Certificates of Confidentiality

A Certificate of Confidentiality (CoC) protects the privacy of human research participants by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the participant consents to such disclosures or in other limited specific situations.  

CoCs are issued to the research institution by a U.S. federal agency, typically as a term and condition of funding on an award sponsored by that agency, and require an authorized signature from the designated institutional official to show institutional agreement with the terms.

To validate the CoC application for submission to the funding agency and to facilitate the request for the authorized institutional signature, the U-M HRPP has a required pre-application review process.

Prior to submitting the CoC application package to the NIH or other funding agency, you must have IRB approval for the study and have completed the pre-application process with the U-M HRPP.  Principal Investigators (PIs) should not create the NIH application package (or other agency application) until instructed to do so by the U-M HRPP.

U-M CoC Pre-application Process

Follow the U-M CoC pre-application process:

1. For research funded by a non-federal entity (e.g., internal funding).


2. For research funded by an HHS agency that does not have its own CoC application.


3. To apply for the a new CoC in situations where the NIH-sponsored funding has ended and will not be renewed via a No Cost Time Extension or a new award, but the associated human research continues to enroll participants or collect data/biospecimens.


4. To apply for a new CoC if there are substantive changes to the research project (e.g., new PI takes over the project or the project moves to a new institution, major changes in the scope or direction of the research protocol, or changes in the drugs to be administered, if any, and or changes to the persons who will administer the drugs).


5. To cover unfunded research collaborators (i.e., those not receiving NIH funds or paid with NIH monies) who are collecting identifiable, sensitive research participant data/biospecimens as part of an NIH-funded (direct or prime) project.

U-M HRPP CoC Pre-application Package

Download the U-M HRPP CoC Application and follow the instructions within the application to submit to the U-M HRPP.

Post-Approval Compliance

The U-M HRPP office tracks all studies holding a CoC.  The HRPP office typically sends reminders to investigators about expiring NIH funding or about expiring CoCs that were obtained via direct application to the NIH two months prior to the funding period end date or the NIH expiration date, respectively. 

Process Exceptions & Details

New NIH-funded Research

The National Institutes of Health (NIH) automatically issue a CoC for a human research study as a term and condition of the funding on an NIH-sponsored award.  A principal investigator (PI) does not need to apply for a CoC on an NIH-funded project and the NIH does not issue a separate CoC document.  An NIH-issued CoC cannot be extended or amended.

If changes are required, or should NIH funding end and new participants are still being enrolled or data or biospecimens are still being collected from existing participants, the Principal Investigator (PI) must apply for a new CoC using the NIH's online CoC system.

Ongoing NIH-funded Research as of Dec. 13, 2016

In 2017, the NIH changed its process to automatically apply a CoC with their awards.  At that time, study teams with impacted NIH-funded human research that was ongoing as of Dec. 13, 2016 were advised to notify current subjects about the CoC and/or, as instructed by the U-M IRB, update the IRB application and revise their informed consent document(s) to reflect this change.

NOTE:  If the PI obtained a CoC prior to the 2017 NIH policy implementation and subsequently obtained NIH funding for that project, the CoC coverage will be based on the funding end date.

If the NIH funding has ended, but new participants are still being enrolled or data/biospecimens are still being collected from participants, the Principal Investigator (PI) must follow the U-M HRPP pre-application process to apply for a new CoC.

Multi-site Research with Unfunded Collaborators

Effective September 1, 2019, the U-M HRPP no longer accepts signed CoC Assurances from unfunded collaborator/multi-site researchers (i.e., not an NIH direct or sub-award recipient or U-M sub-contractor who is paid with NIH monies).  If collecting identifiable, sensitive participant data/biospecimens, unfunded collaborator/multi-site researchers must apply directly to the NIH for a CoC to cover their research activities in the project.

U-M investigators working as an unfunded researcher where an external Lead site holds the CoC must follow the U-M CoC pre-application process to cover their research activities when their work will involve the collection of identifiable, sensitive data/biospecimens and fall within the NIH mission.

Where a ceding agreement between U-M and another institution (or private IRB) is in place, it is up to the Deputy Institutional Official's (DIO) discretion whether to sign the CoC Assurances on behalf of U-M on a case-by-case basis.

Principal Investigator Responsibilities

PIs should review the NIH CoC policy to learn about the expanded protections and limitations around disclosures and be prepared to discuss the CoC protections, limitations, and application process with all collaborators as part of project planning or on-going communications, including with sub-awardees, sub-contractors who will collect, receive or access identifiable, sensitive data. This may include ensuring that any sub-awardee/sub-contractor includes the required CoC text in consent/assent documents.  Communication of the CoC information may also be covered by the sub-award/contract.  For additional guidance, review the NIH resources in the References & Resources section below.

It is the PI's responsibility to ensure that:

• All funding is accurately described in the IRB application in eResearch;
• The U-M HUM number (i.e., project id) appears in ORSP records linked to the funding;
• Consents/assents are up-to-date with the appropriate CoC statement;
• CoCs are uploaded to the IRB application;
• New CoCs are obtained, as necessary;
• Researchers with whom you share identifiable (or coded and linked) data or biospecimens are informed about the CoC protections and limitations around disclosure; and
• Unfunded collaborators who are collecting identifiable, sensitive research participant data/biospecimens as part of the project apply for a CoC using their institution's process to cover their work on the project.