Certificates of Confidentiality Tip Sheet

Note: If your study/research is funded by NIH please refer to NIH Revision to the Policy on Certificates of Confidentiality.


What is a Certificate of Confidentiality?

Certificates of Confidentiality (CoCs) are issued by the National Institute of Health (NIH) to help researchers protect identifiable research information from forced disclosures such as court orders and subpoenas. They allow researchers to refuse to disclose identifying characteristics about research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level.

Eligibility for Certificates of Confidentiality

Certificates of Confidentiality are issued for studies collecting sensitive information which, if disclosed, “could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation.”[i]

In order to be eligible for a Certificate of Confidentiality, the research must collect personally identifiable, sensitive information, and have been approved by the UMass-Amherst IRB. The subject matter of the study must fall within a mission area of the NIH. Some research areas that are eligible for a CoC include:

  • Research on HIV, AIDS, or other STDs;
  • Studies that collect information on sexual attitudes;
  • Studies on the use of alcohol, drugs, or other addictive products;
  • Studies that collect information on illegal conduct;
  • Studies that gather information that if released could be damaging to a participant’s financial standing, employability, or reputation within the community;
  • Research involving information that might lead to social stigmatization or discrimination if it were disclosed;
  • Research on participants’ psychological well-being or mental health;
  • Genetic studies, including those that collect and store biological samples for future use;
  • Research on behavioral interventions and epidemiological studies.

Research does not have to be funded in order to be eligible for a Certificate of Confidentiality.

What a Certificate of Confidentiality Does Not Protect Against

Personally identifiable information protected by a CoC may be disclosed under the following circumstances:

  • Voluntary disclosure of information by study participants themselves or any disclosure that the study participant has consented to in writing, such as to insurers, employers, or other third parties;
  • Voluntary disclosure by the researcher of information on such things as child abuse, reportable communicable diseases, possible threat to self or others, or voluntary disclosures provided that such disclosures are spelled out in the informed consent document;
  • Voluntary compliance by the researcher with reporting requirements of state laws, such as knowledge of communicable diseases, provided such intention to report is specified in the informed consent document; or
  • Release of information by researchers to DHHS as required for program evaluation or audits of research records or to the FDA as required under the federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.)

How do I apply for a Certificate of Confidentiality?

The NIH recommends that researchers apply for a Certificate of Confidentiality “at least 3 months prior to the date on which enrollment of research subjects is expected to begin.”[ii] Since applications must have already been approved by the UMass-Amherst IRB before you apply for the CoC, we recommend applying far in advance of the anticipated research date.

You can apply for a Certificate of Confidentiality online at the NIH Certificates of Confidentiality Kiosk website: http://grants.nih.gov/grants/policy/coc/index.htm

Consent Form Language

Researchers must tell their participants about the protections afforded by the Certificate of Confidentiality, and about any exceptions to these protections. For example, if there are any circumstances in which the researchers plan to voluntarily disclose identifying information about research participants (e.g. child abuse, harm to self or others, etc), this must be explicitly included on the informed consent form.

The NIH recommends the following language be added to informed consent documents:

“To help us protect you and the information we will be collecting from you, this study has been given a Certificate of Confidentiality by [identify provider of certificate].  This Certificate means that the researchers cannot be forced, even by a court subpoena, in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings, to disclose any information that may identify you.  The researchers will use the Certificate to resist any demands of information that would identify you, except as explained below.” 

“The Certificate cannot be used to resist a request for information from United States government employees if the request is for auditing or evaluation of federally funded projects[include the following statement only if FDA regulated research: or for information that must be disclosed to meet the requirements of the federal Food and Drug Administration (FDA).”

“The Certificate does not stop you or a member of our family from voluntarily disclosing to any person information about yourself or your involvement in the study.  If you give your written consent to release study information to an insurer, employer or other person, the Certificate cannot be used to withhold this information.” 

If applicable:
“If any study information is placed into your medical records, the Certificate does not protect that study information.”

If applicable:
“If the researchers become aware of possible child abuse or elder abuse, or that you may cause serious harm to yourself or others, the researchers may report this to the appropriate authorities without your consent.” 

If applicable:
“If the research shows that you have a reportable communicable disease (for example, tuberculosis [TB] or HIV/AIDS), the researchers may report this to state and/or federal public health authorities without your consent.”    

UMass Amherst IRB Review and Certificates of Confidentiality

Please note on your IRB application that you are applying for a Certificate of Confidentiality. Approval of the application will be contingent on receipt of the Certificate of Confidentiality.

UMass-Amherst researchers must submit a copy of their Certificate of Confidentiality to the UMass-Amherst IRB within ten (10) working days of receipt.

UMass Amherst Institutional Official Signature

The NIH requires that both the Principal Investigator and the UMass-Amherst Institutional Official sign the assurances requested in the application for a Certificate of Confidentiality.

In order to obtain a signature from the UMass-Amherst Institutional Official, please forward your completed application to:

  • Assistant Vice Chancellor for Research and Engagement, Compliance and Research Support Services, Jennifer A. Donais

Phone: (413) 545-5896

Address: 101 University Drive Suite C5, Amherst MA 01002

More Information on Certificates of Confidentiality

Additional Research on Certificates of Confidentiality:

Check et. al 2014. “Certificates of confidentiality and informed consent: perspectives of IRB chairs and institutional legal counsel,” IRB Ethics and Human Research 36(1):1-8.

Wolf et. al 2012. “Certificates of Confidentiality: Legal Counsels’ Experiences with and Perspectives on Legal Demands for Research Data,” Journal of Empirical Research on Human Research Ethics 7(4): 1-9.

Wolf et. al 2013. “Certificates of Confidentiality: Protecting Human Subject Research Data in Law and Practice,” Minnesota Journal of Law, Science & Technology 14(1): 11-87.

[i] http://grants.nih.gov/grants/policy/coc/faqs.htm#365

[ii] Ibid.