consents;
- If necessary for the medical treatment of the participant and made with the consent of the participant; or
- for the purposes of scientific research that is compliant with human subjects’ regulations
*Disclosure of identifiable, sensitive information (i.e., information, physical documents, or biospecimens) protected by a Certificate of Confidentiality must be done when such disclosure is required by other applicable Federal, State, or local laws.
3. Uphold CoC protections.
Institutions with a CoC agree to protect participants’ identifiable, sensitive information from compelled disclosure and support and defend the authority of the Certificate against legal challenges.
For additional information on the requirements to uphold CoC protections:
- NIH-funded investigators can review the NIH CoC Policy, the NIH Grants Policy Statement, and NIH DGS Contract Handbook - Special Contracts Requirements,
- Non-NIH funded investigators can review the Institutional Assurance Statement.
4. Inform investigators or institutions receiving a copy of protected information about CoC protections.
Certificate of Confidentiality recipients are required to inform investigators or institutions who receive a copy of identifiable, sensitive information or obtain biospecimens that are protected by a Certificate that they are also subject to the requirements of the CoC. These institutions and investigators are required to protect the identifiable, sensitive information or biospecimens from disclosure since the responsibilities apply to them equally.
Note: Investigators and institutions that are considering placing research data protected by a CoC in the participants medical records should discuss this with their institutional counsel. See this CoC FAQ for additional information.
NIH funded investigators have additional CoC responsibilities.