Updated: March 15, 2002

Applicants should read NIH's background information and instructions on Certificates of Confidentiality, which are available at http://grants.nih.gov/grants/policy/coc/background.htm. See also Frequently Asked Questions http://grants.nih.gov/grants/policy/coc/faqs.htm.

The Food and Drug Administration handles requests for Certificate of Confidentiality protection for studies that obtain an Investigational New Drug (IND)authorization or other FDA authorization. Projects with INDs or IDEs should apply to the FDA (Leslie Vaccari, Project Management Officer, Division of Scientific Investigations, HFD-45 Office of Compliance Center for Drug Evaluation and Research, Leslie.vaccari@fda.hhs.gov, 240-276-8809 OR Patricia Holobaugh, Bioresearch Monitoring Branch, HFM-664, Center for Biologics Evaluation and Research, patricia.holobaugh@fda.hhs.gov, 301-827-6347).

The application should be written on the letterhead of the research applicant institution and submitted to the appropriate NIH Institute or Center (NIH IC). For a list of NIH Certificate contacts, see http://grants.nih.gov/grants/policy/coc/contacts.htm. The application letter should include the following information.

1. Name and address of applicant research institution. This is the institution with which the applicant is affiliated and the recipient of grant support for the research, if there is any.

2. Sites where the research will be conducted and a brief description of the facilities available for the conduct of the research. Please indicate if this is a multi-site project. The lead site of a multi-site project should apply for a single Certificate to protect participants enrolled at all sites. However, multi-site applicants must list each participating unit, its address, and project director. If any new sites are added after the certificate is issued, the lead site should provide NIH with an updated list and the cover letter should include a statement by the lead site that IRB approval has been given at the new site and that the lead site is maintaining a copy of that approval (see item 5(b) below.)

3. Title of the research project. If the project title on the IRB form (see item 5 below) is different from the title given here, the applicant must document that the IRB approval pertains to this project.

4. Source and number of the supporting grant, if applicable (e.g., National Institute of XYZ, NIH, 1 R01 XY 12345-01; ABC Foundation, Grant No. 123). If the NIH funds the project, please provide the name and telephone number of the Project Officer at the funding IC. If there is no support, type "None."

5(a). Requirement - A Certificate of Confidentiality will not be issued to an applicant conducting research involving human subjects unless the project has IRB approval. The approving IRB must be in compliance with applicable Federal requirements. If the applicant institution is receiving DHHS funding for research involving human subjects, an OHRP-approved IRB for that institution must approve the project for which a Certificate of Confidentiality is sought. For additional information on OHRP and IRB assurances, see http://www.hhs.gov/ohrp/assurances/assurances_index.html

If the applicant institution does not receive DHHS funding for this research involving human subjects but has an IRB that complies with the requirements for IRBs imposed by another Federal agency, that IRB must approve the research. If the applicant institution does not have an IRB, the project should be reviewed by an IRB in accordance with 45 CFR Part 46.

5(b). Documentation of IRB approval: Attach letter or form signed by an authorized IRB representative. Approval must be current and unconditional, or conditioned only upon the issuance of a Certificate of Confidentiality and documented by a letter or form signed by an authorized IRB representative. If this is a multi-site project, the lead site must maintain a copy of the IRB approval from each site, which must be made available to the NIH upon request.

5(c). Documentation of IRB qualifications: For all projects, submit for the IRB that reviewed the project the assurance number assigned by OHRP or documentation that the IRB complies with the applicable Federal regulations governing research involving human subjects. If this is a multi-site project, the lead site must maintain the OHRP assurance number for the reviewing IRB at each site, which must be made available to the NIH upon request.

6. Name, title, mailing and email addresses, telephone and fax numbers of the Applicant as well as name and title of other key personnel. Also include a brief summary of the scientific training of the Applicant and key personnel. If this is a multi-site project, only information from the lead site should be submitted to the NIH. However, the lead site must collect and maintain this information for each site and make it available to the NIH upon request.

