CSR&D Frequently Asked Questions on Certificates of Confidentiality

Although VA does not issue certificates of confidentiality, these FAQs will explain when a certificate might be needed and where to apply for one.

1. What is a Certificate of Confidentiality?

2. What types of CSR&D studies are eligible for a Certificate of Confidentiality?

3. How do I know if I need to apply for a Certificate of Confidentiality for my CSR&D Study?

4. Who applies for the Certificate of Confidentiality (CoC) and to whom is the approved CoC issued for CSR&D studies?

5. When should I apply for a Certificate of Confidentiality?

6. How do I apply for a Certificate of Confidentiality?

7. What language about a Certificate of Confidentiality should be in the consent form?

8. How long is a Certificate of Confidentiality valid?

9. For multicenter studies, does each site have to apply for its own Certificate of Confidentiality?

10. Under what circumstances might a Certificate of Confidentiality need to be amended?

1. What is a Certificate of Confidentiality?

A Certificate of Confidentiality (CoC) is issued for applicable Department of Veterans Affairs (VA) research by several Department of Health and Human Services (DHHS) agencies to protect research subjects by preventing investigators and institutions from being forced or compelled to release identifiable information on research subjects. It allows the investigator and others who have access to research records to refuse to disclose identifying information on research subjects in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. The CoC helps to minimize risks by adding an additional level of protection for maintaining the privacy and confidentiality of research subjects in a VA study. Please note that the Department of Veterans Affairs does not issue CoCs.

2. What types of CSR&D studies are eligible for a Certificate of Confidentiality?

Generally, a CSR&D human subjects research project that collects personally identifiable, sensitive information and that has been approved by an IRB is eligible for a Certificate of Confidentiality (CoC). Sensitive information for purposes of a CoC is not synonymous with the definition of sensitive information in VA and Veterans Health Administration (VHA) Handbooks. Examples of sensitive information for purposes of evaluating whether or not a CSR&D study is eligible for a CoC include:

• Research on HIV, Acquired Immune Deficiency Syndrome (AIDS), and other sexually transmitted diseases (STD)
• Studies that collect information on sexual attitudes, preferences, or practices
• Studies on the use of alcohol, drugs, or other addictive products
• Studies that collect information on illegal conduct
• Studies that gather information that if released could be damaging to a participant's financial standing, employability, or reputation within the community
• Research involving information that might lead to social stigmatization or discrimination if it were disclosed
• Research on participants' psychological well-being or mental health
• Genetic studies, including those that collect and store biological samples for future use
• Research on behavioral interventions and epidemiologic studies

3. How do I know if I need to apply for a Certificate of Confidentiality for my CSR&D study?

As Principal Investigator, you may decide that a Certificate of Confidentiality (CoC) is appropriate for a study because sensitive information is being collected from research subjects. Or, your Institutional Review Board may also ask you to apply for a CoC. In some cases, after a funding decision has been made, you may be contacted by a CSR&D staff member, who will discuss whether a CoC application should be sent and to which Department of Health and Human Services agency it should be sent.

4. Who applies for the Certificate of Confidentiality (CoC) and to whom is the approved CoC issued for CSR&D studies?

• The Principal Investigator (PI) applies for the CoC, but both the PI and the Institutional Official must sign the application for a CoC. If you have received a CSR&D award, both you and your VA Medical Center Director must sign the application.
• If your CoC application is approved by the applicable Department of Health and Human Services (DHHS) agency, the CoC will be issued to your VA Facility.
• If other institutions are involved in the conduct of your research (e.g., VA Facilities, Universities), you can apply for a CoC on behalf of those Institutions and be issued one Certificate for a multi-site study. There are specific requirements and responsibilities involved in applying for multiple sites. Please contact the appropriate DHHS agency during the application process.

5. When should I apply for a Certificate of Confidentiality?

An application for a Certificate of Confidentiality (CoC) is submitted after the Institutional Review Board (IRB) responsible for review of your CSR&D study approves it or issues an IRB approval conditioned upon issuance of a CoC.

