You are here

Certificates of Confidentiality

U-M General Application Requirements

For non-federally-funded research, or research funded by an HHS agency not having its own CoC application process, send the following materials to HRPPCoCgroup@umich.edu only after obtaining full IRB approval OR contingent approval where applying for the CoC is the only contingency remaining:

  1. a copy of your IRB approval/contingent approval
  2. a copy of your consent/assent documents
  3. a copy of the Key Personnel Listing template

Typically, the key personnel listing should be consistent with the individuals appearing on the eResearch application who will have interaction with human subjects.  This includes having access to directly identifiable data OR access to data that could be re-identified via codes/links. 

  1. copies of any Drug Enforcement Certification of Registration forms, as applicable

For research funded by HRSA or SAMHSA:  These agencies require that you apply to them to obtain your CoC.  Please scan and send (as one file) a copy of all application materials required by the agency to HRPPCoCgroup@umich.edu, prior to sending to the agency.  The researcher must include the U-M designated signator name, contact information, and signature line following the PI signature line in the application, as listed below:

Lois Brako, Ph.D.
Assistant Vice President for Research-
Regulatory and Compliance Oversight
University of Michigan
North Campus Research Complex
2800 Plymouth Road
Bldg. 520, Rm. 1190
48109-2800

CoC submissions to the NIH may not occur until you have IRB approval and have first applied to the U-M HRPP office.

 

Certificate of Confidentiality (CoC) protects the privacy of research subjects by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the subject consents to such disclosures or in other limited specific situations.  Small differences in procedures exist depending on whether the research is NIH funded.

CoCs are issued by different federal agencies, most typically by the National Institutes of Health (NIH).

  • For NIH-funded research, the CoC is automatically included as a term and condition of the NIH award.  The NIH also issues CoCs for other federally funded research (where a CoC is not included as a term and condition of award) or for non-federally funded research that falls within the mission of the NIH.
  • For research funded by the Centers for Disease Control and Prevention (CDC), the Health Resources and Services Administration (HRSA), the Substance Abuse and Mental Health Services Administration (SAMHSA), or funded by or operating under the authority of the Food and Drug Administration (FDA), a CoC is included as a term and condition of the award.  Non-funded researchers may not apply for and obtain a CoC from these agencies.  NOTE:  If you are funded by HRSA or SAMHSA, you must apply to the respective agency to obtain your CoC (see details below under HHS Agencies that Issue CoCs as a Term and Condition of Award AND in the side bar U-M General Application Requirements).  Once you compile your CoC application materials per the agency's requirements, and before you send to the agency, you will submit the materials to the U-M HRPP office at HRPPCoCgroup@umich.edu for review.    
  • For other HHS agencies (that do not provide a CoC as a term and condition of the award) or for research without federal funding, researchers may apply for an NIH CoC if a primary focus of the research is within the NIH mission (i.e., health/mental health-related).

    Certificate of Confidentiality Review Processes

    It is recommended that you review and become familiar with the NIH CoC policy and FAQs found at the NIH CoC Kiosk.  Researchers should discuss the CoC protections, limitations, and application process with all collaborators as part of project planning.

    Current NIH-Funded Research

    Effective October 1, 2017 all NIH-funded research commenced or on-going as of December 13, 2016, were issued a CoC as a term and condition of the NIH award.  The researcher does not have to apply to the NIH for the CoC nor does the NIH issue a separate CoC document.  However, should NIH funding end and new subjects are still being enrolled or data or biospecimens are still being collected from existing subjects, the researcher must obtain a new CoC using the applicable application process described below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.

    For on-going research at the time the new CoC policy was implemented where the CoC was not discussed in the consent document, researchers may have to notify current subjects about the CoC and/or update the IRB application and revise their informed consent document(s).  Discuss this with the IRB having oversight authority for your research and submit an amendment to make the changes, as instructed by your IRB.

    Researchers should carefully review the new NIH CoC policy to learn about the expanded protections and limitations around disclosures.  In addition, researchers must ensure that any collaborators (i.e., sub-awardees, sub-contractors) that will collect, receive or access identifiable, sensitive data are made aware of the presence of the CoC, its protections, and limitations on disclosure, as part of your planning or on-going communications.  This may include ensuring that any sub-awardee/sub-contractor includes the required CoC text in consent/assent documents.  Communication of the CoC information may also be covered by the sub-award/contract.  NOTE:  If there are non-NIH funded researchers engaged in the U-M research, they must apply to the NIH for their own CoC (i.e., U-M will not allow them to "roll-up" under our CoC).  For more information, see Multi-Site/Collaborative Research below.

