| |
Substance Abuse and Mental Health Services Administration
Certificate of Confidentiality Information (updated March 2005)
A Certificate of Confidentiality (CC) protects Principal
Investigators (PIs) and Lead Evaluators (LEs) and their contractors and
cooperating agencies from having to comply with government requests (including
subpoenas, court orders, and State reporting laws) for names or other
information that would identify the participants in the evaluation of the
grant/project/contract. Requests for a Certificate should be sent to Peggy
Riccio, SAMHSA CC Coordinator, SAMHSA, Room 8-1106, 1 Choke Cherry Road,
Rockville, MD 20857(use zip code 20850 if using UPS/DHL/FedEx delivery). Phone
number is (240) 276-2315 and e-mail address is
peggy.riccio@samhsa.hhs.gov
. There is no fee but SAMHSA only issues
Certificates to its grantees and contractors. Requesters who do not have SAMHSA
funding should contact the National Institutes of Health.
The principal investigator/lead evaluator (PI/LE) of the
evaluation component of a grant or contract can apply for a Certificate of
Confidentiality. The PI/LE should
apply after the project is entirely planned and the final consent form is
written. She/he would have to
apply again if the consent form or anything else substantial changed, since by
signing the application, he/she is legally affirming the applicant's
description of the study. That is,
the consent form and procedures of the actual study have to be what is
described in the application.
In order to expedite the process, Peggy Riccio will read the
consent forms before Institutional Review Board (IRB) approval is obtained or
before a formal request for a Certificate is sent to SAMHSA to ensure the
required Certificate language is stated properly. Note that in order to obtain
a Certificate, the project and consent forms have to be approved by an
Institutional Review Board (IRB).
The coverage afforded by the Certificate begins before the
PI/LE actually receives the paper copy in the mail. The coverage starts on the
date the application (including consent forms) is complete and complies with
the Federal regulations and SAMHSA's policies.
Once the PI/LE has a Certificate, the coverage is retroactive to the
start of the study and continues forever.
Participants on the rolls or in the data are covered, even if they are no
longer active.
A request for a Certificate consists of: 1) a cover letter
from the PI/LE on stationery, 2) the consent/assent forms, 3) a letter from the
IRB on IRB stationery indicating approval of the project and forms, and 4) the
biosketch or curriculum vitae of the requester (if the information about that
person is not in the cover letter). If there are multiple IRBs, then the
request must contain a letter of approval from the IRB of every institution
involved in the project. Each institution must have filed an Assurance with the
Office for Human Research Protections (OHRP). Note for new filings, a
Federalwide Assurance is the only acceptable format. Other types currently in
existence--Single Project Assurance (SPA), Multiple Project Assurance (MPA),
and Cooperative Project Assurance (CPA)--are being phased out by the end of
calendar year 2005. Contact OHRP directly for more information at
http://www.hhs.gov/ohrp
The goal is to comply with the regulations so the Certificate
can survive any legal challenge. The cover letter must provide the following
information in the same order. SAMHSA asks for all of the assurances below to
be stated in the cover letter, but only those that are relevant to the project
must be reflected in the consent forms or other information that is given to
project participants. An example of a request for a Certificate appears at the
end of these instructions.
a) Name, address,
e-mail, and phone number of person primarily responsible for the conduct of the
evaluation, and of the sponsor or institution with which that person is
affiliated. Name and contract or grant ID number of the project.
b) Location of
the study sites for the project and description of the facilities available for
the evaluation as well as treatment or services to be provided, including the
name and address of any hospital, institution, or other facility to be used in
connection with the project.
c) Summary of the scientific or other appropriate training and
experience of the PI/LE (a resume, curriculum vitae, or biosketch will
suffice).
d) An outline or
summary of the evaluation protocols, including a concise statement of the
rationale and purpose of the evaluation project and the general methods to be
used. Ideally, these should include summaries of criteria and procedures for
subject selection, study variables, procedures for data collection and
analysis, any treatment/intervention provided, and the informed consent
procedure. Also include the number of participants per year for the number of
years of the grant period so there is a sense of annual number of participants
multiplied by the number of years in the grant period.
e) Start date and
estimated end date for the project.
f) Specific
request (e.g., "I request authority to withhold..."), signed by the individual
primarily responsible for the conduct of the evaluation, for authority to
withhold the names and other identifying characteristics of program
participants, and the reasons supporting that request.
g) through k) are assurances that each applicant must provide.
