A few months ago we blogged about our plan to release an updated Certificate of Confidentiality (CoC) policy. Today, we are pleased to announce that we have published the new policy (NOT-OD-17-109), which will go into effect on October 1, 2017. The new policy both enhances the privacy protections of individuals participating in NIH funded research studies and eliminates the need for NIH funded investigators to apply for a CoC.
To help protect the privacy of research participants, NIH has for many years issued CoCs, upon request, to researchers collecting sensitive information about research participants. The CoCs protect researchers and institutions from being compelled to disclose information in response to legal demands that would identify their research subjects. Section 2012 of the 21st Century Cures Act authorized new provisions governing the authority of HHS to protect the privacy of research subjects. The new policy implements the new CoC statutory requirements.
Under the new policy, as of October 1, 2017, NIH funded researchers will no longer have to request a CoC, nor will they receive an actual certificate. The CoC will be issued automatically to NIH funded grants, cooperative agreements, contracts and intramural research projects research funded wholly or in part by the NIH that collects or uses identifiable, sensitive information. Compliance with the requirements of the law will become a term and condition of award. All research that was commenced or ongoing on or after December 13, 2016 and is within the scope of this policy is issued a Certificate through this policy.
The CoC protects the privacy of subjects by limiting the disclosure of identifiable, sensitive information. Under the new policy, disclosure is not up to the discretion of the investigator. Disclosure is only permitted in the following circumstances:
- if required by other Federal, State, or local laws, such as for reporting of communicable diseases
- if the subject consents; or
- for the purposes of scientific research that is compliant with human subjects regulations.
The restrictions on disclosures apply to all researchers or research institutions previously issued a CoC who are engaged in research.
A point that is important to understand is that if your research is covered by a CoC, you are required to ensure that any investigator or institution with whom you share a copy of the identifiable sensitive information that is protected by the policy understands that they are they are also subject to the disclosure restrictions, even if they are not funded by NIH.
If you have non-Federal funding, NIH will continue to consider applications for CoCs for applicable non-federally funded research submitted to our institutes and centers through our existing online CoC application system.
We have noted the changing policy on our CoC website and will be overhauling the page to align with the new policy for the October 1, 2017 policy implementation date.