Certificates of Confidentiality
A Certificate of Confidentiality (CoC) protects the privacy of human research participants by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the participant consents to such disclosures or in other limited specific situations.
About CoCs
CoCs are issued to the research institution by a U.S. federal agency, typically as a term and condition of funding on an award sponsored by that agency, and require an authorized signature from the designated institutional official to show institutional agreement with the terms.
To validate the CoC application for submission to the funding agency and to facilitate the request for the authorized institutional signature, the U-M HRPP has a required pre-application review process.
Prior to submitting the CoC application package to the NIH or other funding agency, you must have IRB approval for the study and have completed the pre-application process with the U-M HRPP. Principal Investigators (PIs) should not create the NIH application package (or other agency application) until instructed to do so by the U-M HRPP.
U-M CoC Pre-application Process
Follow the U-M CoC pre-application process:
- For research funded by a non-federal entity (e.g., internal funding).
- For research funded by an HHS agency that does not have its own CoC application.
- To apply for the a new CoC in situations where the NIH-sponsored funding has ended and will not be renewed via a No Cost Time Extension or a new award, but the associated human research continues to enroll participants or collect data/biospecimens.
- To apply for a new CoC if there are substantive changes to the research project (e.g., new PI takes over the project or the project moves to a new institution, major changes in the scope or direction of the research protocol, or changes in the drugs to be administered, if any, and or changes to the persons who will administer the drugs).
- To cover unfunded research collaborators (i.e., those not receiving NIH funds or paid with NIH monies) who are collecting identifiable, sensitive research participant data/biospecimens as part of an NIH-funded (direct or prime) project.
Federal Agencies with a Distinct CoC Process
- DOJ
- AHRQ
- CDC
- SAMHSA
- HRSA
- IHS
- FDA – for use of an investigational drug/device in a research study operating under FDA authority (regardless of the study’s funding source)
Review the reference table offered by NIH for contact/submission information.
Kate Sasamoto, J.D.
Associate HRPP Director
University of Michigan
North Campus Research Complex
2800 Plymouth Road
Bldg. 520, Rm. 1167
48109-2800
Upon issuance of the CoC, notify HRPPCoCgroup@umich.edu
U-M HRPP CoC Pre-application Package
Pre-review of the application package by the U-M HRPP is required for CoC submission to these federal agencies. Follow steps 1-2 of the CoC process document to submit the application package to the HRPP. Include the U-M designated signatory information following the PI signature line in the application:
Download the U-M HRPP CoC Application and follow the instructions within the application to submit to the U-M HRPP.
Download ApplicationPost-Approval Compliance
The U-M HRPP office tracks all studies holding a CoC. The HRPP office typically sends reminders to investigators about expiring NIH funding or about expiring CoCs that were obtained via direct application to the NIH two months prior to the funding period end date or the NIH expiration date, respectively.
Process Exceptions & Details
New NIH-funded Research
The National Institutes of Health (NIH) automatically issue a CoC for a human research study as a term and condition of the funding on an NIH-sponsored award. A principal investigator (PI) does not need to apply for a CoC on an NIH-funded project and the NIH does not issue a separate CoC document. An NIH-issued CoC cannot be extended or amended.
If changes are required, or should NIH funding end and new participants are still being enrolled or data or biospecimens are still being collected from existing participants, the Principal Investigator (PI) must apply for a new CoC using the NIH’s online CoC system.
Ongoing NIH-funded Research as of Dec. 13, 2016
In 2017, the NIH changed its process to automatically apply a CoC with their awards. At that time, study teams with impacted NIH-funded human research that was ongoing as of Dec. 13, 2016 were advised to notify current subjects about the CoC and/or, as instructed by the U-M IRB, update the IRB application and revise their informed consent document(s) to reflect this change.
NOTE: If the PI obtained a CoC prior to the 2017 NIH policy implementation and subsequently obtained NIH funding for that project, the CoC coverage will be based on the funding end date.