The application might say: "As
principal investigator or lead evaluator, I assure you of the following:
g) that my
colleagues and I will comply with all the requirements of 45 CFR 46,
"Protection of Human Subjects" and its standards for informed consent
h) that the CC
will not be presented as endorsement of the project by the Secretary,
Department of Health and Human Services (DHHS), or used to coerce or pressure
subjects to participate
i) that the
Certificate will be used by all those covered by it, to refuse to disclose
identifying characteristics of evaluation subjects in any Federal, State, or
local civil, criminal, administrative, legislative, or other proceedings to
compel disclosure of the identifying characteristics of evaluation subjects
j) that all
evaluation participants under the CC will be informed that:
1) A CC has been
issued
2) The persons
authorized by the Certificate to protect the identity of the evaluation
subjects may not be compelled to identify the subjects in any civil, criminal,
administrative, legislative, or other proceedings, whether State, Federal, or
local
LIMITATIONS
3) Under any of
the following conditions, the CC does NOT authorize any person to refuse to
reveal identifying information concerning evaluation subjects:
i. If the
subject (or guardian) consents in writing to disclosure of identifying
information
ii. If release is
required by the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301) or
regulations thereunder (21 CFR)
iii. If authorized DHHS personnel request identifying
information for audit or program evaluation of a project funded by DHHS or for
investigation of DHHS grantees or contractors
4) The
Certificate does not prevent voluntary disclosure of identifying information
5) The
Certificate does not represent endorsement of the project by the Secretary,
DHHS
k) that
all evaluation subjects entering the study after termination of the Certificate
will be told the protections do not apply to them
GENERAL INFORMATION ABOUT CONFIDENTIALITY CERTIFICATES
CCs
are issued under the authority vested in the Secretary, DHHS, by section 301(d)
of the Public Health Service Act, 42 U.S.C. 241(d), as amended.
A CC authorizes "persons engaged in research on mental health, including
research on the use and effect of alcohol and other psychoactive drugs, to
protect the privacy of individuals who are the subject of such research by
withholding from all persons not directly connected with the conduct of such
research the names or other identifying characteristics of such individuals.
Persons so authorized to protect the privacy of such individuals may not
be compelled in any Federal, State, or local civil, criminal, administrative,
legislative, or other proceedings to identify such individuals."
The
regulations appear in 42 CFR Part 2a. In these regulations, "research" is
defined as a "systematic study directed toward new or fuller knowledge and
understanding of the subject studied. The term includes, but is not limited to,
behavioral science studies, surveys, evaluation, and clinical investigations."
For a copy of 42 CFR Part 2a, see
http://www.access.gpo.gov/nara/cfr/waisidx_00/42cfr2a_00.html
The
CC protects the PI/LE from having to comply with subpoenas and court orders.
It does not require that the PI/LE protects the information, but it
enables them to and is most often used when questions of a sensitive nature are
asked. SAMHSA understands the need to protect the identity of the participants
in its projects and the issuance of Confidentiality Certificates pursues this
goal. CCs were tested successfully in court soon after they were enacted (People
v. Newman, 32 N.Y.2d 379, 298 N.E.2d 651, 345 N.Y.S.2d 502 (1973), cert.
denied, 414 U.S. 1163 (1973)).
A
CC applies to the evaluation component of a grant, not the services or
treatment portion, which is covered by another regulation.
A CC applies to one project or one grant; a separate application is
required for each project. The SAMHSA CCs cannot be used for
research/evaluations requiring an U.S. Food and Drug Administration (FDA)
Investigational New Drug (IND) or Investigational Device Exemption (IDE), or
research/evaluations related to law enforcement activities within the purview
of 502 (c) of the Controlled Substances Act and 21 CFR 1316.21.
The FDA must issue CCs for projects with INDs or IDEs.
If
an IRB approves every aspect of a project except the project's lack of a CC,
then SAMHSA can proceed as if the project had IRB approval if there is a letter
from the IRB that approval is contingent upon receipt of a CC.
If
a project has a lead entity such as a coordinating center, and a number of
study sites, the coordinating center may get one CC for the entire project,
which would protect itself and all of its contractors and other cooperating
agencies involved in the project. Consent
forms and IRB approval letters from all sites must be included in the
application.
CONSENT FORMS
A
consent form that leads to genuine and realistic informed consent is a key
element of adequate participant protection.
A consent form should truly inform readers, in language they understand. In
some cases, consent forms should be read out loud or translated into another
language. If questions about drug
use, mental health or substance abuse treatment, sexual activity, or any other
sensitive issue will be asked, this should be explicit in the consent form.
