Certificate of Confidentiality

Frequently Asked Questions

What are Certificates of Confidentiality?

A Certificate of Confidentiality helps researchers protect the privacy of subjects in biomedical, behavioral, clinical, or other research projects against compulsory legal demands (e.g., court orders and subpoenas) that seek the names or other identifying characteristics of a research subject.

What protection does a Certificate of Confidentiality afford?

Confidentiality Certificates are issued by the Department of Health and Human Services pursuant to Section 301(d) of the Public Health Services Act (42 U.S.C. Section §241(d)) to afford special privacy protection to research subjects. A Certificate can be used by the researcher to avoid compelled “involuntary disclosure” (e.g., subpoenas) of identifying information about a research subject. It does not prevent voluntary disclosures such as limited disclosure to protect the subject or others from serious harm, as in cases of child abuse. Also, a researcher may not rely on a Certificate to withhold data if the subject consents to the disclosure.

The Certificate covers the collection of sensitive research information for a defined time period (the term of the project); however, personally identifiable information obtained about subjects enrolled while the Certificate is in effect is protected in perpetuity.

What research is eligible for this privacy protection?

Under Section 301(d) of the Public Health Service Act, 42 U.S.C. §241(d):

“The Secretary [of the Department of Health and Human Services] may authorize persons engaged in biomedical, behavioral, clinical, or other research (including research on mental health, and on the use and effect of alcohol and other psychoactive drugs) to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals” (Public Health Service Act 301(d), 42 U.S.C. §241(d), as amended by Public Law No. 100-607, Section 163 (November 4, 1988)).

Accordingly, this special privacy protection can be granted only to research (i.e., a systematic investigation designed to develop or contribute to generalizable knowledge). It is granted only when the research is of a sensitive nature where the protection is judged necessary to achieve the research objectives.

Federal funding is not a prerequisite.

What types of projects are eligible for a certificate?

Projects eligible for Certificates must involve the collection of sensitive information which, if disclosed, could have adverse legal consequences or be damaging to an individual’s financial standing, reputation, insurability, or employability. Research can be considered sensitive if it involves the collection of information in any of the following categories:

  1. Information relating to sexual attitudes, preferences, or practices;
  2. Information relating to the use of alcohol, drugs, or other addictive products;
  3. Information pertaining to illegal conduct;
  4. Information that if released could be damaging to an individuals financial standing, employability, or reputation within the community;
  5. Information that would normally be recorded in a patient’s medical record, and the disclosure of which could reasonably lead to social stigmatization or discrimination;
  6. Information pertaining to an individual’s psychological well being or mental health;
  7. Genetic information.

What projects are NOT eligible for a certificate?

Projects NOT eligible for a Certificate are:

  • Projects that are not research-based or research-related.
  • Projects that are not Institutional Review Board (IRB)-approved.
  • Projects collecting information which, if disclosed, is not deemed to involve significant harm or damage to the subject.
  • Projects which do not collect personally identifiable information.

How Does One Obtain a Certificate of Confidentiality?

The issuance of Certificates of Confidentiality is discretionary. An application is submitted by the Principal Investigator of a specific research project. It includes assurances of compliance with certain basic requisites. Since a certificate is generally issued to a sponsoring research institution, the application, and its assurances, must be signed by a faculty member, or a senior official.

Ordinarily, a Certificate is issued for a single project (not broad groups or classes of projects). However, for cooperative multi-site projects, a coordinating center or “lead” institution can apply for, and receive, a Certificate on behalf of all member institutions. However, that lead institution must agree to be sure that all participating institutions conform to the application assurances and inform their subjects, appropriately, about the Certificate, its protections and the circumstances in which voluntary disclosures would be made.

What is the researcher’s responsibility to participants in a study for which a Certificate has been granted?

When a researcher obtains a Confidentiality Certificate, the subjects must be told about the protections afforded by the Certificate, and any exceptions to that protection. This information is usually included in an “informed consent.”

Research subjects vary widely in their cultural and educational backgrounds. The Confidentiality Certificate description should cover the basic points – privacy protection means that the subject will not be identified as participating in the study, unless the subject consents, or a disclosure is made to protect the subject or another from serious harm. Researchers may adapt the example to the special needs of their clientele, and to the subject matter of the study.

Researchers should also review the language about confidentiality which is routinely included in consent forms to be sure that it is consistent with Confidentiality Certificate protections. For example, consent forms sometimes refer to state law reporting requirements. However, HHS General Counsel advises that such a disclosure would be voluntary, even though (otherwise) required by State law, because the Certificate protects the researcher from the compulsion of that law. Thus, note that the example simply describes the circumstances in which disclosures would be made.

