Skip directly to search Skip directly to A to Z list Skip directly to navigation Skip directly to page options Skip directly to site content
CDC

Frequently Asked Questions on Certificates of Confidentiality

What is a Certificate of Confidentiality?
A Certificate of Confidentiality helps researchers protect the privacy of human research participants enrolled in biomedical, behavioral, clinical and other forms of sensitive research. Certificates protect against compulsory legal demands, such as court orders and subpoenas, for identifying information or identifying characteristics of a research participant. At CDC, Certificates are granted primarily for research funded by grants or cooperative agreements. Those conducting federally-supported research are able to protect the privacy of participants by withholding from all persons not connected with the conduct of such research, the names or other identifying characteristics of such participants without their consent.

Who may apply for a Certificate of Confidentiality?
Application can be made for protection under a Certificate of Confidentiality by researchers within or outside of government, whenever the information collected is so sensitive that research subjects would likely either not participate or be disinclined to provide accurate or complete responses without such added protection. The applicant must apply to the HHS agency that is funding the project.

 Top of Page

What kind of research is eligible for a Certificate?
Any research project that collects personally identifiable, sensitive information and that has been approved by an IRB is eligible for a Certificate. CDC funding is a prerequisite for a Certificate of Confidentiality.

Whose private information is protected?
Private information of human research participants involved in an IRB-approved study for which a Certificate of Confidentiality has been granted are protected.

What information is protected?
The names or other identifying characteristics of human research participants who are the subjects of a study with an approved 301 (d) Certificate of Confidentiality are protected.

When can the information be disclosed without individual authorization?
Disclosures of protected information can be made without individual authorization for the following limited purposes: identifiable disclosures stated in the consent form at the time of data collection; review of records under the Federal Food, Drug, and Cosmetic Act or associated regulations; and an audit or program evaluation of the research.

 Top of Page

I am planning two different studies that will involve human subjects from two different populations. Both studies will collect sensitive information. Can I apply for one Certificate to cover both projects?
A separate application is required for each research project for which a Certificate is desired. A certificate is generally issued to a research institution for a single project (not broad groups or classes of projects). However, projects that use the same sample of subjects but have different protocols may file for one Certificate since the subjects, whose identities the investigator wishes to protect, are the same.

What is meant by sensitive information?
Sensitive information includes (but is not limited to) information relating to sexual attitudes, preferences, or practices; information relating to the use of alcohol, drugs, or other addictive products; information pertaining to illegal conduct; information that, if released, might be damaging to an individual’s financial standing, employability, or reputation within the community or might lead to social stigmatization or discrimination; information pertaining to an individual’s psychological well-being or mental health; and genetic information or tissue samples.

 Top of Page

Can you give some examples of research projects that are eligible for a Certificate?
The following are examples of research areas eligible for a Certificate:

  • Research on HIV, AIDS, and other STDs;
  • Studies that collect information on sexual attitudes, preferences, or practices;
  • Studies on the use of alcohol, drugs, or other addictive products;
  • Studies that collect information on illegal conduct;
  • Studies that gather information that if released could be damaging to a participant’s financial standing, employability, or reputation within the community;
  • Research involving information that might lead to social stigmatization or discrimination if it were disclosed;
  • Research on participants’ psychological well being or mental health;
  • Genetic studies, including those that collect and store biological samples for future use;
  • Research on behavioral interventions and epidemiologic studies.

 Top of Page

What studies would NOT be eligible?
Ineligible studies include projects that are:

  • not research based,
  • not collecting sensitive information or information that might harm the research participants, or
  • not collecting personally identifiable information.

Is CDC required to give all who apply a Certificate of Confidentiality?
No. No project is entitled to a Certificate; its issuance is discretionary.

 Top of Page

What is the effect of a Certificate? What protection does it afford?
Researchers can use a Certificate to avoid compelled “involuntary disclosure” (e.g., subpoenas) of names and other identifying information about any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. It does not protect against voluntary disclosures by the researcher, but those disclosures must be specified in the informed consent form. A researcher may not rely on the Certificate to withhold data if the participant consents in writing to the disclosure.