Where
risks are discussed, the risk of confidentiality breach should be mentioned for
participants to consider. Many
consent forms follow this statement of confidentiality risk with information
about how confidentiality is being protected, to reassure prospective
participants. Some do not talk
directly about confidentiality risk, but say in the risk section something
like, "The risk of participating in this study is expected to be minimal
because we have taken steps to protect your privacy," or other words to this
effect. The point is to have
people include confidentiality issues as they mull over the risks.
Consent
forms should not over-promise the degree of protection or be vague or
misleading. For example, stating
that "Participant information will be kept in strictest confidence" is vague
and false since DHHS can audit and the PI/LE will be reporting suspected cases
of child abuse/neglect; harm to self and others, and communicable diseases (if
testing for it). Thus, the statement "Only researchers will have access to your
data" is false.
It
is better to tell people about the specific steps that have been taken to
protect participants' confidentiality, such as training staff to keep
information private, keeping the code file locked away or encrypted, and
obtaining a Certificate. Examples
of privacy statements that do not mislead the participants are: "The privacy of
the information we collect about you will be very carefully protected," or, "We
are committed to protecting your privacy," or, "We have taken steps to protect
your privacy."
The
consent forms must contain specific Certificate information required by the
regulations and mentioned in the assurances. The consent forms should not have
statements that contradict the Certificate language. Although a PI/LE who has a
Certificate is not obligated under the regulations to do so, it is SAMHSA
policy that the person reports communicable diseases voluntarily as if they
were obeying State laws (only in cases where participants are being tested for
diseases; most SAMHSA projects do not do this).
Likewise, although a PI/LE who has a Certificate is not obligated to do
so, it is SAMHSA policy that suspected cases of child abuse and neglect are
still reported to the proper local authorities. Therefore, the person will
agree to voluntarily report these cases as if they were following State law and
it is most important that parents and children understand this exception to
confidentiality. Similarly, although a PI/LE who has a Certificate is not
obligated to do so, he/she should voluntarily report to the proper authorities
if there is danger that a participant will harm him-/herself or others. So in
addition to DHHS audits, there are three cases in which the Certificate does
not ensure confidentiality: suspected cases of child abuse/neglect; harm to
self and others; and communicable diseases.
The
PI/LE must notify participants in the consent forms in advance about any
reporting they will do and to whom they will report. Conforming to State law in
terms of reporting may be the simplest way to do this; however, it must be made
clear in the consent forms that the PI/LE is doing this voluntarily since the
Certificate actually protects a PI/LE from having to comply with State
reporting laws. To ensure the
Certificate stands up in court, the consent form must not say that the PI/LE
will obey the law or State law or will do something in accordance with State
law. For example, the consent form
should not say: "We are required to report...." or
"We will keep your information confidential except as required by law."
Consent
forms may leave out what is not germane. If a project does not fall within the
purview of the FDC Act, then SAMHSA does not ask that consent forms include
information about the Certificate limitation regarding the FDC Act, even though
the PI/LE would have signed all the assurances, including the one about the FDC
Act.
Consent
forms differ, but the following are examples of consent-form language
about CCs that have been formally approved as suitable for some
projects:
a)
Two informal, short versions that can be used are:
1)
We have [applied for] a Confidentiality Certificate (CC) from the U.S.
Department of Health and Human Services (DHHS) to protect the researchers from
being forced to identify you (for example, by court order or subpoena).
The Certificate adds special protection for research information
about you. We may voluntarily
report medical information in medical necessity, likely harm to yourself or
others, including child abuse/neglect, however, and DHHS may see your
information if it audits us. This
CC does not imply DHHS approval or disapproval. [Communicable
disease reporting and any other exceptions should be included]
2)
We have also obtained [applied for] a Confidentiality Certificate (CC)
from the U.S. Department of Health and Human Services (DHHS) to protect the
researchers from being forced, even by court order or subpoena, to identify
you. (The CC does not imply
approval or disapproval of the project by the Secretary of DHHS.
It adds special protection for the research information about
you.) You should know, however,
that we may provide information to appropriate individuals or agencies if harm
to you, harm to others, or child abuse/neglect becomes a concern.
In addition, the federal agency funding this research may see your
information if it audits us. [Communicable
disease reporting and any other exceptions should be included]
b)
A longer, formal version is:
To
help keep information about you confidential, we have obtained [applied for] a
Confidentiality Certificate from the U.S. Department of Health and Human
Services (DHHS). This Certificate
adds special protection for the research information about you.
