You are here

Certificates of Confidentiality

U-M Certificate of Confidentiality Policy

HRPP Operations Manual, Part 11, Section III B.6

U-M Requirements

For non-federally-funded research, or research funded by an HHS agency not having its own CoC application process, send the following materials to

  1. The "downloaded" version of the CoC application, the IRB approval letter, and the IRB approved consent document(s).
  2. The Letter of Assurances:
  • Use the required template; print on your U-M departmental letterhead and sign.
  • The Letter of Assurances must list the following information for the U-M designated signator: 

Lois Brako, Ph.D.
Assistant Vice President for Research-
Regulatory and Compliance Oversight
University of Michigan
North Campus Research Complex
2800 Plymouth Road
Bldg. 520, Rm. 1190

For research funded by the CDC, FDA, HRSA, or SAMSA, scan and send (as one file) a copy of all application materials required by the agency to, prior to sending to the agency.  The researcher must include the U-M designated signator name, contact information, and signature line following the PI signature line in the application.

Effective 10/01/17:  A new NIH policy for issuing Certificates of Confidentiality was published.  Contact the applicable U-M IRB if you have questions about the new CoC policy or any information at this webpage. 

Certificate of Confidentiality (CoC) protects the privacy of research subjects by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the subject consents to such disclosures or in other limited specific situations.  

CoCs are issued by different federal agencies, most typically by the National Institutes of Health (NIH).

  • For NIH-funded research, the CoC is automatically included as a term and condition of the NIH award.
  • For other HHS agencies (that do not have a CoC application process) or for research without federal funding, researchers may apply for an NIH CoC if a primary focus of the research is within the NIH mission (i.e., health/mental health-related).
  • For research funded by other HHS agencies such as the Centers for Disease Control and Prevention (CDC), the Health Resources and Services Administration (HRSA), the Substance Abuse and Mental Health Services Administration (SAMHSA), or funded by or operating under the authority of the Food and Drug Administration (FDA), researchers should apply for a CoC to the applicable funding agency.  NOTE:  researchers must first submit their CoC application materials to the U-M HRPP to obtain sign-off by the Institutional Official (see below for more information).  Once the Institutional Official has signed-off on the CoC Assurances, you may submit your materials to the respective agency.

    Certificate of Confidentiality Review Processes

    It is recommended that you review and become familiar with the NIH CoC policy and FAQs found at the NIH CoC Kiosk.  Researchers should discuss the CoC protections, limitations, and application process with all collaborators as part of project planning.

    Current NIH-Funded Research

    Effective October 1, 2017 all NIH-funded research commenced or on-going as of December 13, 2016, were issued a CoC as a term and condition of the NIH award.  The researcher does not have to apply to the NIH for the CoC nor does the NIH issue a separate CoC document.  However, should NIH funding end and subjects are still being enrolled, the researcher must obtain a new CoC using the applicable application process described below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.

    Researchers who are still enrolling subjects may have to notify current subjects about the CoC and/or update the IRB application and revise their informed consent document(s), as the CoC boilerplate text has been modified as part of the new policy.  Discuss this with the IRB having oversight authority for your research and submit an amendment to make the changes, as instructed by your IRB.

    Researchers should carefully review the new NIH CoC policy to learn about the expanded protections and limitations around disclosures.  In addition, researchers must ensure that any collaborators (e.g., sub-awardees, sub-contractors, or others) that will receive or access identifiable, sensitive data are made aware of the presence of the CoC, its protections, and limitations on disclosure, as part of your planning or on-going communications.  Communication of the CoC information may also be covered by the sub-award/contract and/or by obtaining signed CoC Assurances from these institutions (see Multi-site information and LOA templates below).

    With the automatic NIH-issued CoC, researchers do not have to amend or extend the CoC as previously required under the old CoC policy.

    HHS Agencies having a CoC Application Process

    Each agency named below has their own CoC application processes and you should consult the links provided to learn more.  Note:  These agencies may request that only the PI sign the application.  However, U-M requires that in addition to the PI signature, you must obtain the U-M Deputy Institutional Official's signature. To obtain the proper signature, applications must first be submitted to before submitting to the agency.

    For other HHS agencies not named in this section, you may apply to the NIH for a CoC following the instructions given below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.

    Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process

    1.  After receiving IRB approval and prior to submitting your online application to the NIH, compile the following materials for submission to the U-M Human Research Protection Program (HRPP) for review and sign-off:

    • Copy of the online CoC Application (see page 4, item 7 to print correct copy):  NOTE - Student research must show the Faculty Advisor as the PI on the CoC application and the student should be listed as Key Personnel.  The student may be listed as the PI on the U-M eResearch application.
    • Letter of Assurances (LOA) - Non-Students:  Use the Letter of Assurances-Non-Student Researcher template (drop into your departmental letterhead before signing). 
    • Letter of Assurances (LOA) - Student Researcher:  Use the Letter of Assurances-Student-Researcher template (drop into your departmental letterhead before signing). 
    • A copy of the IRB Approval or Contingent Approval letter: (if contingent approval was issued, obtaining the CoC must be the only remaining contingency to be met)
    • IRB-reviewed and approved informed consent/assent documentation (if contingent approval was issued, the documentation will not display the approval watermark)

    2.  Obtain ​approval from U-M's designated signator:

    Combine the application materials above into a single PDF document and email it to the University of Michigan Office of Research (UMOR) at  Please include the following information in your email:

    • The name of the U-M PI that is submitting the application
    • Whether the application is for a new CoC or to amend or extend/renew an existing CoC
    • Whether this is a multi-site project and U-M's role (i.e., coordinating site only, research site only, or both), and
    • The names of any U.S. institutions that will rely on the U-M CoC

    You will receive a confirmatory email for receipt of your materials.  Once we confirm that your application packet is complete and the letter of assurances has been signed, you will receive a PDF version of the LOA via email. 

    3.  Upload the signed LOA to your online CoC application and submit to the NIH.

    4.  Once you have obtained your CoC, you must upload the documentation to section 11-2 of the IRB application.

    Amending or Extending your CoC:  Please note that substantive changes to the research (e.g., change in PI, change in research aims and goals) may require a formal amendment to the CoC.  In addition, each CoC is issued with an expiration date and may require formal extension via application at least 3 months prior to the expiration date.  If you encounter either of these events, please consult with the NIH CoC Coordinator to confirm (1) whether you must complete a formal amendment or extension application and (2) obtain the formal application template or a link to the template.  

    Additional U-M HRPP guidance for Amendments to, or Extensions of, Existing CoCs:  Amendments to, or extensions of, existing CoCs may require review by the U-M designated signator even if the issuing NIH agency does not require a re-review of your application materials.  If the NIH does not require a formal application to amend or extend your existing CoC, you must complete the HRPP CoC Amendment/Extension Checklist. This information will help inform whether a formal application will be necessary for HRPP review.  

    Multi-Site Research:  If the research is part of a multi-site project, additional steps must be taken depending on which institution holds the CoC.  This information and actions, along with the CoC policy, protections, and limitations should be discussed with collaborators as part of project planning.

    For multi-site research where other institutions will roll-up under the protections of the U-M CoC: the U-M PI must obtain signed LOAs from each institution and provide copies to the HRPP.  In addition, the HRPP must review the collaborator consent documents to ensure that the CoC boilerplate text is present.  Lastly, the U-M PI should provide collaborators with a copy of the NIH online CoC application and the NIH-issued CoC documentation, once received.  Refer to the HRPP guidance for more information.

    For multi-site research where U-M will roll-up under the protections of another institution's CoC: the U-M PI should obtain instructions from the institution holding the CoC.  However, you should expect to receive a request from the covering institution to obtain a signed LOA from the U-M institutional official, for their records.  In addition, you should obtain a copy of the NIH-issued CoC documentation from the covering institution that must then be uploaded to section 11-2 of the IRB application. 


    Contact the following for questions regarding Certificates of Confidentiality:

    For IRB-HSBS studies:

    Mary Ramirez, CIP
    Assistant Director
    Health Sciences and Behavioral Sciences Institutional Review Board
    (734) 615-9464 

    For IRBMED studies:

    S. Joseph Austin, J.D., LL.M
    Assistant Director, Regulatory Operations
    Institutional Review Boards
    University of Michigan Medical School
    (734) 763-1236