This list of Frequently Asked Questions was adapted from the National Institutes of Health Certificate of Confidentiality Kiosk.
A federal law allows the HRSA and other federal agencies to issue Certificates of Confidentiality to persons engaged in sensitive biomedical, behavioral, clinical or other research, for the purpose of protecting the privacy of research subjects. The authorizing federal law states that anyone who receives a Certificate of Confidentiality may not be compelled in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings to identify the subjects of research covered by the Certificate. Thus, the Certificates help minimize risks to subjects by adding an additional level of protection for maintaining confidentiality of private information.
This protection is not limited to federally funded research; Certificates may be issued to cover any study that the issuing federal agency deems to be appropriate. Generally, research will be considered “sensitive” and eligible for Certificate protection if the study involves the collection of identifying information which, if revealed, could harm the financial standing, employability, insurability, or reputation of a research subject. Such information includes data about sexual attitudes and behavior, substance abuse, illegal conduct, psychiatric or genetic information, and much medical information.
Importantly, however, there are exceptions to the scope of protection afforded by a Certificate of Confidentiality. Certificates do not protect research subjects against the voluntary disclosure by the investigator of identifying information. For example, a Certificate does not prevent an investigator from notifying the authorities if he or she obtains evidence of child abuse or a subject's threatened violence to self or others. In fact, JHM policies require investigators to comply with all such mandatory disclosure laws. Also, federal agency rights to audit research records are not eliminated by Certificates of Confidentiality. The consent form for a research study must inform study subjects that even when a Certificate has been obtained, the investigator can make certain disclosures.
Any person engaged in research in which sensitive information is gathered from human research participants (or any person who intends to engage in such research) may apply for a Certificate of Confidentiality.
Before submitting a new application to the IRB, investigators should consider whether a Certificate of Confidentiality would be an added protection for study data. If the investigator seeks to obtain identifying information of a sensitive nature from research participants, and the disclosure of such information could harm the participants as described above, the PI may wish to apply to the government for a Certificate of Confidentiality. The investigator should state in the application to the IRB that he or she will seek a Certificate of Confidentiality after the IRB has reviewed the application. Certificates are most important for grant-funded and investigator-initiated research.
Generally, any research project that collects personally identifiable, sensitive information and that has been approved by an IRB operating under either an approved Federal-Wide Assurance issued by the Office of Human Research Protections or the approval of the Food and Drug Administration is eligible for a Certificate. Federal funding is not a prerequisite for a HRSA issued Certificate, but the subject matter of the study must fall within the mission area.
Sensitive information includes (but is not limited to) information relating to sexual attitudes, preferences, or practices; information relating to the use of alcohol, drugs, or other addictive products; information pertaining to illegal conduct; information that, if released, might be damaging to an individual's financial standing, employability, or reputation within the community or might lead to social stigmatization or discrimination; information pertaining to an individual's psychological well-being or mental health; and genetic information or tissue samples.
The following is an illustrative but not exhaustive list of research areas eligible for a Certificate:
Ineligible studies include projects that are:
Researchers can use a Certificate to avoid compelled "involuntary disclosure" (e.g., subpoenas) of names and other identifying information about any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. It does not protect against voluntary disclosures by the researcher, but those disclosures must be specified in the informed consent form. A researcher may not rely on the Certificate to withhold data if the participant consents in writing to the disclosure.
Individuals who participate as research subjects (i.e., about whom the investigator maintains identifying information) in the specified research project during any time the Certificate is in effect are protected permanently- even if the subject gave the researcher data before the Certificate is issued.
