Updates regarding Certificates of Confidentiality

All CoCs issued in the past or in the future, regardless of funding sources, must comply with the requirements of the NIH's CoC policy, especially the new disclosure requirements and restrictions.

The new disclosure requirements prohibit disclosure of the name of the research subjects or any identifiable research information, document, or biospecimen to anyone not connected with the research except under very specific circumstance as detailed in the NIH's CoC policy.

  • Effective October 1, 2017 CoCs will be issued automatically for any NIH-funded project using identifiable, sensitive information that was on-going on/after December 13, 2016
    • The CoC will be issued as a term and condition of award
    • There will be no physical certificate issued.

NIH awardees no longer have to apply for a CoC

Per Section 2012 of the 21st Center Cures Act as implemented in the 2017 NIH Certificates of Confidentiality Policy, all ongoing or new research funded by NIH as of Dec. 13, 2016 that is collecting or using identifiable, sensitive information is automatically issued a CoC.  Compliance requirements are outlined in the NIH Grants Policy Statement, which is a term and condition of all NIH awards.

This policy applies to NIH funded:

  • Grants
  • Cooperative Agreements
  • R&D Contracts
  • Other Transaction Awards
  • NIH's own intramural research

How do I know if my NIH funded research project is covered by a CoC?

Research is which identifiable, sensitive information is collected or used, including research that

  • Meets the definition of human subject research, including exempt research in which subjects can be identified
  • Is collecting or using human biospecimens that are identifiable or that have a risk of being identified
  • Involves the generation of individual level human genomic data
  • Involves any other information that might identify a person

If your research meets any of the above criteria then your research data or information is automatically protected by a CoC from NIH.

What does having a CoC mean I need to do?

  1. Researchers with a CoC may ONLY disclose identifiable, sensitive information in the following circumstances:
    1. if required by other Federal, State or local laws, such as for reporting of communicable diseases
    2. if the subject consents; or
    3. for the purposes of scientific research that is compliant with human subject regulations
  2. AND you must ensure that anyone who is conducting research as a subawardee or receives a copy of identifiable sensitive information protected by the policy understands that they are also subject to the disclosure restrictions, even if they are not funded directly by NIH

How do I document that I have a CoC for my NIH funded Research?

NIH will no longer issue a physical certificate.  You may point to your Notice of Award and the NIH Grants Policy Statement as documentation of the CoC protection.

What does this mean for my research project?

If your research data is protected by a CoC from NIH, MCHS IRB requires that you ensure that the appropriate language and information is within your study informed consent to inform participants of the applicable coverage of their identifiable sensitive information.