You are here
U-M Certificate of Confidentiality Policy
For non-federally-funded research, or research funded by an HHS agency not having its own CoC application process, send the following materials to HRPPCoCgroup@umich.edu:
- The "downloaded" version of the CoC application, the IRB approval letter, and the IRB approved consent document(s).
- The Letter of Assurances:
- Use the required template; print on your U-M departmental letterhead and sign.
- The Letter of Assurances must list the following information for the U-M designated signator:
Lois Brako, Ph.D.
Assistant Vice President for Research-
Regulatory and Compliance Oversight
University of Michigan
North Campus Research Complex
2800 Plymouth Road
Bldg. 520, Rm. 1190
For research funded by HRSA or SAMHSA, scan and send (as one file) a copy of all application materials required by the agency to HRPPCoCgroup@umich.edu, prior to sending to the agency. The researcher must include the U-M designated signator name, contact information, and signature line following the PI signature line in the application.
Important Notices - Please Read Before Continuing into our Webpage!
March 19, 2020: This website is currently undergoing revisions specific to the U-M HRPP application process. Please contact Mary Ramirez at 734-615-9464 or at firstname.lastname@example.org to learn what you must do to apply for a CoC. CoC submissions to the NIH may not occur until you have IRB approval and have applied to the U-M HRPP office.
September 1, 2019: Effective September 1, 2019, non NIH-funded U-M PIs who are conducting research with an NIH-funded lead site or collaborator, will have to apply to the NIH for a CoC to cover their part in the project if they are collecting or maintaining "identifiable, sensitive" data/biospecimens. Click here for more information.
A Certificate of Confidentiality (CoC) protects the privacy of research subjects by prohibiting forced disclosure of their individually identifiable, sensitive research information, records, or data to anyone not associated with the research, except when the subject consents to such disclosures or in other limited specific situations. Small differences in procedures exist depending on whether the research is NIH funded.
CoCs are issued by different federal agencies, most typically by the National Institutes of Health (NIH).
- For NIH-funded research, the CoC is automatically included as a term and condition of the NIH award. The NIH also issues CoCs for other federally funded research (where a CoC is not included as a term and condition of award) or for non-federally funded research that falls within the mission of the NIH.
- For research funded by the Centers for Disease Control and Prevention (CDC), the Health Resources and Services Administration (HRSA), the Substance Abuse and Mental Health Services Administration (SAMHSA), or funded by or operating under the authority of the Food and Drug Administration (FDA), a CoC is included as a term and condition of the award. Non-funded researchers may not apply for and obtain a CoC from these agencies. NOTE: If you are funded by HRSA or SAMHSA, you must apply to the respective agency to obtain your CoC (see details below under HHS Agencies that Issue CoCs as a Term and Condition of Award AND in the side bar U-M Requirements). Once you compile your CoC application materials per the agency's requirements, and before you send to the agency, you will submit the materials to the U-M HRPP office at HRPPCoCgroup@umich.edu for review.
- For other HHS agencies (that do not provide a CoC as a term and condition of the award) or for research without federal funding, researchers may apply for an NIH CoC if a primary focus of the research is within the NIH mission (i.e., health/mental health-related).
Certificate of Confidentiality Review Processes
It is recommended that you review and become familiar with the NIH CoC policy and FAQs found at the NIH CoC Kiosk. Researchers should discuss the CoC protections, limitations, and application process with all collaborators as part of project planning.
Current NIH-Funded Research
Effective October 1, 2017 all NIH-funded research commenced or on-going as of December 13, 2016, were issued a CoC as a term and condition of the NIH award. The researcher does not have to apply to the NIH for the CoC nor does the NIH issue a separate CoC document. However, should NIH funding end and new subjects are still being enrolled or data or biospecimens are still being collected from existing subjects, the researcher must obtain a new CoC using the applicable application process described below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.
For on-going research at the time the new CoC policy was implemented where the CoC was not discussed in the consent document, researchers may have to notify current subjects about the CoC and/or update the IRB application and revise their informed consent document(s). Discuss this with the IRB having oversight authority for your research and submit an amendment to make the changes, as instructed by your IRB.
Researchers should carefully review the new NIH CoC policy to learn about the expanded protections and limitations around disclosures. In addition, researchers must ensure that any collaborators (e.g., sub-awardees, sub-contractors) that will receive or access identifiable, sensitive data are made aware of the presence of the CoC, its protections, and limitations on disclosure, as part of your planning or on-going communications. Communication of the CoC information may also be covered by the sub-award/contract. NOTE: If there are non-NIH funded researchers engaged in the research, they must apply to the NIH for their own CoC (i.e., U-M will not allow them to "roll-up" under our CoC).
With the automatic NIH-issued CoC, researchers do not have to amend or extend the CoC as previously required under the old CoC policy.
The U-M HRPP office tracks all studies holding a CoC. The HRPP office or the IRB may periodically send reminders to investigators about expiring funding or CoCs that were obtained via direct application to the NIH. It is the PI's responsibility to ensure all funding is accurately described in the eResearch application, maintain up-to-date consents with the appropriate CoC statement, and amend/extend directly-issued CoCs as necessary. NOTE: if the PI obtained a CoC prior to the policy change and they have NIH funding, CoC coverage is based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, coverage is good until 2022).
