You are here

Certificates of Confidentiality

Federal Agencies with a Distinct CoC Process

  • DOJ
  • AHRQ
  • CDC
  • HRSA
  • IHS
  • FDA - for use of an investigational drug/device in a research study operating under FDA authority (regardless of the study's funding source)

Review the reference table offered by NIH for contact/submission information.

Pre-review of the application packge by the U-M HRPP is required for CoC submission to these federal agencies.  Follow steps 1-2 of the CoC process document to submit the application package to the HRPP.  Include the U-M designated signatory information following the PI signature line in the application:

Sana Shakour, Ph.D.
Associate HRPP Director
University of Michigan
North Campus Research Complex
2800 Plymouth Road
Bldg. 520, Rm. 1172

Upon issuance of the CoC, notify

Before applying for a certificate of confidentiality, U-M investigators must first obtain a review of the application package by the U-M HRPP.

Certificate of Confidentiality (CoC) protects the privacy of human research participants by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the participant consents to such disclosures or in other limited specific situations.  

CoCs are generally issued by a U.S. federal agency, most typically by the National Institutes of Health (NIH), as a term and condition of funding on an award sponsored by that agency.

NIH CoC Process

New NIH-funded Research

The National Institutes of Health (NIH) automatically issue a CoC for a human research study as a term and condition of the funding on an NIH-sponsored award.  A principal investigator (PI) does not need to apply for a CoC on an NIH-funded project and the NIH does not issue a separate CoC document.

Blue info iconAn NIH-issued CoC cannot be extended or amended.  If changes are required, or should NIH funding end and new participants are still being enrolled or data or biospecimens are still being collected from existing participants, the Principal Investigator (PI) must apply for a new CoC using the NIH's online CoC system.

Ongoing NIH-funded Research as of Dec. 13, 2016

Effective October 1, 2017 all NIH-funded research commenced or on-going as of December 13, 2016, were issued a CoC as a term and condition of the NIH award.  If the CoC was not discussed in the consent document, researchers may have to notify current subjects about the CoC and/or update the IRB application and revise their informed consent document(s).  Discuss this with the IRB having oversight authority for your research and submit an amendment to make the changes, as instructed by your IRB.

NOTE:  If the PI obtained a CoC prior to the 2017 NIH policy implementation and subsequently obtained NIH funding for that project, CoC coverage will be based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, CoC coverage is good until 2022).

Multi-site Research with Unfunded Collaborators

Effective September 1, 2019, the U-M HRPP no longer accepts signed CoC Assurances from unfunded collaborator/multi-site researchers (i.e., not an NIH direct or sub-award recipient or U-M sub-contractor who is paid with NIH monies).  If collecting identifiable, sensitive participant data/biospecimens, unfunded collaborator/multi-site researchers must apply directly to the NIH for a CoC to cover their research activities in the project.

For unfunded U-M researchers working on a project where the Lead site holds a CoC via funding, or where an unfunded Lead site holds a CoC via direct application to the NIH, U-M will not sign that institution’s CoC Assurances.  The unfunded U-M researcher must apply directly to the NIH for a CoC to cover their research activities in the project, if the work involves the collection of identifiable, sensitive data/biospecimens and falls within the NIH mission.

Where a ceding agreement between U-M and another institution (or private IRB) is in place, it is up to the Deputy Institutional Official's (DIO) discretion whether to sign the CoC Assurances on behalf of U-M on a case-by-case basis.

When to Use the NIH CoC Application System

  1. For research funded by a non-federal entity (e.g., industry sponsor, internal funding).
  2. For research funded by an HHS agency that does not have its own CoC application.
  3. To apply for the a new CoC in situtations where the NIH-sponsored funding has ended and will not be renewed via a No Cost Time Extension or a new award, but the associated human research continues to enroll participants or collect data/biospecimens.
  4. To apply for a new CoC if there are substantive changes to the research project (e.g., new PI takes over the project or the project moves to a new institution, major changes in the scope or direction of the research protocol, or changes in the drugs to be administered, if any, and or changes to the persons who will adminster the drugs).
  5. To cover unfunded research collaborators (i.e., those not receiving NIH funds or paid with NIH monies) who are collecting identifiable, sensitive research participant data/biospecimens as part of an NIH-funded (direct or prime) project.

U-M HRPP CoC Application Requirements

Warning IconPrior to submitting the CoC application package to the NIH or other funding agency, you must have IRB approval for the study and have received an administrative review of the application package by the U-M HRPP. PIs should not create the NIH application (or other agency application) until instructed to do so by the U-M HRPP.

Download the U-M HRPP CoC Application 

CoCs and Compliance

The U-M HRPP office tracks all studies holding a CoC.  The HRPP office typically sends reminders to investigators about expiring NIH funding or about expiring CoCs that were obtained via direct application to the NIH three months prior to the funding period end date prior to the funding period end date or the NIH expiration expiration date, respectively. 

Principal Investigator Responsibilities

PIs should review the NIH CoC policy to learn about the expanded protections and limitations around disclosures and be prepared to discuss the CoC protections, limitations, and application process with all collaborators as part of project planning or on-going communications, including with sub-awardees, sub-contractors who will collect, receive or access identifiable, sensitive data. This may include ensuring that any sub-awardee/sub-contractor includes the required CoC text in consent/assent documents.  Communication of the CoC information may also be covered by the sub-award/contract.  For additional guidance, review the NIH resources in the References & Resources section below.

It is the PI's responsibility to ensure that:

  • All funding is accurately described in the eResearch application 
  • The U-M HUM number (i.e., project id) appears in ORSP records linked to the funding
  • Consents/assents are up-to-date with the appropriate CoC statement
  • CoCs are uploaded to the IRB application
  • New CoCs are obtained, as necessary
  • Researchers with whom you share identifiable (or coded and linked) data or biospecimens are informed about the CoC protections and limitations around disclosure.
  • Unfunded collaborators who are collecting identifiable, sensitive research participant data/biospecimens as part of the project apply for a CoC to cover their work on the project.

References and Resources

NIH Guidelines

  • NIH CoC Webpage NIH policy & compliance webpage for certificates of confidentiality
  • NIH CoC FAQs Link to the NIH's webpage of frequently asked questions for certificates of confidentiality
  • NIH Online CoC Request System Link to the NIH system to request a CoC.  Reminder:  U-M investigators must first obtain U-M HRPP review of the application package prior to using this system.


Contact for questions regarding Certificates of Confidentiality for human research.