Notice: Changes to NIH policy for issuing Certificates of Confidentiality

This notice is provided by the Institutional Review Board/Human Subjects Protection Office of Penn State Health Milton S. Hershey Medical Center/Penn State College of Medicine.

Date: Oct. 13, 2017
From: Kathleen A. Hay, PhD, CIP, Director, Human Subjects Protection Office
Subject: Notice of Changes to NIH Policy for Issuing Certificates of Confidentiality
Get printable version (PDF)

In response to the 21st Century Cures Act, enacted Dec. 13, 2016, NIH has updated its policy for issuing Certificates of Confidentiality (Certificates) for NIH-funded and conducted research that involves biomedical, behavioral, clinical or other research, in which identifiable, sensitive information is collected. Certificates of Confidentiality protect the privacy of subjects by limiting the disclosure of identifiable, sensitive information.

Previously, Certifications were obtained through an application process, but NIH will now provide Certificates automatically to any NIH-funded recipients conducting research applicable to this Policy. The updated NIH Policy applies to all biomedical, behavioral, clinical, or other research funded wholly or in part by the NIH, and indicates that all research that was commenced or ongoing on or after Dec. 13, 2016, and is within the scope of this Policy is deemed to be issued a Certificate through this Policy and is required to protect the privacy of individuals accordingly. This Policy will be included in the NIH Grants Policy statement as a standard term and condition of award effective Oct. 1, 2017, for new and noncompeting awards. Certificates issued in this manner will not be issued as a separate document.

The following summary outlines the criteria used to determine if a Certificate of Confidentiality is required.

Applies to NIH-funded research that collects/uses identifiable, sensitive data

• Involves human subjects as defined by the regulations;
• Collects or uses biospecimens that are identifiable to an individual;
• If collecting/using biospecimens, there is a small risk that some combination of the biospecimen, a request for the biospecimen and other available data sources could be used to deduce the identity of an individual; OR
• Involves generation of individual level, human genomic data from biospecimens

See details on this policy and Certificates of Confidentiality on the NIH website.

See the 2017 NIH Certificates of Confidentiality Policy (NOT-OD-17-109).

According to the Policy, for studies in which informed consent is sought research subjects must be informed of the protections and the limits to protections provided by a CoC.

What does this mean for researchers and research studies?

New NIH-funded studies in which informed consent is sought: Include CoC text in section 7a of the consent form.

Ongoing NIH-funded studies: For those commenced or ongoing on or after Dec. 13, 2016, in which informed consent is sought, submit a CATS IRB Modification by the next continuing review as follows:

• If open to accrual: Submit a revised consent from with CoC text in section 7a
• If the study has current, active subjects: Submit an addendum to consent or an alternate consent process (verbal notification or written summary)
• If the study has subjects who completed study: No need to re-consent

Note: These actions may change as more guidance is received from NIH.

See suggested consent language from the NIH here.

If you're having trouble accessing this content, or would like it in another format, please email the Penn State College of Medicine web department.