When is a CoC Appropriate?

Are There Limits To a CoC?

NIH-Funded
Research

 

Agency-Specific Funded Research

Other Funded/
UnfundedResearch

Consent
Process

Investigator Responsibilities

Brown’s Responsibilities

Regulations &
References

Overview

Certificate of Confidentiality (CoC): A CoC protects the confidentiality of research participants enrolled in biomedical, social, behavioral, clinical, or other types of research that collect or use identifiable, sensitive information. With limited exceptions, investigators may not disclose names or any information, documents or biospecimens containing identifiable, sensitive information.

A CoC allows investigators to refuse to disclose identifying information on research participants in civil, criminal, administrative, legislative, or other proceedings, whether federal, state, or local. The CoC prohibits disclosure in response to legal demands, such as a subpoena.

Covered Information: All names, documents, biospecimens, or any other information, containing identifiable, sensitive information related to a research participant protected by a CoC. In addition, if there is at least a very small risk that information, documents, or biospecimens can be combined with other available data sources to determine the identity of an individual, then they are also protected by the CoC.

By protecting investigators and Brown University from being compelled to disclose information that could identify research participants, CoCs help minimize risks to participants and add an extra level of protection for maintaining the confidentiality of private information.

A CoC is study-specific, non-transferrable, and lasts in perpetuity. However, if an investigator has funding and the study continues after funding ends, new information collected may not be protected.

When is a Coc Appropriate?

 

The Investigator, the funder, or the IRB/HRPP may determine that a CoC is necessary depending on the identifiable, sensitive information collected or used in the study and the potential impact it may have on participants should it be disclosed or confidentiality lost (e.g. potential damage to their financial standing, employability, insurability, or reputation).

Identifiable, Sensitive Information: Information about an individual, gathered or used during biomedical, behavioral, clinical or other research, through which there is at least a small risk that some combination of the information, a request for the information, and other available data sources could be used to determine the identity of an individual.

Examples of identifiable, sensitive information includes, but is not limited to name, address, social security or other identifying number, fingerprints, voiceprints, photographs, genetic information, tissue samples, or data fields that when used in combination with other information may lead to identification of an individual.

Are There Limits to a CoC?

Investigators are not prevented from disclosing certain information about research participants, such as child abuse or a participant’s threatened violence to self or others. However, if investigators intend to make such disclosures, they must clearly inform participants through the consent process.

A CoC does not protect participants when they voluntarily disclose identifying information about themselves. A participant must consent to a disclosure for it to be used as evidence in the legal process.

See “Investigator Responsibilities” below for more guidance.

National Institutes of Health (NIH)-Funded Research

All human subjects research studies receiving funding from the National Institutes of Health (NIH) – prime awardee or sub-recipient – that collect or use identifiable, sensitive information are automatically issued a CoC by the NIH as a term and condition of the award (i.e., 42 USC 241).  

Investigators will not need to request a CoC if they receive an NIH-sponsored award or sub-award for their study. Investigators will not receive a physical certificate.

The IRB/HRPP will assist investigators in making the appropriate determination as to whether the research they are conducting involves the collection or use of identifiable, sensitive information and is subject to the NIH CoC Policy and deemed to be issued a Certificate.

Agency-specific funded research

The following sponsors require that investigators contact them directly to apply for a CoC. The NIH will not issue a CoC for research studies funded by these agencies. Investigators must have IRB Approval or an Exempt Determination before requesting a CoC. Agency-specific contact information is available on the NIH website.

  • Agency for Healthcare Research & Quality (AHRQ)
  • Centers for Disease Control and Prevention (CDC)
  • Department of Justice (DOJ)
  • Food and Drug Administration (FDA) – For all studies operating under an IND or IDE.
  • Health Resources and Services Administration (HRSA)
  • Indian Health Service (IHS)
  • Substance Abuse and Mental Health Services Administration (SAMHSA)

If an agency requires application materials signed by Brown’s Institutional Official or the Brown IRB Chair, please e-mail the application materials to [email protected] for signature routing. Signed assurances are typically returned within 5 business days.

See “Regulations & References” below for more guidance.

All other funded research/unfunded research

If the research is funded by any other sponsor or is unfunded, investigators can request a CoC from the NIH by completing an application through the NIH’s Certificate of Confidentiality System.