This Certificate does not imply that the Secretary, DHHS, approves or
disapproves of the project. The
Confidentiality Certificate will protect the investigators from being forced,
even under a court order or subpoena, to release information that could
identify you. We may release identifying information in some circumstances,
however. For example, we may
disclose medical information in cases of medical necessity, or take steps
(including notifying authorities) to protect you or someone else from serious
harm, including child abuse/neglect. Also, because this research is sponsored
by DHHS, staff from DHHS may review records that identify you during an audit.
[and any other exceptions (e.g., communicable disease reporting if you
test for a communicable disease) should be included as steps the researchers
may take voluntarily]
EXTENSIONS and AMENDMENTS OF CERTIFICATES
CC
protection is permanent with regard to subjects who participated (even by being
on its rolls) in a covered study while the CC was in effect.
CC protections do not extend, however, to participants who join a
project after the CC has expired.
To obtain a CC extension, the PI/LE on the current CC needs to send to SAMHSA a
signed request for an extension, ideally before expiration, with the proposed
new expiration date, the justification for the extension, a copy of the current
IRB approval, a copy of the current consent form, a copy of the expiring CC,
and a statement that the project has not changed in any significant way since
the original CC was issued. That
is, the primary staff, consent form, scope and direction, instruments, and
other significant features must be the same as when the Certificate was issued.
CC
protections also do not extend to a project that changes significantly from its
description in the original CC application.
If the PI/LE, the consent form, scope and direction, instruments, or other
significant features of a project change, the PI/LE should notify SAMHSA.
If the consent form changes, it is helpful to send both old and new
forms. If the changes are
judged significant--if they increase risks to participants--the regulations
require a full new application. SAMHSA also needs a copy of the original CC.
If the changes do not affect risk to participants, the PI/LE will be
notified that his/her CC remains in effect with the project changed as
described.
EXAMPLE OF AN APPLICATION FOR A CERTIFICATE OF CONFIDENTIALITY
March xx, 200x
Ms.
Peggy Riccio
SAMHSA CC Coordinator
SAMHSA
Room 8-1106
1 Choke Cherry Road
Rockville,
MD
20857
Dear
Ms. Riccio:
I
am writing to request a confidentiality certificate for the project described
below.
a)
Principal Investigator's or Lead Evaluator's name, address, phone number and
e-mail:
John
Doe, Ph.D., Director of Studies, Services Research Institute, Suite 400, 3300
Dupont Avenue, Fremont, MD 20999.
I can be reached at 301-123-4567 (voice), 301-123-8910 (fax),
jdoe@SRI.org. My study is CSAT grant no. TI01234, "Evaluation of
Project HEALTH." Our project
officer at SAMHSA is Ken Ncadi.
b)
Location and description of study sites:
The
study sites are residential substance abuse treatment facilities in three
Oklahoma
counties. Treatment will be
provided and all interviews will be conducted at these sites.
Data analysis is housed at Services Research Institute. The project
sites are as follows: [List names
and addresses of any hospital, institution, or other facility to be used in
connection with the evaluation. The
cooperating agencies also are covered by the CC and should be identified in the
application.]
c)
Information about PI/LE(s):
Resumes
or brief summaries, including names and addresses, of the scientific or other
appropriate training and experience--of all personnel having major
responsibilities in the evaluation project, and the training and experience
requirements for major positions not yet filled.
The resume or summary of the PI/LE is sufficient.
d)
An outline or summary of the evaluation protocols
1.
[This should be a short, clear statement of the purpose of the evaluation
project and the general methods to be used. This should include criteria and
procedures for subject selection, study variables, procedures for data
collection and analysis, any treatment/intervention provided, and the informed
consent procedure. Include the number of participants per year for the number
of years of the grant period so there is a sense of annual number of
participants multiplied by the number of years in the grant period.
2.
[In addition, please include a separate, very short statement summarizing the
purpose of the evaluation and the other key characteristics in one or two
paragraphs, such as the following:]
The
purpose of the study is to evaluate the effectiveness of ... and .... by
comparing their outcomes over a period of .... years.
Using a pre/post research design, the researchers will conduct baseline
and three follow-up interviews, at 3, 6, and 12 months after discharge.
We will also use information from ..... and administer urine tests.
A total of 200 adult clients and their children are expected to
participate annually for a total of xxx over the x-year grant.
Some of the data will be used in a cross-site study.
3.
My project has the following plans for [briefly describe the plans for
handling the following]
A)
reporting suspected child abuse: [e.g., We plan to report to local authorities.
