Certificate of Confidentiality Application Instructions

The CDC Office of Scientific Regulatory Services (OSRS) handles the review and issuance of Certificates of Confidentiality (CoC) for research grants funded by CDC or ATSDR.

Steps:

1. Applicant contacts OSRS to ensure that a CoC is needed and for guidance prior to submitting application (at 404-639-4642 or cdccoc@cdc.gov).
   
   
2. Applicant submits draft application to OSRS (by email to cdccoc@cdc.gov).
   
   
3. OSRS reviews draft and works with applicant to finalize.
   
   
4. Applicant submits the final application on institutional letterhead with PI (and any Co-PI) signatures. Final applications should be submitted as follows:
   
   

   Original Application by Courier:
   Certificate of Confidentiality
   Office of Scientific Regulatory Services
   Centers for Disease Control and Prevention
   1600 Clifton Rd., MS D-74
   Atlanta, GA 30333
   
   Email Copy of Application (include all items) to:
   cdccoc@cdc.gov
   
   

5. Application is reviewed by the CDC Confidentiality Review Group (comprised of senior scientists, managers, and general counsel). The review process takes approximately three to six months before a CoC is issued.

Note: To request a CoC for research dealing only with drug abuse, alcoholism, or alcohol abuse, contact NIH for guidance. A list of NIH CoC contacts can be found at http://grants.nih.gov/grants/policy/coc/contacts.htm.

The following items must be included in the application:

1. Application letter.
   
   
2. IRB protocol submitted and approved by IRB(s).
   
   
3. Questionnaire or data collection forms (submit draft if not finalized).
   
   
4. Introductory letter to participants (if there is one).
   
   
5. Consent forms approved by local and/or CDC IRB(s).
   
   
6. Copy of IRB approval letter(s) (include local IRB and CDC IRB, if CDC IRB approval is required).
   
   
7. One page research summary.
   
   

Note: If a consolidated application is being done for a number of sites conducting the same project, the application should come from either the CDC/ATSDR project officer/program official or the PI/project director at the lead site. Corollary letters requesting coverage by the CoC from each of the sites collecting identifiable data should also be submitted. Language for those letters will be provided when the application is finalized

An application submitted to CDC using NIH instructions is not acceptable.

References to review prior to submitting an application:

Notifiable Disease Reporting with Confidentiality Certificates

Certificate of Confidentiality - Interim Guidance
(For CDC CoC, the applicant should not prepare the text of the certificate despite instructions in the Interim Policy Statement. CDC OSRS will prepare the certificate. Also, note implementing regulations have not been developed.)

Content of Application Letter:

I.		Address Certificate of Confidentiality Office of Scientific Regulatory Services Centers for Disease Control and Prevention 1600 Clifton Rd., MS D-74 Atlanta, GA 30333
II.		Principal Investigator and Co-PI (if applicable) Contact Information Name(s) Institutional affiliation(s) Complete mailing address(es) Telephone number(s) Fax numbers(s) Email address(es)
	a.	Name of Project If the project name on the IRB form is different from the name given here, the applicant must document that the IRB approval pertains to this project.
	b.	Retention Time Information Will Be Kept in Identifiable Form Address retention time information will be kept in identifiable form. Note: Often id numbers or codes are used, but generally a list linking names with id numbers must be maintained. If this is the case, identify those who will have access to this link.
	c.	Source of Funding List the Center, Institute, or Office within CDC, or Division within ATSDR providing the funding. Include the funding mechanism (grant, cooperative agreement, contract/task order), award number, and the name and telephone number of the CDC/ATSDR Project Officer, Program Official, or Project Coordinator.
	d.	Indicate When Data Collection is Expected to Begin and How Long it Will Continue The certificate must be written to last as long as data collection is expected to continue. CDC issues certificates for five years. Certificates may be extended after five years, if identifiable data is still being collected.
	e.	Purpose of the Project This will be included in the formal purpose statement within the certificate. It should be limited to one or two clear sentences.
	f.	Description of the Project: This section should be at least 3-4 paragraphs in length. Describe: 1) what the study is attempting to learn; incorporate the Purpose stated above, but expand; 2) the Method (e.g., "Five hundred women attending STD clinics will be recruited to participate, and half will receive educational interventions to increase their awareness of..."); and 3) how the subjects will be identified.
	g.	Sensitive Information Describe in detail the sensitive information that is to be collected. Sensitive information includes: Sexual attitudes, preferences, or practices; use of alcohol, drugs, other addictive products; illegal conduct; an individual's psychological mental health; genetic information; information that if released could reasonably be damaging to an individual's financial standing, employability, or reputation; information normally recorded in a medical record, the disclosure of which could lead to social stigmatization.
	h.	Safeguarding Measures Describe the safeguarding measures that will be in place to protect the data (e.g., locked cabinets, encryption of data, linking information stored in a different location from other data, access limited to small number of research staff).
	i.	Address the Effect Upon Respondents if the Project Does Not Have Confidentiality Protection Example: Individuals may not be willing to participate or may provide inaccurate information.
	j.	Describe the Instances in Which Researchers Might be Called upon to use the Confidentiality Certificate to Withhold Data Example: Participants are on parole and their parole officers could subpoena information on illegal activities, such as drug use.
	k.	Address Testing for Reportable Communicable Diseases. If reportable disease testing is not being done, state: "The project does not involve testing for communicable diseases." If project is conducting testing, briefly describe the testing being conducted, and address how the project intends to comply with policies set out in the Notifiable Disease Reporting with Confidentiality Certificates memorandum.
	l.	Indicate the Project’s Compliance with Protection of Human Subjects Regulation (45 CFR Part 46) State specifically that the project has been reviewed by an Institutional Review Board (IRB) or IRBs. For each IRB approval, list the name of the IRB, the dates of the approval period, and the site of the research. Address if CDC IRB review is needed. If IRB approval has not yet been obtained, indicate the date of submission, whether any IRB report has been received, etc. Note: CDC IRB approval is not required for grants. It may be required for cooperative agreements.
	m.	Agreement to Add CDC’s Preferred Confidentiality Advisement Language to Consent Documents [Include the following 2 paragraphs verbatim to indicate your agreement.] The principal researcher(s) at each site involved in the collection of individually identified data for the project have agreed to add CDC’s preferred confidentiality advisement language (below) to consent documents when the Certificate approval has been obtained, and to return revised consent forms to their IRB(s) for approval: "All answers that you give will be kept private. This is so because this study has been given a Certificate of Confidentiality. This means anything you tell us will not have to be given out to anyone, even if a court orders us to do so, unless you say it’s okay. But under the law, we must report to the state suspected cases of child abuse or if you tell us you are planning to cause serious harm to yourself or others."
	n.	Assurances from persons requesting authorization of 301(d) protection [End all applications with the following assurances and provide space for each person requesting authorization of 301(d) protection (PI and Co-PIs if applicable) to provide their signature and date below the assurances] I assure: (1) that personnel involved in the conduct of the research will comply with all the requirements of 45 CFR Part 46 "Protection of Human Subjects" (Non-DHHS-supported projects must comply with 45 CFR 46 103 (c) and document legally informed consent in a manner consistent with the principles stated in 45 CFR 46); (2) that the Certificate of Confidentiality will not be represented as an endorsement of the project by the DHHS Secretary or used to coerce individuals to participate in the research project; (3) that the recipient of the Confidentiality Certificate will use the vested authority to protect the identity of research subjects; (4) that all subjects be informed that a certificate has been issued and that subjects will be provided with a description of the protection covered by the certificate; and (5) that subjects who enter the project after termination of the certificate will be informed of the termination.
Certificate of Confidentiality Requested by: ______________________________      __________________ (Signature)      (Date) XXXXXXXXXXX Principal Investigator ______________________________      __________________ (Signature)      (Date) XXXXXXXXXXX Co-Principal Investigator