You are here

Certificates of Confidentiality

U-M Certificate of Confidentiality Policy

HRPP Operations Manual, Part 11, Section III B.6

U-M Requirements

For non-federally-funded research, or research funded by an HHS agency not having its own CoC application process, send the following materials to HRPPCoCgroup@umich.edu:

  1. The "downloaded" version of the CoC application, the IRB approval letter, and the IRB approved consent document(s).
  2. The Letter of Assurances:
  • Use the required template; print on your U-M departmental letterhead and sign.
  • The Letter of Assurances must list the following information for the U-M designated signator: 

Lois Brako, Ph.D.
Assistant Vice President for Research-
Regulatory and Compliance Oversight
University of Michigan
North Campus Research Complex
2800 Plymouth Road
Bldg. 520, Rm. 1190
48109-2800

For research funded by the CDC, FDA, HRSA, or SAMSA, scan and send (as one file) a copy of all application materials required by the agency to HRPPCoCgroup@umich.edu, prior to sending to the agency.  The researcher must include the U-M designated signator name, contact information, and signature line following the PI signature line in the application.

Certificate of Confidentiality (CoC) protects the privacy of research subjects by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the subject consents to such disclosures or in other limited specific situations.  Small differences in procedures exist depending on whether the research is NIH funded.

CoCs are issued by different federal agencies, most typically by the National Institutes of Health (NIH).

  • For NIH-funded research, the CoC is automatically included as a term and condition of the NIH award.  The NIH also issues CoCs for other federally funded research (where a CoC is not included as a term and condition of award) or for non-federally funded research that falls within the mission of the NIH.
  • For research funded by the Centers for Disease Control and Prevention (CDC), the Health Resources and Services Administration (HRSA), the Substance Abuse and Mental Health Services Administration (SAMHSA), or funded by or operating under the authority of the Food and Drug Administration (FDA), a CoC is included as a term and condition of the award.  Non-funded researchers may not apply for and obtain a CoC from these agencies.
  • For other HHS agencies (that do not provide a CoC as a term and condition of the award) or for research without federal funding, researchers may apply for an NIH CoC if a primary focus of the research is within the NIH mission (i.e., health/mental health-related).

    Certificate of Confidentiality Review Processes

    It is recommended that you review and become familiar with the NIH CoC policy and FAQs found at the NIH CoC Kiosk.  Researchers should discuss the CoC protections, limitations, and application process with all collaborators as part of project planning.

    Current NIH-Funded Research

    Effective October 1, 2017 all NIH-funded research commenced or on-going as of December 13, 2016, were issued a CoC as a term and condition of the NIH award.  The researcher does not have to apply to the NIH for the CoC nor does the NIH issue a separate CoC document.  However, should NIH funding end and new subjects are still being enrolled or data or biospecimens are still being collected from existing subjects, the researcher must obtain a new CoC using the applicable application process described below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.

    For on-going research at the time the new CoC policy was implemented where the CoC was not discussed in the consent document, researchers may have to notify current subjects about the CoC and/or update the IRB application and revise their informed consent document(s).  Discuss this with the IRB having oversight authority for your research and submit an amendment to make the changes, as instructed by your IRB.

    Researchers should carefully review the new NIH CoC policy to learn about the expanded protections and limitations around disclosures.  In addition, researchers must ensure that any collaborators (e.g., sub-awardees, sub-contractors) that will receive or access identifiable, sensitive data are made aware of the presence of the CoC, its protections, and limitations on disclosure, as part of your planning or on-going communications.  Communication of the CoC information may also be covered by the sub-award/contract and/or by obtaining signed CoC Assurances from these institutions (see Multi-site information and LOA templates below).

    With the automatic NIH-issued CoC, researchers do not have to amend or extend the CoC as previously required under the old CoC policy.

    The U-M HRPP office tracks all studies holding a CoC.  The HRPP office or the IRB may periodically send reminders to investigators about expiring funding or CoCs that were obtained via direct application to the NIH.  It is the PI's responsibility to ensure all funding is accurately described in the eResearch application, maintain up-to-date consents with the appropriate CoC statement, and amend/extend directly-issued CoCs as necessary.  NOTE:  if the PI obtained a CoC prior to the policy change and they have NIH funding, CoC coverage is based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, coverage is good until 2022).

    HHS Agencies that Issue CoCs as a Term and Condition of Award

    Each agency named below provides a CoC as a term and condition of funding.  CoCs from these agencies are only available via funding.  Each of these agencies may have specific requirements for researchers.  For more information, follow the links to the agency webpages:

    For other HHS agencies not named in this section, you may apply to the NIH for a CoC following the instructions given below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.

    Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process

    1.  After receiving IRB approval and prior to submitting your online application to the NIH, compile the following materials for submission to the U-M Human Research Protection Program (HRPP) for review and sign-off:

    • Copy of the online CoC Application (see page 4, item 7 to print correct copy):  NOTE - Student research must show the Faculty Advisor as the PI on the CoC application and the student should be listed as Key Personnel.  The student may be listed as the PI on the U-M eResearch application.
    • Letter of Assurances (LOA) - Non-Students:  Use the Letter of Assurances-Non-Student Researcher template (drop into your departmental letterhead before signing). 
    • Letter of Assurances (LOA) - Student Researcher:  Use the Letter of Assurances-Student-Researcher template (drop into your departmental letterhead before signing). 
    • A copy of the IRB Approval or Contingent Approval letter: (if contingent approval was issued, obtaining the CoC must be the only remaining contingency to be met)
    • IRB-reviewed and approved informed consent/assent documentation (if contingent approval was issued, the documentation will not display the approval watermark)

    2.  Obtain ​approval from U-M's designated signator:

    Combine the application materials above into a single PDF document and email it to the University of Michigan Office of Research (UMOR) at HRPPCoCgroup@umich.edu.  Please include the following information in your email:

    • The name of the U-M PI that is submitting the application
    • Whether the application is for a new CoC or to amend or extend/renew an existing CoC
    • Whether this is a multi-site project and U-M's role (i.e., coordinating site only, research site only, or both), and
    • The names of any U.S. institutions that will rely on the U-M CoC

    You will receive a confirmatory email for receipt of your materials.  Once we confirm that your application packet is complete and the letter of assurances has been signed, you will receive a PDF version of the LOA via email. 

    3.  Upload the signed LOA to your online CoC application and submit to the NIH.

    4.  Once you have obtained your CoC, you must upload the documentation to section 11-2 of the IRB application.

    The U-M HRPP office tracks all studies holding a CoC.  The HRPP office or the IRB may periodically send reminders to investigators about expiring funding or CoCs that were obtained via direct application to the NIH.  It is the PI's responsibility to ensure all funding is accurately described in the eResearch application, maintain up-to-date consents with the appropriate CoC statement, and amend/extend directly-issued CoCs as necessary.  NOTE:  if the PI obtained a CoC prior to the policy change and subsequently obtains NIH funding, CoC coverage is based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, coverage is good until 2022).

    Amending or Extending your CoC:  Please note that substantive changes to the research (e.g., change in PI, change in research aims and goals) may require a formal amendment to the CoC.  In addition, each CoC is issued with an expiration date and may require formal extension via application at least 3 months prior to the expiration date.  If you encounter either of these events, please consult with the NIH CoC Coordinator to confirm (1) whether you must complete a formal amendment or extension application and (2) obtain the formal application template or a link to the template.  

    Additional U-M HRPP guidance for Amendments to, or Extensions of, Existing CoCs:  Amendments to, or extensions of, existing CoCs may require review by the U-M designated signator even if the issuing NIH agency does not require a re-review of your application materials.  If the NIH does not require a formal application to amend or extend your existing CoC, you must complete the HRPP CoC Amendment/Extension Checklist. This information will help inform whether a formal application will be necessary for HRPP review.  

    Multi-Site Research:  If the research is part of a multi-site project, additional steps must be taken depending on which institution holds the CoC.  This information and actions, along with the CoC policy, protections, and limitations should be discussed with collaborators as part of project planning.

    For multi-site research where other institutions will roll-up under the protections of the U-M CoC: the U-M PI must obtain signed LOAs from each institution and provide copies to the HRPP.  In addition, the HRPP must review the collaborator consent documents to ensure that the CoC boilerplate text is present.  Lastly, the U-M PI should provide collaborators with a copy of the NIH online CoC application and the NIH-issued CoC documentation, once received.  Refer to the HRPP guidance for more information.

    For multi-site research where U-M will roll-up under the protections of another institution's CoC: the U-M PI should obtain instructions from the institution holding the CoC.  However, you should expect to receive a request from the covering institution to obtain a signed LOA from the U-M institutional official, for their records.  In addition, you should obtain a copy of the NIH-issued CoC documentation from the covering institution that must then be uploaded to section 11-2 of the IRB application. 

    Questions?

    Contact the following for questions regarding Certificates of Confidentiality:

    For IRB-HSBS studies:

    Mary Ramirez, CIP
    Assistant Director
    Health Sciences and Behavioral Sciences Institutional Review Board
    HRPP/UMOR
    (734) 615-9464
    mramirez@umich.edu 

    For IRBMED studies:

    Corey Zolondek, Ph.D., CIP
    Assistant Director, Regulatory Operations
    Institutional Review Boards
    University of Michigan Medical School
    (734) 763-4768
    zolondek@med.umich.edu