7. Beginning date and expected end date of the project. The Certificate will state the date upon which it becomes effective and the date upon which it expires. A Certificate of Confidentiality protects all information identifiable to any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. The protection afforded by the Certificate is permanent. If this project is not completed by the expiration date, the Applicant must submit a written request for an extension three months prior to the expiration date. Any such request must include a brief description of the reason for the extension, documentation of the most recent IRB approval, and the expected date for completion of the research project.

8. Concise description of project aims and research methods (1-2 paragraphs, omit background). This section should include a brief description of procedures for the collection and storage of identifying information as well as the number of subjects to be included in the study, the source from which they will be recruited, and a description of the study population (e.g., gender, age, race, etc.) If significant changes are made to the project aims or methods during the course of the study, the Applicant should contact the Certificate Coordinator who issued the Certificate. That person will determine if the Certificate can be modified or if the Applicant will need to submit an amended application.

9. A description of means used to protect subjects' identities (i.e., subjects are coded by numbers not names, linking information is kept in locked files, identifiers will be destroyed when the study is completed, etc.)

10. Reasons for requesting a Certificate of Confidentiality (e.g., will collect sensitive information, identifying information on subjects, etc.) Include brief description of sensitive and identifying information to be collected.

11. Informed consent forms for human subjects, as approved by the IRB (attach copy). The informed consent form must include a description of the protections and limitations of the Certificate of Confidentiality, including the circumstances in which the investigators plan to disclose voluntarily identifying information about research participants (e.g., child abuse, harm to self or others, etc.) Sample language is provided below. If significant changes are made to the informed consent form, the Applicant should contact the Certificate Coordinator who issued the Certificate and submit a copy of the revised consent form. If this is a multi-site project, the lead site must indicate that it has on file a copy of the consent form as approved by the IRB from each site, which will be made available to the NIH upon request.

12. Research not funded by NIH in which drugs will be administered to human subjects must provide the following additional information:

• Identification of drugs to be administered;
• Description of methods for administration of these drugs, including a statement of dosages;
• Evidence that individuals who will receive the drugs are authorized to do so under applicable Federal and State law.

13. All research in which a controlled drug or drugs will be administered must submit a copy of the Drug Enforcement Administration Certificate of Registration (BND Form 223) under which the research project will be conducted.

14. If the research project is testing for reportable communicable diseases, the applicant must submit information relating to its compliance with State reporting laws as specified in the August 9, 1991 memorandum from the Assistant Secretary for Health (http://grants.nih.gov/grants/policy/coc/cd_policy.htm).

The following assurances are required and the following information should be inserted verbatim into the Certificate application letter. Both the PI and the Institutional Official must sign this letter. The name and title of the Institutional Official should be typed below the signature.

Informed Consent

When a researcher obtains a Certificate of Confidentiality, the research subjects must be told about the protections afforded by the certificate and any exceptions to that protection. That information should be included in the informed consent form. Examples of appropriate language follow. Researchers may adapt the language to the needs of the research participants and to the subject matter of the study. However, the language used must cover the basic points.

Researchers should also review the language about confidentiality and data security that is routinely included in consent forms to be certain that it is consistent with the protections of the Certificate of Confidentiality.

Example:

To help us protect your privacy, we have obtained a Certificate of Confidentiality from the National Institutes of Health. With this Certificate, the researchers cannot be forced to disclose information that may identify you, even by a court subpoena, in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings. The researchers will use the Certificate to resist any demands for information that would identify you, except as explained below.

The Certificate cannot be used to resist a demand for information from personnel of the United States Government that is used for auditing or evaluation of Federally funded projects or for information that must be disclosed in order to meet the requirements of the federal Food and Drug Administration (FDA).

You should understand that a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the researchers may not use the Certificate to withhold that information.

[The researchers should include language such as the following if they intend to make voluntary disclosure about things such as child abuse, intent to hurt self or others, or other voluntary disclosures.] The Certificate of Confidentiality does not prevent the researchers from disclosing voluntarily, without your consent, information that would identify you as a participant in the research project under the following circumstances. [The researchers should state here the conditions under which voluntary disclosure would be made. If no voluntary disclosures will be made, the researchers should so state.]