    With the automatic NIH-issued CoC (because you hold direct or sub-award/sub-contracting NIH funding), researchers do not have to amend or extend the CoC as previously required under the old CoC policy.  

    To remain compliant, it is the PI's responsibility to ensure that:

    • All funding is accurately described in the eResearch application
    • Consents/assents are up-to-date with the appropriate CoC statement
    • A new CoC is obtained should funding end and is not renewed via a No Cost Extension or a new award

    NOTE:  if the PI obtained a CoC prior to the policy change and they also have NIH funding, CoC coverage is based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, coverage is good until 2022).

    HHS Agencies that Issue CoCs as a Term and Condition of Award

    Each agency named below provides a CoC as a term and condition of funding.  CoCs from these agencies are only available via their funding.  For more information, follow the links to the agency webpages:

    For other HHS agencies not named in this section, you may apply to the NIH for a CoC following the instructions given below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.

    Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process

    Effective March 19, 2020, the NIH changed the online system for submitting Certificate of Confidentiality applications.  As a result, the U-M HRPP has modified their CoC intake, review, and confirmation process, effective April 1, 2020.

    STEP 1:  Actions to Complete Prior to Submitting to the U-M HRPP

    1. Include the IRBMED or IRB-HSBS CoC text in consent/assent documents for IRB review.  If using assent documents, the CoC text may be modified as necessary, and as approved by the IRB, for the age and reading level of the children.  
    2. You must obtain IRB full approval, or contingent approval where applying for the CoC is the only contingency.

    STEP 2:  Submitting to the U-M HRPP

    1. Prepare the following materials and SCAN AS ONE DOCUMENT:
    • a copy of your IRB approval/contingent approval
    • a copy of your consent/assent documents
    • a copy of the Key Personnel Listing template*
    • copies of any Drug Enforcement Certification of Registration forms, as applicable

    *Typically, the key personnel listing should be consistent with the individuals appearing on the eResearch application who will have interaction with human subjects.  This includes having access to directly identifiable data OR access to data that could be re-identified via codes/links. 

    1. Send an email to HRPPCoCgroup@umich.edu, attaching the single scanned document, and use the following text for your message (inserting the requested information, as indicated by the brackets):

    This is a CoC application for [name of PI].

    The study is a [single site/multi-site] project.

    The person to contact with any questions is [name].

    The PI confirms that no application has yet been submitted to the NIH. 

    1. Upon receipt of your materials, you will receive an acknowledgement email with additional information about the review process and next steps.

    STEP 3:  U-M HRPP Administrative Review

    CoC applications will undergo an administrative review by a representative of the overseeing IRB for the project.  The administrative review is conducted to ensure that:

    • the consent document includes text about the CoC (consult with IRB for requirements)
    • the IRB approval is current (initial application, SCR, or AME approval as applies)
    • the Key Personnel listing is consistent with the study team listed in your eResearch application

    When the administrative review is completed, the PI will be instructed to go to the NIH CoC website to create and submit the application.  PIs should not create the NIH application until instructed to do so by the U-M HRPP.  

    STEP 4:  Submitting your NIH CoC Application

    The new NIH system does not allow the PI to save their application, nor does it allow the U-M HRPP to send the application back to the PI to make corrections.  Therefore, PIs want to be sure to enter the information into the NIH application as accurately as possible.  Should errors exist in the application, the only recourse available for correction is to complete a whole new application.

    After receiving the go-ahead from the HRPP, you will create your application in the NIH system.  The application is relatively short and most of the information you will provide is straight-forward and brief.  However, it is important that you complete the following items as described:

    Item 12:

    North Campus Research Complex

    2800 Plymouth Rd, Bldg 520, Rm 1190

    Ann Arbor

    USA

    Michigan

    48109

    Item 13:  Lois Brako, Ph.D., Assistant Vice President for Research

    Item 14:  lbrako@umich.edu

    Item 15:  734-615-8936  

    Item 16:  University of Michigan

    Item 17:  Provide your address (or other U-M address), as applies

    Item 23:  You will be asked to enter your Key Personnel.  This information should be consistent with what you submitted to the HRPP in the Key Personnel Listing document and with what appears in your eresearch application.

