Certificates of Confidentiality

Notice of Changes to NIH Policy for Issuing Certificates of Confidentiality

Effective October 1, 2017, all research that is funded wholly or in part by the NIH and collects or uses identifiable, sensitive information is deemed to be issued a Certificate of Confidentiality (CoC), and is therefore required to protect the privacy of individuals who are subjects of such research in accordance with subsection 301(d) of the Public Health Service Act. This change is retroactive to December 13, 2016.

For more information, please see 

Am I affected?

  • If you have a NIH-funded or supported project that was started or ongoing on or after December 13, 2016, your project may now be covered by a CoC, even if you did not apply for one. See the link above to determine if your project is within the scope of this policy.

What do I need to do if I am affected?

  • You will need to comply with the requirements in 301(d) of the Public Health Service Act (see the link above for more information).
  • You will need to make sure those you share information with know the requirements. Recipients of Certificates are required to ensure that any subrecipients as well as any investigator or institution not funded by NIH who receives a copy of identifiable, sensitive information protected by a CoC, understand they are also subject to the requirements of subsection 301(d) of the Public Health Service Act. 
  • For studies in which informed consent is sought, NIH expects investigators to inform research participants of the protections and the limits to protections provided by a CoC. For studies where enrollment is ongoing, this means an amendment will be needed to add the required CoC language to the consent form (generally, this can occur at your next continuing review or the next time you need to amend the consent form for other reasons). You should also amend the form to eliminate provisions that may be inconsistent with the new CoC protections. If research subjects are no longer actively participating in the project, then an amendment to the informed consent process may be impractical: contact the IRB office for guidance.

Additional guidance and changes to the AURA application are in development; please contact the SBS IRB office (sbs-irb@uchicago.edu) with questions.

Resources: