Version date: September, 2019
Certificates of Confidentiality (CoCs) protect the privacy of research subjects by prohibiting disclosure of identifiable, sensitive research information to anyone not connected to the research, except when the subject consents to allow disclosure or in a few other specific situations.
This guidance describes types of studies for which the UW Health Sciences IRBs may require researchers to apply for a CoC, information to include in IRB submissions about CoCs, and when to apply for a CoC. For detailed information about CoCs, including researchers’ responsibilities, application instructions, and frequently asked questions, see the UW Human Research Protection Program’s Certificate of Confidentiality Guidance and the NIH’s Certificates of Confidentiality (CoC) - Human Subjects website.
Do I need to apply for a CoC?
NIH funded researchers are now automatically issued a CoC through their award and do not need to apply for a CoC.
For research not funded by NIH, the UW Health Sciences IRBs may require researchers to apply for a CoC if their study collects or uses identifiable data that, if disclosed, could pose legal risks to subjects; damage their reputation, insurability, employability, or financial standing; or have other significant negative impact on subjects. Examples of research data that may require a CoC include (but are not limited to):
- Genetic information
- Information about participants' sexual attitudes, preferences or practices
- Information about controlled substance abuse or other illegal risk behaviors
Researchers may also choose to apply for a CoC to provide added confidentiality protections for subjects.
What do I need to include in my protocol and/or ARROW application about CoCs?
Risks and Benefits
Question 4.1: Describe types of information the study will collect that could be harmful to participants in the event of a confidentiality breach.
- For studies not funded by NIH that will collect or use identifiable, sensitive data, state the study team’s intention to apply for a CoC after IRB approval.
- For NIH-funded studies, describe the CoC issued through the NIH grant as one way that risks will be minimized.
Privacy and Confidentiality
Question 1.3: Describe the CoC as one of the confidentiality protections for subjects.
Consent forms for studies that have or will apply for a CoC must inform subjects about the protections and limits of protection provided by the CoC. The Health Sciences IRBs consent form templates include CoC language in the section on confidentiality protections. This language, and instructions for using it, are also available on the HS IRBs’ Informed Consent Model Language page.
When do I apply for a CoC?
IRB approval for a study must be in place before a researcher can apply for a CoC. The UW Health Sciences IRBs expect researchers to apply for a CoC promptly after IRB approval and provide the CoC to the IRB (as a change of protocol) once issued.
What if I don’t receive a CoC?
If a researcher’s request for a CoC is denied, the researcher should promptly submit a change of protocol to:
- Report that the CoC was denied (and provide any correspondence from the issuing agency regarding this decision)
- Remove consent form language describing CoC protections
- Provide a plan for informing any subjects who have consented to participate that the CoC’s protections do not apply to the data (and biospecimens, if applicable) collected by the study.
UW Human Research Protection Program’s Certificate of Confidentiality Guidance
NIH Certificates of Confidentiality (CoC) - Human Subjects
HS IRBs Informed Consent Templates
HS IRBs Informed Consent Model Language