In addition, researchers should be careful not to represent the issuance of a Certificate to potential participants as an endorsement of the research project by DHHS or to use it in a coercive manner for recruitment of participants. Finally, the researcher must be prepared to use the authority of the Certificate to resist compulsory disclosure of individually identifiable research data.

In what situations may data protected by a Certificate be disclosed?

Data that are protected by a Certificate may be disclosed under the following circumstances:

  • Voluntary disclosure of information by study participants themselves to physicians or other third parties, or authorization by study participants of release of information to insurers, employers, or other third parties.
  • Voluntary reporting by the investigator of information, such as child abuse or threat of other potential violence by the study participant to the participant or others, provided such intention is specified in the informed consent document.
  • Voluntary compliance by the researcher with reporting requirements of other state laws such as knowledge of a communicable disease, provided such intention is specified in the informed consent document.
  • Release of information by investigators to DHHS as required for audits of research records or to the FDA as required under the federal Food, Drug, and Cosmetic Act (21 U.S.C. § 301 et seq.).

Depending on your funding source or area of research, you may want to contact a specific agency of one of the contacts below for information pertaining to Certificates of Confidentialty.

Primary Contact
Ms. Olga Boikess
National Institute of Mental Health
17-C-02 Parklawn Building
5600 Fishers Lane
Rockville, MD 20857
Telephone: (301) 443-3877
Email: oboikess@mail.nih.gov
For information about certificates for research projects funded by the National Institute on Alcohol Abuse and Alcoholism
Ms. Susan Farrell
National Institute on Alcohol Abuse and Alcoholism
Willco Building, Suite 402
6000 Executive Boulevard, MSC 7003
Bethesda, MD 20892-7003
Telephone: (301) 443-1274
For information about certificates for research projects funded by the National Institute on Drug Abuse
Ms. Jacqueline R. Porter
National Institute on Drug Abuse
Parklawn Building, Room 10-42
5600 Fishers Lane
Rockville, MD 20857
Telephone: (301) 443-2755
For information about certificates for research projects funded by Centers for Disease Control and Prevention (CDC), and Agency for Toxic Substances and Disease Registry (ATSDR):
Ms. Betsey Dunaway
MASO, M/S E-11
Centers for Disease Control
1600 Clifton Road NE
Atlanta, GA 30333
Telephone: (404) 539-2942
Fax: (404) 639-0445
Email: basl@cdc.gov
For information about certificates for research projects requiring an Investigational New Drug Exemption from the Food and Drug Administration:
Ms. Nancy Pitt
Food and Drug Administration
HFY-20
Parklawn Building. Room 15-22
5600 Fishers Lane
Rockville, MD 20857
Telephone: (301) 827-1697
For information about certificates for research projects funded by Health Resources and Services Administration (HRSA):
Dr. Louis Emmet Mahoney
Health Resources and Services Administration
Parklawn Building, Room 9-05
5600 Fishers Lane
Rockville, MD 20857
Telephone (301) 443-0458
Fax: (301) 443-9795
Email: lmahoney@hirsa.gov
For information about certificates for research projects funded by the Indian Health Service:
Dr. William L Freeman
Indian Health Service
5300 Homestead Road
Albuquerque, NM 87110-1293
Telephone: (505) 248-4141
Fax: (505) 248-4384
For information about certificates for research projects funded by the National Institute of Allergy and Infectious Disease:
Dr. Estelle Parrott
National Institute of Allergy. and Infectious Disease
Solar Building, Room 4B-O1
6003 Executive Boulevard
Rockville, MD 20892
Telephone: (301) 496-8697
Fax: (301) 496-8729
For information about certificates for research projects funded by the National Cancer Institute:
Dr. Susan Sieber
National Cancer Institute
Executive Plaza North, Room R540
6130 Executive Boulevard
Rockville, MD 20852
Telephone: (301) 496-5946
Fax (301) 496-1297
For information about certificates for research projects funded by the National Institute of Environmental Health Sciences:
Dr. John Penta
National Institute of Environmental Health Sciences
P.O. Box 12233
Research Triangle Park, NC 27709
Telephone: (919) 541-3696
Fax: (919) 541-2260
For information about certificates .for research projects funded by the National Institute of Heart Lung and Blood:
Mr. James Wehling
National Institute of Heart Lung and Blood
Building 31, Room 5 A48
9000 Rockville Pike
Bethesda, MD 20892
Telephone: (301) 496-2411
Fax: (301) 402-3686
For information about certificates for research projects funded by the Substance Abuse and Mental Health Administration:
Dr. Dorita Sewell
Substance Abuse and Mental Health Administration
Parklawn Building, Room 12C-26
5600 Fishers Lane
Rockville, MD 20857
Telephone: (301) 443-7023
Fax: (301) 443-1587

How are extensions or amendments to existing Certificates obtained?