How long does a Certificate’s protection last?
Individuals who participate as research subjects (i.e., about whom the investigator maintains identifying information) in the specified research project during any time the Certificate is in effect are protected permanently – even after death.

 Top of Page

In what situations may personally identifiable information protected by a Certificate be disclosed?
Personally identifiable information protected by a Certificate may be disclosed under the following circumstances:

  • Voluntary disclosure of information by study participants themselves or any disclosure that the study participant has consented to in writing, such as to insurers, employers, or other third parties;
  • Voluntary disclosure by the researcher of information on such things as child abuse, reportable communicable diseases, possible threat to self or others, or other voluntary disclosures provided that such disclosures are spelled out in the informed consent form;
  • Voluntary compliance by the researcher with reporting requirements of state laws, such as knowledge of communicable disease, provided such intention to report is specified in the informed consent form (see Attachment D, which sets forth PHS policy on reporting of communicable diseases); or
  • Release of information by researchers to DHHS as required for program evaluation or audits of research records or to the FDA as required under the federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.)

 Top of Page

What does identifying characteristic mean?
Identifying characteristics include things such as: name, address, social security or other identifying number, fingerprints, voiceprints, photographs, genetic information or tissue samples, or any other item or combination of data about a research participant which could reasonably lead, directly or indirectly by reference to other information, to identification of that research subject.

To whom should I apply for a Certificate of Confidentiality?
If CDC funds the research project for which you would like a Certificate, you may apply through the CDC Office of Scientific Integrity. However, even if your research is not supported with CDC funding, you may apply for a Certificate through the National Institutes of Health (NIH). You may find more information about applying for a Certificate of Confidentiality for research not funded by a federal agency at: http://grants.nih.gov/grants/policy/coc/index.htm

 Top of Page

When should I apply for a Certificate?
Applications for Certificates should be submitted at least three months prior to the date on which enrollment of research subjects is expected to begin. Since the informed consent form should include language describing the Certificate and any voluntary disclosures specified by the investigator, the applicant should tell the IRB that they are applying for a Certificate of Confidentiality and include appropriate language in the informed consent form.

What if there is a significant change in my research project after a Certificate is issued?
If a significant change in your research project is proposed after a Certificate is issued, you must inform the CDC by submitting an amended application for a Certificate of Confidentiality (in the same form and manner as your original application for a Certificate).

 Top of Page

What do you mean by significant changes?
Significant changes include: major changes in the scope or direction of the research protocol, changes in personnel having major responsibilities in the project, or changes in the drugs to be administered (if any) and the persons who will administer them.

What happens once I submit an amended application?
Amended applications will be reviewed by CDC and either approved or disapproved. If an amended application is approved, an amended Certificate of Confidentiality will be issued. If an amended application is disapproved, you will be notified that adoption of the proposed significant change(s) will result in prospective termination of the original Certificate. Any termination of a Certificate of Confidentiality is operative only with respect to the identifying characteristics of individuals who began their participation as research subjects after the effective date of such termination.

 Top of Page

What if my research project extends beyond the expiration date on the Certificate?
If you determine that the research project for which you have received a Certificate of Confidentiality will extend beyond the expiration date on the Certificate, you may submit a written request for extension of the date. This request should be submitted to the CDC at least three months prior to the Certificate’s expiration. It must include an explanation of the reasons for requesting an extension (e.g., new subjects continue to be enrolled in the project), a revised estimate of the date for completion of the project, documentation of the Institutional Review Board’s most recent approval for the project, and a copy of the consent form which should include language explaining the Certificate’s protections, specify any voluntary disclosures, and clearly state any other limitations. If your request is approved, an amended Certificate will be issued.

What is the researcher’s responsibility to participants regarding a Certificate of Confidentiality?
When a researcher obtains a Certificate of Confidentiality, the subjects must be told about protections afforded by the Certificate and any exceptions to those protections – i.e., the circumstances in which the investigators plan to disclose, voluntarily, identifying information about research participants (e.g., child abuse, harm to self or others, etc.). This information should be included in the informed consent form unless a research subject is no longer actively participating in the project so amendment of the informed consent would be impractical The researchers should eliminate provisions in consent form templates that may be inconsistent with the Certificate protections (such as references to disclosures required by law, since the Certificate enables researchers to resist disclosures that would otherwise be compelled by law). In addition, researchers may not represent the Certificate as an endorsement of the research project by the DHHS or use it in a coercive manner when recruiting subjects

 Top of Page

Has the legality of Certificates been challenged?
There have been very few reported court cases. In 1973, the certificate’s authority was upheld in the New York Court of Appeals. The U.S. Supreme Court declined to hear the case.

What should an investigator do if legal action is brought to release personally identifying information protected by a certificate?
The researcher should immediately inform the CDC and seek legal counsel from his or her institution. The CDC is available to discuss the regulations with the researcher’s attorney.

I am collecting data from subjects recruited in a foreign country. Can I get a Certificate of Confidentiality?
Yes, if the data are maintained within the U.S. If the data are maintained only in the foreign country, a Certificate of Confidentiality would not be effective.

 Top of Page

I am an intramural scientist working on a study at the CDC. If the Federal Privacy Act applies to my research, do I still need a Certificate of Confidentiality?
Yes, because the Federal Privacy Act does not protect identifying information if disclosure is ordered by a court of competent jurisdiction. Moreover, there are other exceptions to the protection afforded by the Privacy Act.

I’m conducting a longitudinal study. I just got a Certificate of Confidentiality. Part of my cohort was recruited prior to issuance of the Certificate, but they are no longer actively participating in the study. What do I do?
In the informed consent form, you should tell subjects who are still actively involved in your study that the Certificate is in effect. If subjects are no longer actively participating in the project, an amendment to the informed consent form would be impractical.

If I am conducting a sensitive research project that is covered by the AHRQ confidentiality statute (42 U.S.C. section299a-1(c) entitled “limitation on use of certain information”) or the Department of Justice confidentiality statute (42USC section 3789g), should I also apply to the CDC for a Certificate of Confidentiality?
No. You should not apply for a CDC Certificate if your study is covered by AHRQ or the DOJ statute.

 Top of Page

You indicate that the PI must sign the application for a Certificate. What do you mean by “PI” and final application?
The PI (Principal Investigator) refers to the person(s) conducting the research investigation. After the application has been submitted for review and all revisions from the Confidentiality Office pertaining to the application have been addressed, the PI must sign the final version of the Certificate of Confidentiality application.

Does the Privacy Rule preclude the need for Certificates of Confidentiality?
No. Certificates of Confidentiality offer an important protection for the privacy of research study participants by protecting identifiable health information from forced disclosure (e.g., by court order). While the Privacy Rule does establish protections for covered entities, it permits use or disclosure in response to certain judicial or administrative orders. Therefore, researchers/contractors may obtain Certificates of Confidentiality to protect them from being forced to disclose information that would have to be disclosed under the Privacy Rule.

 Top of Page

Does the Patriot Act affect the Certificate of Confidentiality protections?
No, a Certificate of Confidentiality protects investigators and institutions from being compelled to release information that could be used to identify study participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. The Patriot Act does not affect those protections.

How can I get more information about Certificates of Confidentiality?
You may contact the Confidentiality Office in the CDC Office of Scientific Integrity at 404-639-4642 or cdccoc@cdc.gov

 Top of Page

Get Email Updates

To receive email updates about this page, enter your email address:

What's this?Submit
  • Page last reviewed: June 29, 2017
  • Page last updated: April 10, 2015
  • Content source:
    • Office of the Associate Director for Science
TOP