6. How do I apply for a Certificate of Confidentiality?

• VA does not issue Certificates of Confidentiality; they are issued by several Department of Health and Human Services (DHHS) operating agencies. A flowchart is available at http://grants.nih.gov/grants/policy/coc/coc_flow_chart_062011.pdf.
• For a VA-funded study, you may apply for a Certificate through the National Institutes of Health (NIH) Institute or Center (IC) that supports research in a scientific area similar to your project. Detailed application instructions can be found at http://grants.nih.gov/grants/policy/coc/appl_extramural.htm. Some ICs have an online application process. See http://grants.nih.gov/grants/policy/coc/contacts.htm for a list of contacts at NIH and other HHS agencies that issue CoCs. Additional information regarding the process for applications to NIH are found at http://grants.nih.gov/grants/policy/coc/faqs.htm.
• If NIH funds the research project for which you would like to request a CoC, you should apply through the respective IC.
• The Food and Drug Administration (FDA) handles requests for Certificates of Confidentiality for studies that obtain an Investigational New Drug (IND) authorization, Investigational Device Exemption (IDE), or other FDA authorization. Projects with INDs or IDEs should apply to the FDA (see http://grants.nih.gov/grants/policy/coc/appl_extramural.htm, paragraph 2 for FDA contact information).

7. What language about a Certificate of Confidentiality should be in the consent form?

• When a researcher obtains a Certificate of Confidentiality (CoC), the research subjects must be informed about the protections afforded by the CoC and any exception to that protection. That information should be included in the informed consent form. Examples of consent form appropriate language when a CoC is issued by NIH can be found under the Informed Consent section of the following web site: http://grants.nih.gov/grants/policy/coc/appl_extramural.htm
• Researchers should also review the language about confidentiality and data security that is routinely included in consent forms to be certain that it is consistent with the protections of the CoC.

8. How long is a Certificate of Confidentiality valid?

Individuals who participate as research subjects in the specified research project during any time the Certificate of Confidentiality (CoC) is in effect are protected permanently even if the subject gave the researcher data before the CoC was issued.

9. For multicenter studies, does each site have to apply for its own Certificate of Confidentiality?

• No, for multi-site projects, a coordinating center or lead institution can apply for and receive a Certificate of Confidentiality (CoC) on behalf of all member institutions.
• For more information see http://grants.nih.gov/grants/policy/coc/faqs.htm, question and answer 6 under section C. Eligibility for a Certificate.
• If other institutions are involved in the conduct of your research (e.g., VA Facilities, Universities), you can apply for a CoC on behalf of those Institutions and be issued one Certificate for a multi-site study. There are specific requirements and responsibilities involved in applying for multiple sites. Please contact the appropriate Department of Health and Human Services agency during the application process.

10. Under what circumstances might a Certificate of Confidentiality need to be amended?

• If a significant change in your research project is proposed after a Certificate of Confidentiality (CoC) is issued, you must inform the Department of Health and Human Services Agency who awarded the CoC. For the National Institutes of Health (NIH), notify the Certificate Coordinator or the NIH Institute. Instructions on amending CoCs issued by NIH can be found at http://grants.nih.gov/grants/policy/coc/faqs.htm.
• Significant changes for NIH-issued CoCs include: major changes in the scope or direction of the research protocol, changes in personnel having major responsibilities in the project, or changes in the drugs to be administered (if any) and the persons who will administer them.

REFERENCES:

Section 301(d) of the Public Health Service Act (42 U.S.C. 241(d))

VHA Handbook 1200.05, Requirements for the Protection of Human Subjects in Research, May 2, 2012.

NIH FAQs on Certificates of Confidentiality: http://grants.nih.gov/grants/policy/coc/faqs.htm

NIH Certificates of Confidentiality: Background Information: http://grants.nih.gov/grants/policy/coc/background.htm

Detailed Application Instructions for Certificate of Confidentiality: Extramural Research Projects:http://grants.nih.gov/grants/policy/coc/appl_extramural.htm