decorative image
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
decorative image
Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

n/a Warning! This browser is not supported - Some features might not work. Try using a different browser such as Chrome, Edge, Firefox, or Safari.

  1. Home
  2. Policy & Compliance
  3. Human Subjects
  4. Certificates of Confidentiality
  5. Who Can Get a Certificate of Confidentiality?

Who Can Get a Certificate of Confidentiality?

Effective October 1, 2017 Certificates of Confidentiality (COCs) will be issued automatically for any NIH-funded project using identifiable, sensitive information that was on-going on/after December 13, 2016.

  • The CoC will be issued as a term and condition of award
  • There will be no physical certificate issued

The NIH will continue to consider requests for Certificates of Confidentiality for specific projects that are not funded by NIH, or other HHS agencies that issue Certificates. Such requests need to be submitted through the NIH online system in accordance with current NIH procedures for issuing Certificates.

Select your Funder below to learn more

NIH Funded Research

NIH awardees no longer need to request a Certificate of Confidentiality.

Per Section 2012 of the 21st Century Cures Act as implemented in the 2017 NIH Certificates of Confidentiality Policy, all ongoing or new research funded by NIH as of December 13, 2016 that is collecting or using identifiable, sensitive information is automatically issued a CoC. Compliance requirements are outlined in the NIH Grants Policy Statement, which is a term and condition of all NIH awards.

This policy applies to NIH funded: 

  • Grants
  • Cooperative Agreements
  • R&D Contracts
  • Other Transaction Awards
  • NIH’s own intramural research

How do I know if my NIH funded research project is covered by a CoC?

Research in which identifiable, sensitive information is collected or used, including research that
  • Meets the definition of human subjects’ research, including exempt research in which subjects can be identified
  • Is collecting or using human biospecimens that are identifiable or that have a risk of being identifiable
  • Involves the generation of individual level human genomic data
  • Involves any other information that might identify a person
If your research meets any of the above criteria, then your research data or information is automatically protected by a CoC from NIH.
 

What do I need to do if I have a CoC?

  1. Researchers with a CoC may ONLY disclose identifiable, sensitive information in the following circumstances:
    • if required by other Federal, State, or local laws, such as for reporting of communicable diseases
    • if the subject consents; or
    • for the purposes of scientific research that is compliant with human subjects’ regulations
  2. AND you must ensure that anyone who is conducting research as a sub-awardee or receives a copy of identifiable sensitive information protected by the policy understand they are they are also subject to the disclosure restrictions, even if they are not funded directly by NIH.

How do I document that I have a CoC for my NIH funded Research?

NIH will no longer issue a physical certificate.  You may point to your Notice of Award and the NIH Grants Policy Statement as documentation of the CoC protection.

 

For more information see CoC FAQs
Have a CoC Question?
Please address your inquiries to the NIH Office of Extramural Research: NIH-CoC-Coordinator@mail.nih.gov
 

Other HHS Agencies (non-NIH)

Several non-NIH HHS agencies, including CDC, FDA, HRSA, and SAMHSA, issue Certificates of Confidentiality (CoCs). If your research is funded by one of these agencies or is operating under the authority of the FDA, please contact the Certificate Coordinators at the funding agency to determine how to obtain a CoC.   
If your research is funded by an HHS agency, other than NIH, CDC, FDA, HRSA or SAMHSA, that do not issue CoCs, you may request a Certificate of Confidentiality for specific health-related projects using sensitive, identifiable information, using the NIH online system. NIH issues CoCs on behalf of these HHS agencies. 

For more information see CoC FAQs
Have a CoC Question?
Please direct additional questions to the NIH Office of Extramural Research: NIH-CoC-Coordinator@mail.nih.gov

Non-HHS Agencies

If your research is funded by a non-HHS Federal Agency, you may request a Certificate of Confidentiality for a specific project that involves sensitive, identifiable information. Issuance of a CoC is at the discretion of the NIH. Certificates of confidentiality are only issued for research projects that are:

  • Collecting or using identifiable, sensitive information (see below for more detail)
  • On a topic that is within the HHS health related research mission
  • Storing the research information collected or used in the US
   Research in which identifiable, sensitive information is collected or used, including research that:
  • Meets the definition of human subjects’ research, including exempt research in which subjects can be identified
  • Is collecting or using human biospecimens that are identifiable or that have a risk of being identifiable
  • Involves the generation of individual level human genomic data
  • Involves any other information that might identify a person

For more information see CoC FAQs
Have a CoC Question?
Please direct additional questions to the NIH Office of Extramural Research: NIH-CoC-Coordinator@mail.nih.gov

Non-Federal Funders

Health-related research that is not federally funded in which identifiable, sensitive information is collected or used, may request a Certificate of Confidentiality (CoC) for specific projects. Issuance of a CoC for non-federally-funded research continues to be at the discretion of NIH.

Certificates of confidentiality are only issued for research projects that are:

  • Collecting or using identifiable, sensitive information (see below for more detail)
  • On a topic that is within the HHS health related research mission
  • Storing the research information collected or used in the US
   Research in which identifiable, sensitive information is collected or used, including research that:                                                               
  • Meets the definition of human subjects’ research, including exempt research in which subjects can be identified
  • Is collecting or using human biospecimens that are identifiable or that have a risk of being identifiable
  • Involves the generation of individual level human genomic data
  • Involves any other information that might identify a person

For more information see CoC FAQs 
Have a CoC Question?
Please direct additional questions to the NIH Office of Extramural Research: NIH-CoC-Coordinator@mail.nih.gov
 

This page last updated on: January 15, 2019

Technical Issues: E-mail OER Webmaster