If the research scope of a project covered by a Certificate should change substantially, the PI should request an amendment to the Certificate. An extension must be requested if the research extends beyond the expiration date of the original Certificate, in order to provide coverage for subjects recruited after the expiration of a Certificate.

Requests for extensions of an expiration date for a Certificate or for other amendments should be made three months prior to the needed date. These requests should be accompanied by a justification, documentation of the most recent IRB approval, a copy of an informed consent describing the Confidentiality Certificate protections and the circumstances in which voluntary disclosures might be made, and in the case of an extension, the new expected completion date for the research project.

Has the legality of Certificates been challenged?

There have been court challenges to the confidentiality protections afforded by a Certificate. In 1973, the Certificate’s authority was upheld in the New York Court of Appeals. The U.S. Supreme Court declined to hear the case.

What should an investigator do if legal action is brought to release personally identifying information protected by a certificate?

A Certificate of Confidentiality is a legal defense against a subpoena or court order to be used by the researcher to resist disclosure. The researcher should seek legal counsel from his or her institution. The Office of General Counsel for DHHS is willing to discuss the regulations with the researcher’s attorney. In addition, NINDS-funded researchers should notify:

Barbara Radziszewska, Ph.D., M.P.H.
Clinical Research Project Manager
NINDS/NIH
Neuroscience Center
6001 Executive Blvd. RM# 2215, MSC# 9520
Bethesda, MD 20892-9520 (for courier service: Rockville, MD 20852)
PHONE: (301) 496-2076
FAX: (301) 480-1080
E-MAIL: br94h@nih.gov
Top

Application Instructions

To apply for a Certificate of Confidentiality, under the authority of Section 301(d) of the Public Health Service Act (42 U.S.C. Section §241(d)) in order to protect against involuntary disclosure of the identities of research subjects, please direct a letter containing the following information using the numbering scheme shown. Except for Items 4 and 5, please do not respond by submitting supplementary materials.

  1. Title of the project.
  2. Source and number of the supporting grant (if applicable, e.g., National Institute of Neurological Disorders and Stroke NS12345; ABC Foundation, otherwise type “None”).
  3. Name and location of sponsoring/host institution.
  4. Documentation of Institutional Review Board (IRB) approval (letter or form signed by authorized IRB representative).
  5. Copy of informed consent/assent forms to be used in study with language describing the Confidentiality Certificate protections and the circumstances in which a voluntary disclosure might be made.
  6. Name, title or position at sponsoring institution, mailing address, telephone/fax numbers, email address, and summary of the relevant training of the Principal Investigator.
  7. Beginning date and expected end date of the project.
  8. Concise description (e.g., 1-2 paragraphs) of the project aims and research methodology (omit “Background”). Include number, source and description of the human subjects.
  9. Reasons for requiring confidentiality.
  10. Means used to protect subjects’ identities (e.g., coded by number, kept in locked files, identifiers destroyed when study completed).
  11. Assurances: (a) that personnel involved in the conduct of the research will comply with all the requirements of 45 CFR Part 45 “Protection of Human Subjects” (Non-DHHS-supported projects must comply with 45 CFR 46.103 (c) and document legally informed consent in a manner consistent with the principles stated in 45 CFR 46.111); (b) that the Certificate of Confidentiality will not be represented as an endorsement of the project by the DHHS Secretary or used to coerce individuals to participate in the research project; (c) that the recipient of the Confidentiality Certificate will use the vested authority to protect the identity of research subjects; (d) that all subjects will be informed that a certificate has been issued and that subjects will be provided with a description of the protection covered by the certificate; and (d) that subjects who enter the project after termination of the certificate will be informed of the termination. (Please type the assurances verbatim.)
  12. The application must be signed by the individual primarily responsible for the conduct of the research, or a senior official.

Example Language Used in Certificates of Confidentiality

To help us further protect your privacy, the investigators have obtained a Confidentiality Certificate from the Department of Health and Human Services (DHHS).

With this Certificate, the investigators cannot be forced (for example by court subpoena) to disclose research information that may identify you in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings. Disclosure will be necessary, however, upon request of DHHS for audit or program evaluation purposes.

You should understand that a Confidentiality Certificate does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. Note however, that if an insurer or employer learns about your participation, and obtains your consent to receive research information, then the investigator may not use the Certificate of Confidentiality to withhold this information. This means that you and your family must also actively protect your own privacy.

Finally, you should understand that the investigator is not prevented from taking steps, including reporting to authorities, to prevent serious harm to yourself or others.

Top

Reviewed September 13, 2001 by Barbara Radziszewska