IMPORTANT:

  • The study must have IRB Approval or an Exempt Determination before submitting the application request.
  • The investigator must complete the CoC request in one session. There is no save option to return and complete the application at a later time.

When submitting the application for verification, it will automatically route to Brown’s Human Research Protection Program for review by the Institutional Official (IO) and final submission.

When the CoC is approved, the Principal Investigator listed on the application and Brown’s IO will receive an e-mail confirmation from the NIH CoC Coordinator with a PDF copy of the CoC. Typically, the NIH processes CoC requests within one week after receiving the request.

Please use the information below when completing the CoC application:

Name of Institution:

  • Brown University

Institution Address:

  • Human Research Protection Program

350 Eddy Street

Box 1986

Providence, RI 02912

 

Name of Institutional Official:

  • Jill Pipher, Ph.D.

Email Address of Institutional Official:

Phone Number of Institutional Official:

  • (401) 863-3050

Consent Process
Consent process

Investigators must include CoC protection language in any consent process – written, online, or verbal.

Each agency may have their own sample language. Investigators should use the language provided by the agency that issued the CoC. The NIH sample consent language, and other additional consent language, which may be helpful are available on the HRPP Forms & Templates webpage.

Include CoC protection language in the Brown consent template sections listed below:

  • Brown’s Standard Consent Template – “How will my information be protected?”
  • Brown’s Bulleted Consent Template – “CONFIDENTIALITY”

Investigator Responsibilities

Investigators issued a CoC have several responsibilities and expectations:

  1. Inform Participants: If obtaining informed consent, investigators must inform participants about the protections afforded to them by the CoC and any exceptions to those protections.
  2. Inform Collaborating Investigators About CoC Protections:
    1. Incoming Data: If receiving identifiable, sensitive information or identifiable biospecimens from a collaborating investigator that is not covered by a CoC, Brown investigators must inform them that the information/biospecimens held by the collaborating investigator is protected by the new CoC issued to Brown and the collaborating investigator is equally subject to the CoC requirements.
    2. Outgoing Data: If sharing identifiable, sensitive information or identifiable biospecimens with a collaborating investigator already covered by a CoC, Brown investigators must inform the collaborating investigator that the information/biospecimens from Brown now being maintained by the collaborating investigator must be protected by the collaborator’s CoC and Brown’s shared data is equally subject to the CoC requirements.
  3. Data Confidentiality: Investigators must not disclose or share a participant’s identifiable, sensitive information, except under limited circumstances.
    1. No disclosure to any federal, state, or local civil, criminal, administrative, legislative, or other proceedings.
    2. No sharing of research data to any person not engaged in the research study and/or not approved by Brown’s IRB to obtain, use, study, or analyze.
    3. Limited circumstances may apply if:
      1. Required by other federal, state, or local laws, such as for public health reporting of communicable diseases, or child or elder abuse reporting;
      2. Voluntarily consented by the participant; or
      3. Necessary for the medical care and voluntarily consent of the participant.

In the event that an investigator may have to break the study’s CoC due to limited circumstances, the Human Research Protection Program must be notified immediately so the appropriate steps can be taken by the University.

Brown's Responsibilities

If an investigator is issued a CoC, Brown has several responsibilities and expectations:

  1. Uphold CoC Protections: Brown will protect participants’ identifiable, sensitive information from compelled disclosure, and support and defend the authority of the CoC against legal challenges.
  2. Inform Collaborating Institutions About CoC Protections:
    1. Incoming Data: If Brown receives identifiable, sensitive information or identifiable biospecimens from a collaborating institution that is not covered by a CoC, Brown must inform the collaborating institution. The information/biospecimens held by the collaborating institution is protected by the new CoC and the collaborating institution is equally subject to the CoC requirements.
    2. Outgoing Data: If Brown shares identifiable, sensitive information or identifiable biospecimens with a collaborating institution that is already covered by a CoC, Brown must inform the collaborating institution. The information/biospecimens now being maintained by the collaborating institution must be protected by the CoC and Brown’s shared data is equally subject to the CoC requirements.

regulations & References 

Brown University

U.S. Department of Health and Human Services (DHHS) Federal Regulations

U.S. DHHS – National Institutes of Health (NIH)