Certificates of Confidentiality

Notice of Changes to NIH Policy for Issuing Certificates of Confidentiality

Effective October 1, 2017, all research that is funded wholly or in part by the NIH and collects or uses identifiable, sensitive information is deemed to be issued a Certificate of Confidentiality (CoC), and is therefore required to protect the privacy of individuals who are subjects of such research in accordance with subsection 301(d) of the Public Health Service Act. This change is retroactive to December 13, 2016.

For more information, please see 

Am I affected?

  • If you have a NIH-funded or supported project that was started or ongoing on or after December 13, 2016, your project may now be covered by a CoC, even if you did not apply for one. See the link above to determine if your project is within the scope of this policy.

What do I need to do if I am affected?

  • You will need to comply with the requirements in 301(d) of the Public Health Service Act (see the link above for more information).
  • You will need to make sure those you share information with know the requirements. Recipients of Certificates are required to ensure that any subrecipients as well as any investigator or institution not funded by NIH who receives a copy of identifiable, sensitive information protected by a CoC, understand they are also subject to the requirements of subsection 301(d) of the Public Health Service Act. 
  • For studies in which informed consent is sought, NIH expects investigators to inform research participants of the protections and the limits to protections provided by a CoC. For studies where enrollment is ongoing, this means an amendment will be needed to add the required CoC language to the consent form (generally, this can occur at your next continuing review or the next time you need to amend the consent form for other reasons). You should also amend the form to eliminate provisions that may be inconsistent with the new CoC protections. If research subjects are no longer actively participating in the project, then an amendment to the informed consent process may be impractical: contact the IRB office for guidance.

Additional guidance and changes to the AURA application are in development; please contact the SBS IRB office (sbs-irb@uchicago.edu) with questions.


Consent ​Template Language:

This research is covered by a Certificate of Confidentiality from the National Institutes of Health. The researchers with this Certificate may not disclose or use information, documents, or biospecimens that may identify you in any federal, state, or local civil, criminal, administrative, legislative, or other action, suit, or proceeding unless you have consented for this use. Information, documents, or biospecimens protected by this Certificate cannot be disclosed to anyone else who is not connected with the research except if there is a federal, state, or local law that requires disclosure (such as to report child abuse or communicable diseases, see below); if you have consented to the disclosure, including for your medical treatment; or if it is used for other scientific research, as allowed by federal regulations protecting research subjects.

Exceptions to data confidentiality:

The researchers will voluntarily disclose information to the appropriate authorities about evidence of child abuse, and/or intent to hurt yourself or others. In addition, a Certificate of Confidentiality does not prevent you or a member of your family from voluntarily releasing information about yourself or your involvement in this research. If an insurer, employer, or other person obtains your written consent to receive research information, then the researchers may not use the Certificate to withhold that information. Finally, the Certificate may not be used to withhold information from the Federal government needed for auditing or evaluating Federally funded Projects or information needed by the FDA.