Certificate of Confidentiality

Certificates of Confidentiality are issued by the National Institutes of Health (NIH) to protect the privacy of research subjects by protecting investigators and institutions from being compelled to release information that could be used to identify subjects with a research project. Certificates of Confidentiality are issued to institutions or universities where the research is conducted. They allow the investigator and others who have access to research records to refuse to disclose identifying information in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level.

Identifying information is broadly defined as any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

Certificates can be used for biomedical, behavioral, clinical or other types of research that is sensitive. By sensitive, we mean that disclosure of identifying information could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation.

Examples of sensitive research activities include but are not limited to the following:

  • Collecting genetic information;
  • Collecting information on psychological well-being of subjects;
  • Collecting information on subjects' sexual attitudes, preferences or practices;
  • Collecting data on substance abuse or other illegal risk behaviors;
  • Studies where subjects may be involved in litigation related to exposures under study (e.g., breast implants, environmental or occupational exposures).

Federal funding is not a prerequisite for securing a CoC; however, CoCs are issued automatically for any NIH-funded projects using identifiable, sensitive information.

Certificates are retroactive; data collected prior to the issue of the CoC are protected.

Agencies issuing the CoCs may require specific language within the approved protocol and consent processes. If this language is not already in the protocol, an IRB amendment should be submitted to add this language.

CoC requests include a Certificate of Confidentiality Assurance signed by the principal investigators and a Duke University institutional official. The Campus IRB office will secure the signature of the Duke institutional official.

For more information, visit the NIH page for Certificates of Confidentiality.