Section XII:

Informed Consent Process and Documentation

WPP #: XII-2

Title 2:

Certificates of Confidentiality

Effective Date:


Revision History:

06-07-04; 6-21-06

Policy Statement

Certificates of Confidentiality are issued by the National Institutes of Health (NIH) to protect the privacy of research subjects by protecting investigators and institutions from being compelled to release information that could be used to identify subjects with a research project. Certificates of Confidentiality are issued to institutions or universities where the research is conducted. A Certificate of Confidentiality can also be issued for non-DHHS funded research.

Principal investigators are responsible for applying for a Certificate of Confidentiality prior to submission to the IRB or applying for a Certificate of Confidentiality upon request from the VCU IRB.

Description and Procedures

  1. Purpose of a Certificate of Confidentiality:

    Certificates of Confidentiality allow the investigator and others who have access to research records to refuse to disclose identifying information in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level.

    Identifying information is broadly defined as any item or combination of items in the research data that could lead directly or indirectly to the identification of a research subject.

    By protecting researchers and institutions from being compelled to disclose information that would identify research participants, Certificates of Confidentiality help achieve the research objectives and promote participation in studies by assuring privacy to subjects.

    Certificates can be used for biomedical, behavioral, clinical or other types of research that is sensitive. Sensitive means that disclosure of identifying information could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation.

    Examples of sensitive research activities include but are not limited to the following:

    • Collecting genetic information;
    • Collecting information on psychological well-being of subjects;
    • Collecting information on subjects' sexual attitudes, preferences or practices;
    • Collecting data on substance abuse or other illegal risk behaviors;
    • Studies where subjects may be involved in litigation related to exposures under study (e.g., breast implants, environmental or occupational exposures).
  2. Scope and Term of the Certificate of Confidentiality:

    A Certificate of Confidentiality protects personally identifiable information about subjects in the research project while the Certificate is in effect. Generally, Certificates of Confidentiality are effective on the date of issuance or upon commencement of the research project if that occurs after the date of issuance. The expiration date should correspond to the completion of the study. The Certificate will state the date upon which it becomes effective and the date upon which it expires. A Certificate of Confidentiality protects all information identifiable to any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate of Confidentiality is in effect. An extension of coverage must be requested if the research extends beyond the expiration date of the original Certificate of Confidentiality. However, the protection afforded by the Certificate is permanent. All personally identifiable information maintained about participants in the project while the Certificate was in effect is protected in perpetuity.

    While Certificates of Confidentiality protect against involuntary disclosure, investigators should note that research subjects might voluntarily disclose their research data or information. Subjects may disclose information to physicians or other third parties. They may also authorize in writing the investigator to release the information to insurers, employers, or other third parties. In such cases, researchers may not use the Certificate of Confidentiality to refuse disclosure. Moreover, researchers are not prevented from the voluntary disclosure of matters such as child abuse, reportable communicable diseases, or subject's threatened violence to self or others. However, if the researcher intends to make any voluntary disclosures, the consent form must specify such disclosure.

    In general, Certificates of Confidentiality are issued for single research projects rather than groups or classes of projects. In some instances, a Certificate of Confidentiality can be issued for multi-site projects.

    IRB approval is required before a Certificate of Confidentiality is issued. In the informed consent document, investigators should state that a Certificate of Confidentiality is being requested, and once it is received, a modification should be submitted to update the informed consent document to specify that the Certificate of Confidentiality is in effect. Subjects should be given a fair and clear explanation of the protection that it affords, including the limitations and exceptions noted above.

    Note: The majority of the above information is directly from the National Institutes of Health. Also, please note that Certificates of Confidentiality are untested in the legal system. There is the possibility that assured protections may, in the future, be challenged by the courts.


NIH Office of Extramural Research