]
B)
reporting communicable diseases we test for--[e.g., We plan to report to state
public health officers, or, We are not testing for a communicable disease.]
C)
reporting harm to self or others: [e.g., We plan to report to participant's
physician. ]
D)
dealing with pregnant substance abusers: [e.g., We plan to test for pregnancy
and to provide counseling or referral to local substance abuse treatment
providers or physicians as appropriate.]
E)
other reporting we plan to do:
e)
Start date and estimated end date for the project:
The
project began 10/1/97 and will end 9/30/2000.
We expect to begin recruiting participants by 12/1/97, and we will/will not
wait until our CC is in place. [The
CC coverage does not start until the CC becomes effective, but once a person
has a Certificate, the Certificate covers anyone who is in the study while the
CC is in effect, for the entire study, including the time before the person
received the CC. So if the PI/LE
recruits before CC protection begins, information obtained from the
participants before the CC date will be protected by the CC for people who are
participating (e.g., on the rolls) during the CC coverage period.]
f)
Signed specific request with reasons:
I
request authority to withhold the names and other identifying characteristics
of the participants in my study, "Evaluation of Project HEALTH."
My reasons for this request are that I am collecting sensitive substance
abuse and mental health data, and the CC will protect my participants' privacy
and help me recruit participants. [The
reasons for wanting authority to protect the participants should very briefly
be summarized here. This should
include how the Certificate will benefit participants in the project.]
____[signature]__________
John Doe, Ph.D., PI
____[signature]_______
Institutional
Official [the authorized institutional official is the individual named by the
applicant origination who is authorized to act for that organization and
assumes on behalf of the institution the obligation imposed by assurances as
well as obligations imposed by Federal law, regulations, and requirements and
other conditions that may apply to grant application and awards]
g)
- k) Assurances:
I
assure you of the following:
g)
that my colleagues and I will comply with all the requirements of 45 CFR
46, "Protection of Human Subjects" and its standards for informed consent;
h)
that the CC will not be presented as endorsement of the research by the
Secretary, DHHS, or used to coerce or pressure subjects to participate;
I)
that the Certificate will be used by all those covered by it, to refuse
to disclose identifying characteristics of research subjects in any Federal,
State, or local civil, criminal, administrative, legislative, or other
proceedings to compel disclosure of the identifying characteristics of research
subjects;
j)
that all research participants under the CC will be informed that:
1)
A CC has been issued
2)
The persons authorized by the Certificate to protect the identity of
research subjects may not be compelled to identify research subjects in any
civil, criminal, administrative, legislative, or other proceedings, whether
State, Federal, or local
LIMITATIONS
3)
Under any of the following conditions, the CC does NOT authorize any
person to refuse to reveal identifying information concerning research
subjects:
i.
If the subject (or guardian) consents in writing to disclosure of
identifying information
ii.
If release is required by the Federal Food, Drug, and Cosmetic Act (21
U.S.C. 301) or regs thereunder (21 CFR)
iii.
If authorized DHHS personnel request identifying information for audit or
program evaluation of a research project funded by DHHS or for investigation of
DHHS grantees or contractors
4)
The Certificate does not prevent voluntary disclosure of identifying
information
5)
The Certificate does not represent an endorsement of the research by the
Secretary, DHHS;
k)
that all research subjects entering the study after termination of the
Certificate will be told the protections do not apply to them.
[SAMHSA
asks for all of these assurances, but only those that are relevant to the
project must be reflected in the consent forms or other information given to
project participants.]
I
include copies of the notice of final approval from all IRBs [or the only IRB]
that must approve our project and of every [or the only] consent form that will
be used in the project.
The
Assurance Number(s) on file with the Office for Human Research Protections for
these IRBs is (are) as follows:
Services
Research Institute (applicant)--FWA 000000012
Health
Services, Inc. (Study site)--FWA00000034.
I
understand that if this project is not completed by the expiration date I can
request an extension of the Certificate (preferably prior to the expiration
date) by sending SAMHSA my reasons for the extension, a copy of the most recent
IRB approval, the new expiration date, copies of current consent forms, a copy
of the original CC, and a statement that the project has not changed in any
significant way since the original CC was issued.
I
understand that if the project changes in any significant way (if there are
modifications to the consent form, protocols, key personnel, or other
significant elements of the project), regulations require me to notify SAMHSA
of the changes before the changes are implemented.
Sincerely
yours,
John
Doe, Ph.D.
Principal Investigator
Back to Top
 |
