Certificates of Confidentiality

If a study is covered by a CoC, researchers:

• May not disclose or provide, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
• May not disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research.
• May disclose information only when:
  • Required by Federal, State, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings.
  • Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual;
  • Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
  • Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human participants in research.

Researchers conducting research covered by a certificate of confidentiality, even if the research is not federally funded, must ensure that if identifiable, sensitive information is provided to other researchers or organizations, the other researcher or organization must comply with applicable requirements when research is covered by a certificate of confidentiality

Please note the following for studies conducted at the AVAHCS and covered by a CoC:

• For studies that do not involve a medical intervention, no annotation may be made in the medical record.
• For studies involving medical intervention, a progress note in the medical record should be made, indicating the individual has been enrolled in a research study, any details that would impact clinical care, and the name and contact information of the researcher conducting the study.

All new and ongoing NIH-funded research meeting certain criteria is deemed to be issued a Certificate of Confidentiality (CoC) via a new NIH policy. (Previously, researchers had to proactively apply to the NIH for a CoC, and only if the study was collecting sensitive information from participants.)

The term "identifiable, sensitive information" means information about an individual that is gathered or used during biomedical, behavioral, clinical, or other research, where the following may occur:

• An individual is identified; or
• For which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual.

For more information about the change in policy, please see the policy notice.

Funded by NIH and was commenced or ongoing on or after December 13, 2016, and:

• Is "human subjects research" as defined by federal regulations, including exempt research where data is identifiable. Example include biomedical, behavioral, clinical, or other research, including exempt research, except where the information obtained is recorded in such a manner that human participants cannot be identified or the identity of the human participants cannot readily be ascertained, directly or through identifiers linked to the participants
• Or, is research involving the collection or use of biospecimens that are individually identifiable or for which there is at least a very small risk that some there is some way to deduce the identity of an individual;
• Or, is research that generates individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is "identifiable" per the Common Rule; or
• Or, is any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that the subject's identity could be deduced

For studies that obtain informed consent, the human subjects must be informed that their information is protected by a CoC, and what that means (protections and limitations). The IRB provides language in its consent form (ICF) template to be used in all new submissions meeting the above criteria.

The IRB has also provided an addendum (DOCX) to be used when consenting prospective subjects in ongoing research studies, until the study team updates the ICF to include the CoC language (more to come on when that will be required).

Yes. Once in place, the CoC applies to all data collected in the study, including data collected before the CoC was issued.

For non-federally funded research, you can apply for a CoC. To apply for a CoC, please take the following steps:

1. Go to the NIH's CoC Kiosk and complete the steps to submit your application electronically. After it is received, the NIH will provide you with a form that must be signed by the PI and the Emory Institutional Official.

2. Once you have the form ready to be signed, DO NOT send the form directly to the Emory Institutional Official. Instead, email the IRB analyst who is responsible for your study. If you are unsure who the analyst is, you may call us to find out, or you can send the CoC application directly to our main email address (irb@emory.edu).

In your email, please include the following:

1. The full CoC application, as an attachment, along with the "Assurances" form that needs to be signed;

2. The nature of the sensitive data to be generated during the research study;

3. How that data will be identifiable/linked to the subject;

4. Whether that sensitive information also exists somewhere outside the research record (e.g. HIV diagnosis already present in subjects' medical record - either at EHC or elsewhere - before the study begins). If the sensitive information is already present in another location that could be subpoenaed, then we may not sign off on the CoC application; we do not want subjects to have a false sense of security.

The CoC's protections – and limitations – must be stated in the Informed Consent form once the CoC is granted, and the language is dictated by the NIH. The consent templates posted on the Emory IRB website contain the required language.

The NIH prefers that you NOT state in the consent form that you are applying for a CoC. Only after the CoC is actually obtained should subjects be enrolled via a consent form that references the CoC. If the IRB agrees that enrollment prior to obtaining the CoC is acceptable, the IRB can approve a no-CoC version of the consent form, along with a CoC version that you can submit to the NIH with your CoC application - but which cannot be used to enroll until the CoC is granted.

If you are granted a CoC for a study that has already been approved, you should submit an amendment in eIRB to do the following:

1. Upload the approved CoC into the eIRB system under the "Miscellaneous Documents" section.
2. Add the required language in the ICF to note the CoC (refer to the most recent ICF template).

Finally, it is important to be aware of the differences between a CoC and "sensitive study status." When a study is declared to have "sensitive status," steps are taken to limit the amount of information that is put into the medical record. A CoC, however, doesn't limit the information put into the record but instead it covers that information with privacy protections. In other words, determining that a protocol has "sensitive study status" alone does not protect research data from subpoena, therefore a CoC may be recommended or even required in addition to the sensitive status determination.