If the NIH funding has ended, but new participants are still being enrolled or data/biospecimens are still being collected from participants, the Principal Investigator (PI) must follow the U-M HRPP pre-application process to apply for a new CoC.
Multi-site Research with Unfunded Collaborators
Effective September 1, 2019, the U-M HRPP no longer accepts signed CoC Assurances from unfunded collaborator/multi-site researchers (i.e., not an NIH direct or sub-award recipient or U-M sub-contractor who is paid with NIH monies). If collecting identifiable, sensitive participant data/biospecimens, unfunded collaborator/multi-site researchers must apply directly to the NIH for a CoC to cover their research activities in the project.
U-M investigators working as an unfunded researcher where an external Lead site holds the CoC must follow the U-M CoC pre-application process to cover their research activities when their work will involve the collection of identifiable, sensitive data/biospecimens and fall within the NIH mission.
Where a ceding agreement between U-M and another institution (or private IRB) is in place, it is up to the Deputy Institutional Official’s (DIO) discretion whether to sign the CoC Assurances on behalf of U-M on a case-by-case basis.
Principal Investigator Responsibilities
PIs should review the NIH CoC policy to learn about the expanded protections and limitations around disclosures and be prepared to discuss the CoC protections, limitations, and application process with all collaborators as part of project planning or on-going communications, including with sub-awardees, sub-contractors who will collect, receive or access identifiable, sensitive data. This may include ensuring that any sub-awardee/sub-contractor includes the required CoC text in consent/assent documents. Communication of the CoC information may also be covered by the sub-award/contract. For additional guidance, review the NIH resources in the References & Resources section below.
It is the PI’s responsibility to ensure that:
- All funding is accurately described in the IRB application in eResearch;
- The U-M HUM number (i.e., project id) appears in ORSP records linked to the funding;
- Consents/assents are up-to-date with the appropriate CoC statement;
- CoCs are uploaded to the IRB application;
- New CoCs are obtained, as necessary;
- Researchers with whom you share identifiable (or coded and linked) data or biospecimens are informed about the CoC protections and limitations around disclosure; and
- Unfunded collaborators who are collecting identifiable, sensitive research participant data/biospecimens as part of the project apply for a CoC using their institution’s process to cover their work on the project.
References and Resources
(PDF) One-page snapshot of key CoC information by funding/non-funding source. Last updated: 05/28/2021
CoC Quick Facts for U-M Researchers
This document provides U-M faculty and graduate students with quick facts about CoCs. Last Updated 05/19/2020
Link to the NIH’s webpage of frequently asked questions for certificates of confidentiality
NIH policy & compliance webpage for certificates of confidentiality
Link to the NIH system to request a CoC. Reminder: U-M investigators must first obtain U-M HRPP review of the application package prior to using this system.
NIH Online CoC System User Guide
Instructions and information to use the NIH online certificate of confidentiality system to request a CoC. (PDF)
U-M HRPP CoC Application Instructions with Key Personnel Listing Template
(Download) Provides instructions to prepare the CoC application package for U-M HRPP review prior to submission to the NIH; includes key U-M data required for the NIH online form and the Key Personnel Listing template. Last Updated: 02/14/2024
Questions?
Contact HRPPCoCgroup@umich.edu for questions regarding Certificates of Confidentiality for human research.
Related Information
U-M Certificate of Confidentiality Policy
HRPP Operations Manual, Part 11, Section I A.3
AHRQ Research and Confidentiality Protections
The confidentiality of identifiable persons and establishments in AHRQ supported research is protected from disclosure by the Confidentiality Statute, 42 U.S.C. § 299c-3(c). This Statute restricts the use, publication and release of identifiable information about individuals and establishments obtained in the course of activities undertaken or supported under Title IX of the Public Health Service Act. As such, it is unnecessary for AHRQ recipients to hold a certificate of confidentiality for research projects.
Researchers should plan to include a concise statement about the limitations on disclosure of research data under of the Confidentiality Statute in their informed consent document.