What is a Certificate of Confidentiality (CoC)? It is an authorization from the Department of Health and Human Services (DHHS) that
helps researchers and their institutions safeguard the privacy of research participants
enrolled in sensitive biomedical and behavioral research by protecting against compulsory
legal demands such as subpoenas for identifying information.
What does it do? Research institutions can use a CoC to avoid forced disclosure of names and other
identifying characteristics about research participants. It is used to oppose subpoenas
and other compulsory demands.
Are there circumstances where a CoC cannot be used to resist disclosure?
When the disclosure is requested in writing by the research participant, their legal
guardian, or their legal representative.
To DHHS or FDA in certain situations such as research audits as required by law
Are there circumstances where information about study participants may be voluntarily
disclosed by the Investigator or Institution? Investigators and their institutions may (and should be prepared to) make disclosures
to prevent serious harm to the participant or to someone else, including child abuse
and to voluntarily comply with state and local reporting requirements for communicable
diseases. The consent form should explain these and any other circumstances of voluntary
What DHHS agencies are authorized to issue CoCs? NIH, CDC, HRSA, HIS, and SAMSA can issue CoCs for research that they fund; FDA is
authorized to issue CoCs for studies with an IND/ IDE that do not have other DHHS
Is research that is not funded by DHHS eligible for a CoC? NIH is authorized to issue CoCs for sensitive research that is not federally funded,
at its discretion, if the research is related to the NIH mission. Additionally, the
research must be approved by an IRB operating under an approved Federal-wide Assurance
and must accurately reflect the protections and limitations of the CoC in the subject