Certificate of Confidentiality SBS

Unlike doctors or lawyers, researchers do not have the legal privilege of confidentiality with their study participants. Though a researcher may pledge to keep a participant’s information confidential, that information must be disclosed if a researcher receives a valid subpoena.  For research that involves sensitive information (information that could be damaging to a participant in a legal proceeding such as a custody case) or illegal behaviors, this presents an obstacle for both researchers and participants. If researchers are unable to protect the confidentiality of their participants, the participants are less likely to participate in needed studies. In response, Congress enacted a law allowing researchers to obtain a Certificate of Confidentiality, which permits researchers to refuse to disclose identifying information about their participants when subpoenaed by a court of law.

A Certificate of Confidentiality is not without its limitations. If a participant volunteers information beyond the scope of the study, that information could be subpoenaed. A researcher can breach confidentiality if the researcher suspects child abuse or if the participant is threatening violence against others.  

Applying for a Certificate of Confidentiality

Do I need a Certificate of Confidentiality? 
Studies that need a Certificate of Confidentiality include but are not limited to:

• Using a legally at-risk population, such as abusers of illegal substances, prisoners, victims of crime, persons with conditions that might affect custody cases, etc., where the data collected from these individuals describes their illegal or sensitive behaviors.  Although using these participants may make it more likely for a researcher to learn information about sensitive or illegal behaviors, it is not the participant that determines the need for a Certificate of Confidentiality, but the data collected about the participant.
• Asking questions about illegal or sensitive behavior. If the participants are minors, this may include asking questions about tobacco and alcohol use. For more information, see Including Risk-Sensitive Populations in Research.

Where can I apply for a Certificate of Confidentiality? 
Most social and behavioral science research can obtain a Certificate of Confidentiality through the National Institutes of Health (NIH). Studies that are funded by the NIH have an automatic Certificate of Confidentiality and don't need to apply for additional certification. For non-NIH funded studies, the NIH will also consider applications for a CofC. For more information, please see their website: https://grants.nih.gov/policy/humansubjects/coc.htm

IRB Approval and a Certificate of Confidentiality 
In order to obtain a Certificate of Confidentiality, you must have IRB approval. However, in order to obtain IRB approval, the Board will want to know in your protocol that your intention is to obtain a Certificate of Confidentiality. Your IRB approval will be provisional and you will not be able to conduct your study until you have submitted a copy of your Certificate of Confidentiality to the Board. Please note that the NIH will require that you put specific template language in your consent form. When you submit your Certificate of Confidentiality to the IRB, please submit a final copy of your consent form(s).

A word of caution: if your protocol needs a Certificate of Confidentiality, it is likely that it is a riskier study, which will require at least one review by the full board, if not more. You should plan for at least six weeks for review by the IRB-SBS; the NIH recommends planning for at least three months for their approval. 

Protocol and Consent Form Additions

iProtocol 
In general, the Board will want to know that you are considering the risks and the needs of the participants in your study. Take a little extra time to make sure that you have addressed the likely scenarios for an adverse event, etc. The Board is more likely to agree with your procedures if they are well-designed and explained. More specifically, please include the following in your protocol:

• State that the nature of the data you are collecting requires you to obtain a Certificate of Confidentiality and that you are in the process of applying for a Certificate of Confidentiality (if you don't have NIH funding). Describe how you will collect and store your data so that participants’ identities will be protected. 
• Describe the risks to the participants, including the risk of lost confidentiality with your data (if a participant's identity became known to their victimizer, for example), and explain your procedures for protecting your participants (i.e. data storage security procedures and obtaining a Certificate of Confidentiality).
• Once you have a Certificate of Confidentiality, it will need to be upload the documentation in the Permissions sections. 

Consent Form 
In the consent form, the NIH recommends that you include specific text regarding the Certificate of Confidentiality. The Board will also require that the text in the consent form is easy to read and understand, particularly if your participants’ reading comprehension level is low. It can be difficult to balance both the need to include all the necessary information and the need to do it in a way that can be understood. Please know that your pre-reviewer will be able to either help you with this effort or refer you to other experts as well.

The following consent template text is from the NIH website. Please tailor this text to your study and to the participants involved (i.e. appropriate reading level, language appropriate for minors).

Certificate of Confidentiality: This research is covered by a Certificate of Confidentiality from the National Institutes of Health. This means that the researchers cannot release or use information, documents, or samples that may identify you in any action or suit unless you say it is okay. They also cannot provide them as evidence unless you have agreed.  This protection includes federal, state, or local civil, criminal, administrative, legislative, or other proceedings. An example would be a court subpoena. 
  
There are some important things that you need to know.  The Certificate DOES NOT stop reporting that federal, state or local laws require. Some examples are laws that require reporting of child or elder abuse, some communicable diseases, and threats to harm yourself or others.  The Certificate CANNOT BE USED to stop a sponsoring United States federal or state government agency from checking records or evaluating programs. The Certificate DOES NOT stop disclosures required by the federal Food and Drug Administration (FDA).  The Certificate also DOES NOT prevent your information from being used for other research if allowed by federal regulations. 
  
Researchers may release information about you when you say it is okay. For example, you may give them permission to release information to insurers, medical providers or any other persons not connected with the research. The Certificate of Confidentiality does not stop you from willingly releasing information about your involvement in this research. It also does not prevent you from having access to your own information.