Personally identifiable information protected by a Certificate may be disclosed under the following circumstances:
Generally, an application for a Certificate of Confidentiality is submitted after the Institutional Review Board (IRB) responsible for its review approves the research project (because IRB approval or approval conditioned upon issuance of a Certificate of Confidentiality is a prerequisite for issuance of a Certificate). Since the informed consent form should include language describing the Certificate and any voluntary disclosures specified by the investigator, the Applicant could tell the IRB that they are applying for a Certificate of Confidentiality and have included appropriate language in the informed consent form. Applications for Certificates should be submitted at least three months prior to the date on which enrollment of research subjects is expected to begin
If a significant change in your research project is proposed after a Certificate is issued, you must inform the Certificate Coordinator of the Institute issuing the certificate by submitting an amended application for a Certificate of Confidentiality (in the same form and manner as your original application for a Certificate).
Significant changes include: major changes in the scope or direction of the research protocol, changes in personnel having major responsibilities in the project, or changes in the drugs to be administered (if any) and the persons who will administer them.
If you determine that the research project for which you have received a Certificate of Confidentiality will extend beyond the expiration date on the Certificate, you may submit a written request for extension of the date. This request should be submitted to the HRSA at least three months prior to the Certificate's expiration. It must include an explanation of the reasons for requesting an extension (e.g., new subjects continue to be enrolled in the project), a revised estimate of the date for completion of the project, documentation of the Institutional Review Board's most recent approval for the project, and a copy of the consent form which should include language explaining the Certificate's protections, specify any voluntary disclosures, and clearly state any other limitations. If your request is approved, an amended Certificate will be issued.
When a researcher obtains a Certificate of Confidentiality, the subjects must be told about protections afforded by the Certificate and any exceptions to those protections - i.e., the circumstances in which the investigators plan to disclose, voluntarily, identifying information about research participants (e.g., child abuse, harm to self or others, etc.). This information should be included in the informed consent form unless a research subject is no longer actively participating in the project so amendment of the informed consent would be impractical The researchers should eliminate provisions in consent form templates that may be inconsistent with the Certificate protections (such as references to disclosures required by law, since the Certificate enables researchers to resist disclosures that would otherwise be compelled by law). In addition, researchers may not represent the Certificate as an endorsement of the research project by the DHHS or use it in a coercive manner when recruiting subjects
The researcher should immediately inform the Certificate Coordinator who issued the Certificate and seek legal counsel from his or her institution.
In the informed consent form, you should tell subjects who are still actively involved in your study that the Certificate is in effect. If subjects are no longer actively participating in the project, an amendment to the informed consent form would be impractical.
The authorized institutional official is the individual named by the applicant organization who is authorized to act for that organization and assumes on behalf of the institution the obligations imposed by assurances as well as obligations imposed by the Federal laws, regulations, requirements and other conditions that apply to grant applications and awards.
No. Certificates of Confidentiality offer an important protection for the privacy of research study participants by protecting identifiable health information from forced disclosure (e.g., by court order). While the Privacy Rule does establish protections for covered entities’ use and disclosure of PHI, it permits use or disclosure in response to certain judicial or administrative orders. Therefore, researchers/contractors may obtain Certificates of Confidentiality to protect them from being forced to disclose information that would have to be disclosed under the Privacy Rule.
No, a Certificate of Confidentiality protects investigators and institutions from being compelled to release information that could be used to identify study participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. The Patriot Act does not affect those protections.
NO. The Certificate is issued to an individual PI or sponsor. If the PI of a study is replaced by another investigator, the Certificate must be amended to reflect that change.
Yes. The Certificate is issued for an explicit period of time. Once it expires, any study information collected after that expiration is not protected. The PI must renew the Certificate of Confidentiality, well in advance of its expiration, so that the entire period of data collection is protected.
Yes, most Certificates of Confidentiality specify that the holder of the Certificate must notify the issuing agency of any changes to the protocol.
Assuming that the project meets the eligibility criteria for the Certificate and that subjects are actively being recruited, previously enrolled subjects will be covered. The applicant should indicate the entire length of the study to be covered (start to finish) in the application letter. The Certificate issued should indicate that the research is already underway and that it will end on the stated date. The applicant should also take the Consent Form, revised according to suggested wording, to the IRB for approval prior to requesting the Certificate.