HHS Agencies that Issue CoCs as a Term and Condition of Award
Each agency named below provides a CoC as a term and condition of funding. CoCs from these agencies are only available via their funding. For more information, follow the links to the agency webpages:
- CDC: https://www.cdc.gov/od/science/integrity/confidentiality/guidance.htm
- FDA: https://grants.nih.gov/grants/guide/notice-files/NOT-FD-19-002.html or Email: OAGSGrantsPolicy@fda.hhs.gov
- HRSA (although a term and condition of the award, PI must apply for the CoC. Amendments and Extensions also required.): https://www.hrsa.gov/public-health/clinical/human-subjects/index.html
- SAMHSA (although a term and condition of the award, PI must apply for the CoC. Amendments and Extensions also required.): https://www.samhsa.gov/grants/gpra-measurement-tools/certificate-confidentiality
For other HHS agencies not named in this section, you may apply to the NIH for a CoC following the instructions given below in Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process.
Non-Federally-Funded Research and Research Funded by HHS Agencies Not Having a CoC Application Process
1. After receiving IRB approval and prior to submitting your online application to the NIH, compile the following materials for submission to the U-M Human Research Protection Program (HRPP) for review and sign-off:
- Copy of the online CoC Application (see page 4, item 7 to print correct copy): NOTE - Student research must show the Faculty Advisor as the PI on the CoC application and the student should be listed as Key Personnel. The student may be listed as the PI on the U-M eResearch application.
- Letter of Assurances (LOA) - Non-Students: Use the Letter of Assurances-Non-Student Researcher template (drop into your departmental letterhead before signing).
- Letter of Assurances (LOA) - Student Researcher: Use the Letter of Assurances-Student-Researcher template (drop into your departmental letterhead before signing).
- A copy of the IRB Approval or Contingent Approval letter: (if contingent approval was issued, obtaining the CoC must be the only remaining contingency to be met)
- IRB-reviewed and approved informed consent/assent documentation (if contingent approval was issued, the documentation will not display the approval watermark)
2. Obtain approval from U-M's designated signator:
Combine the application materials above into a single PDF document and email it to the University of Michigan Office of Research (UMOR) at HRPPCoCgroup@umich.edu. Please include the following information in your email:
- The name of the U-M PI that is submitting the application
- Whether the application is for a new CoC or to amend or extend/renew an existing CoC
- Whether this is a multi-site project and U-M's role (i.e., coordinating site only, research site only, or both): NOTE: U-M or collaborator institutions that are not NIH funded must each apply for their own CoC.
You will receive a confirmatory email for receipt of your materials. Once we confirm that your application packet is complete and the letter of assurances has been signed, you will receive a PDF version of the LOA via email.
3. Upload the signed LOA to your online CoC application and submit to the NIH.
4. Once you have obtained your CoC, you must upload the documentation to section 11-2 of the IRB application.
The U-M HRPP office tracks all studies holding a CoC. The HRPP office or the IRB may periodically send reminders to investigators about expiring funding or CoCs that were obtained via direct application to the NIH. It is the PI's responsibility to ensure all funding is accurately described in the eResearch application, maintain up-to-date consents with the appropriate CoC statement, and amend/extend directly-issued CoCs as necessary. NOTE: if the PI obtained a CoC prior to the policy change and subsequently obtains NIH funding, CoC coverage is based on the date allowing for the most time (e.g., "old" CoC expires 2020 but NIH funding ends 2022, coverage is good until 2022).
Amending or Extending your CoC: Please note that substantive changes to the research (e.g., change in PI, change in research aims and goals) may require a formal amendment to the CoC. In addition, each CoC is issued with an expiration date and may require formal extension via application at least 3 months prior to the expiration date. If you encounter either of these events, please consult with the NIH CoC Coordinator to confirm (1) whether you must complete a formal amendment or extension application and (2) obtain the formal application template or a link to the template.
Additional U-M HRPP guidance for Amendments to, or Extensions of, Existing CoCs: Amendments to, or extensions of, existing CoCs may require review by the U-M designated signator even if the issuing NIH agency does not require a re-review of your application materials. If the NIH does not require a formal application to amend or extend your existing CoC, you must complete the HRPP CoC Amendment/Extension Checklist. This information will help inform whether a formal application will be necessary for HRPP review.
Multi-Site/Collaborative Research: Effective September 1, 2019, where U-M is NIH funded, the U-M HRPP no longer accepts signed CoC Assurances from unfunded collaborator/multi-site researchers (i.e., not an NIH direct or sub-award recipient or U-M sub-contractor who is paid with NIH monies). If collecting identifiable, sensitive subject data/biospecimens, unfunded collaborator/multi-site researchers must apply directly to the NIH for a CoC to cover their research activities in the project.
Similarly, where unfunded U-M researchers are working on a project where the Lead site holds a CoC via funding, U-M will not sign that institution’s CoC Assurances. The unfunded U-M researcher must apply directly to the NIH for a CoC to cover their research activities in the project, if the work involves the collection of identifiable, sensitive data/biospecimens and falls within the NIH mission.
Researchers who accepted signed Assurances from non U-M collaborators/multi-sites, or where U-M signed another institution’s CoC Assurances, prior to September 1, 2019 are not affected by this change in policy.
Contact the following for questions regarding Certificates of Confidentiality:
For IRB-HSBS studies:
Mary Ramirez, CIP
Health Sciences and Behavioral Sciences Institutional Review Board
For IRBMED studies:
Corey Zolondek, Ph.D., CIP
Assistant Director, Regulatory Operations
Institutional Review Boards
University of Michigan Medical School