    STEP 5:  Confirmation Process

    Upon submission of your NIH CoC application, the U-M Institutional Official (IO) will receive an email notification from the NIH with a link to your application.  If the application is accurate and there are no questions, the IO will formally agree to the CoC Assurances and issue the confirmation in the system. 

    STEP 6:  After the IO Confirmation has been Issued

    After the IO has issued the confirmation, you can expect to receive your NIH CoC (typically, this takes 1-3 weeks, on average).  When you receive the CoC, you must do the following:

    IRBMED Research

    • Send an email to mramirez@umich.edu cc: kroger@umich.edu to alert us that you have received the CoC.  We will add your information to the HRPP CoC database.
    • Submit an amendment to upload the CoC to section 11-2 of your eResearch application.

    IRB-HSBS Research

    • Send an email to mramirez@umich.edu cc: kroger@umich.edu to alert us that you have received the CoC.  We will add your information to the HRPP CoC database.
    • Upload a copy of the CoC to section 11-2 of your eResearch application.  Once you have completed this step, IRB-HSBS will issue full approval for your application and you may begin your research.

    CoCs and Compliance

    The U-M HRPP office tracks all studies holding a CoC.  The HRPP office typically sends reminders to investigators about expiring NIH funding or expiring CoCs that were obtained via direct application to the NIH (3 months prior to the funding period end date or the NIH expiration expiration date, respectively).

    It is the PI's responsibility to ensure that:

    • All funding is accurately described in the eResearch application 
    • The eresearch HUM number appears in ORSP records linked to the funding
    • Consents/assents are up-to-date with the appropriate CoC statement
    • CoCs are uploaded to the eresearch application
    • New CoCs are obtained, as necessary, and
    • Researchers with whom you share identifiable (or coded and linked) data or biospecimens are informed about the CoC protections and limitations around disclosure

    NOTE:  If the PI obtained a CoC prior to the policy change and subsequently obtains NIH funding, CoC coverage is based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, CoC coverage is good until 2022).

    As of April 15, 2020, the NIH no longer accepts amendments or extensions to CoCs.  If you are still enrolling subjects or collecting data or biospecimens from existing subjects, and:

    • there are substantive changes to the research project (e.g., new PI takes over the project or the project moves to a new institution), or
    • the current CoC expires, or
    • your NIH funding ends and is not renewed -

    You must obtain a new CoC following the application instructions above.

    Multi-Site/Collaborative Research

    Effective September 1, 2019, where U-M is NIH funded, the U-M HRPP no longer accepts signed CoC Assurances from unfunded collaborator/multi-site researchers (i.e., not an NIH direct or sub-award recipient or U-M sub-contractor who is paid with NIH monies).  If collecting identifiable, sensitive subject data/biospecimens, unfunded collaborator/multi-site researchers must apply directly to the NIH for a CoC to cover their research activities in the project.

    Similarly, where unfunded U-M researchers are working on a project where the Lead site holds a CoC via funding, U-M will not sign that institution’s CoC Assurances.  The unfunded U-M researcher must apply directly to the NIH for a CoC to cover their research activities in the project, if the work involves the collection of identifiable, sensitive data/biospecimens and falls within the NIH mission.

    Researchers who accepted signed Assurances from non U-M collaborators/multi-sites, or where U-M signed another institution’s CoC Assurances, prior to September 1, 2019 are not affected by this change in policy.

     

    References and Resources

    Questions?

    Contact the following for questions regarding Certificates of Confidentiality:

    For IRB-HSBS studies:

    Mary Ramirez, CIP
    Assistant Director
    Health Sciences and Behavioral Sciences Institutional Review Board
    HRPP/UMOR
    (734) 615-9464
    mramirez@umich.edu 

    For IRBMED studies:

    Corey Zolondek, Ph.D., CIP
    Assistant Director, Regulatory Operations
    Institutional Review Boards
    University of Michigan Medical School
    (734) 763-4768
    zolondek@med.umich.edu