NIH Policy for NIH-Funded Human Subjects Research
Effective October 1, 2017, all new and ongoing NIH-funded research meeting certain criteria is deemed to be issued a Certificate of Confidentiality (CoC) via a new NIH policy. This policy results from a directive in the 21st Century Cures Act. For more information about the change in policy, please see this notice.
Previously, researchers had to proactively apply to the NIH for a CoC, and it would be granted only if the study was collecting “sensitive” information from participants, like reports of illegal behavior.
What is a Certificate of Confidentiality?
NIH grants Certificates of Confidentiality to research studies, to protect identifiable research records from forced disclosure.
What Research is Now Covered Automatically by a CoC?
- All NIH-funded research that is commenced or ongoing on or after December 13, 2016, and:
- Is “human subjects research” as defined by federal regulations, including exempt research where data is identifiable;
- This includes research on individually-identifiable biospecimens
- Or, is research involving the collection or use of biospecimens or for which there is at least a very small risk that there is some way to deduce the identity of an individual;
- Or, is research that generates individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is “identifiable” per the Common Rule;
- Or, is any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that the subject’s identity could be deduced
What Does the Research Team Have to Do?
For studies that obtain informed consent, the human subjects must be informed that their information is protected by a CoC. The IRB provides language in its consent form (ICF) template to be used in all new submissions meeting the above criteria. The IRB also provided an addendum to be used when consenting prospective subjects in ongoing research studies, until the study team updates the ICF to include the CoC language (more to come on when that will be required).
Then, if you receive a subpoena or a request for production of documents related to identifiable research data, you may refuse per the CoC. Please consult with the Office of the General Counsel whenever you receive such a request. (Note that if an individual subject wishes for their information to be released, and provides a signed consent to that effect, then the disclosure would be considered voluntary and the CoC would not block it.)
Will the CoC Cover Data Already Collected in Your Ongoing Study?
Yes. Once in place, the CoC applies to all data collected in the study, including data collected before the CoC was issued. However, once your NIH funding ends, any new data collected after that point will NOT be covered by the CoC. You would have to apply for a new one.
Will I Receive an Actual “Certificate?”
No. The NIH will not be sending out certificates when the CoC is automatically granted.
Can I Still Apply for a CoC for Non-NIH-Funded Research?
Yes, the old application process may still be used for studies not funded by the NIH. See our website or the NIH Kiosk for guidance.