UNIVERSITY OF TENNESSEE HEALTH SCIENCES CENTER INSTITUTIONAL REVIEW BOARD

CERTIFICATES OF CONFIDENTIALITY

1. PURPOSE
   
   To document the policies concerning Certificates of Confidentiality (CoC).
2. SCOPE
   
   This SOP applies to all studies approved by the UTHSC IRB.
   
   Personnel Responsible:
   
   University of Tennessee Health Sciences Center Institutional Review Board administrative staff and members, and investigators.
3. BACKGROUND
   
   Under the Public Health Service Act §301(d), 42 U.S.C. §241), as amended by Section 2012 of the 21st Century Cures Act enacted December 13, 2016, the Secretary of the Department of Health and Human Services may authorize persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of research subjects by prohibiting investigators from disclosing or providing to any person not connected with the conduct of such research, the name or any such information, document, or biospecimen that contains identifiable, sensitive information about a subject that was created or compiled for purposes of the research. “Identifiable, sensitive information” includes both information that identifies an individual, as well as information for which there is a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual. The privacy of the research subjects is protected through the issuance of Certificates of Confidentiality (CoC). Persons authorized under a CoC to protect the privacy of such individuals shall not disclose or provide in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding identifiable, sensitive information collected or used in research by an investigator or institution with a Certificate. In this way, CoCs help to minimize risks to subjects by adding an additional layer of protection regarding confidentiality.
   
   Under section 2012 of the 21^st Century Cures Act, the Secretary of Health and Human Services must issue a Certificate for any research study partially or fully supported by the federal government in which identifiable, sensitive information is collected. Certificates are issued automatically for NIH funded research, but must be requested for other federally supported research. In addition, the protection afforded by CoCs is not limited to federally supported research. Other researchers may obtain certificates of confidentiality provided that a determination is made that the research involves the collection of identifiable, sensitive information. Certificates are issued by the National Institutes of Health and other HHS agencies.
   
   The National Institutes of Health (NIH) considers research in which identifiable, sensitive information is collected or used, to include:

• Human subjects research as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46), including exempt research except for human subjects research that is determined to be exempt from all or some of the requirements of 45 CFR 46 if the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
• Research involving the collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual;
• Research that involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of the human subjects can readily be ascertained as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46); or
• Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual, as defined in subsection 301(d) of the Public Health Service Act.
  
  Protections Provided by Certificates of Confidentiality
  |
  Researchers who receive a CoC shall not:

• Disclose or provide, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or
• Disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research.
  
  Disclosure is permitted only when:

• Required by Federal, State, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to State and local health departments), excluding instances of disclosure in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding;
• Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual;
• Made with the consent of the individual to whom the information, document, or biospecimen pertains; or
• Made for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human subjects in research.
  
  Recipients of Certificates who receive NIH funding are required to ensure that any investigator or institution not funded by NIH who receives a copy of identifiable, sensitive information protected by a Certificate, understands that they are also subject to the NIH requirements. Recipients are also responsible for ensuring that any subrecipient that receives funds to carry out part of the NIH award involving a copy of identifiable, sensitive information protected by a Certificate understands that they are also subject to these requirements.
  
  Length of Protection
  
  The research subjects’ identifiable, sensitive information that was created or complied in the specified research project during any time the CoC is in effect is protected permanently, even if the subject gave the researcher the identifiable, sensitive information before the CoC was issued. Furthermore, after the expiration of the CoC, the protections provided hold in perpetuity for any identifiable, sensitive information gathered during the period prior to the expiration of the CoC.
  
  In accordance with:
  
  Public Health Service Act § 301(d), 42 U.S.C. § 241(d) Section 2012 of the 12st Century Cures Act, P.L. 114-255
  
  OHRP Guidance on Certificates of Confidentiality (02/25/2003) https://www.hhs.gov/ohrp/regulations-and-policy/guidance/certificates-of-confidentiality/index.html#:~:text=This%20protection%20is%20not%20limited,from%20forced%20or%20compelled%20disclosure.
  
  Certificate of Confidentiality Frequently Asked Questions
  For more information on Certificates of Confidentiality and their limitations and For Certificate of Confidentiality contacts at the National Institutes of Health and Other HHS Agencies
  https://www.hhs.gov/ohrp/regulations-and-policy/guidance/certificates-of-confidentiality/index.html
  
  Compliance with this policy also requires compliance with state or local laws or regulations which provide additional protections for human subjects.
  
  IV PROCEDURES
  1. Effective October 1, 2017, for studies wholly or partially funded by NIH using identifiable, sensitive information that was on-going on/after December 13, 2016, CoCs must be issued by the Secretary of Health and Human Services. For NIH-funded studies, the CoC will be issued automatically as a term and condition of award, and there will be no physical certificate issued. The Notice of Award and the NIH Grants Policy Statement serve as documentation of the CoC protection.
  2. For federally supported studies other than those funded by NIH, the investigator must request a CoC. The funding agency should be contacted to determine the process for securing a CoC, as some agencies issue their own certificates, while others rely on the NIH.
     1. Applications must be made for each specific protocol. OHRP’s website contains a list of contacts for different federal agencies concerning CoCs located at https://humansubjects.nih.gov/coc/contacts .
     2. CoCs are not transferable from one protocol to another, and may not be used to cover more than one protocol, unless separate protocols have the very same subject population.
     3. CoCs are effective the date issued; investigators must obtain an extension from HHS if the CoC will expire prior to completion of funding for the study. This request for an extension must occur at least 3 months prior to the expiration date on the certificate.
     4. If a researcher intends to make voluntary disclosures of confidential information, the consent form should clearly indicate the specific limitations that will be placed on the protection of confidentiality (e.g., suspected child abuse, intent to harm self or others, etc.).
  3. For studies other than those wholly or partially funded by the federal government, investigators may voluntarily seek, or the UTHSC IRB may require an investigator to obtain, a COC for research using identifiable, sensitive information.
     1. Applications must be made for each specific protocol. These applications must be filed electronically with the NIH at https://humansubjects.nih.gov/coc/apply.
     2. CoCs are not transferable from one protocol to another, and may not be used to cover more than one protocol, unless separate protocols have the very same subject population.
     3. CoCs are effective the date issued; investigators must obtain an extension from HHS if the CoC will expire prior to study completion. This request for an extension must occur at least 3 months prior to the expiration date on the certificate.
     4. If a researcher intends to make voluntary disclosures of confidential information, the consent form should clearly indicate the specific limitations that will be placed on the protection of confidentiality (e.g., suspected child abuse, intent to harm self or others, etc.).
  4. For studies other than those wholly or partially funded by the federal government, if the UTHSC IRB determines that a CoC is necessary to minimize risks to human subjects, final approval of the study will be granted; however, subjects may not be enrolled and subject data may not be collected until such a CoC is obtained, submitted to the IRB for review, and acknowledged by the IRB.
  5. For studies other than those funded by NIH, a copy of any CoC and/or any amendments to such an application must be submitted to UTHSC IRB. In addition, the renewed CoC showing the new expiration date must be submitted to the UTHSC IRB promptly during the course of the study. Upon receipt of the study revision application, the UTHSC IRB will follow the procedures outlined in SOP: Revisions in Approved Studies.
  6. For studies other than those funded by NIH, if an investigator obtains a CoC for a previously approved study, then the investigator must submit to the UTHSC IRB via iMedRIS a Form 2: Change Request and Amendments and include the following:
     1. Copy of the CoC;
     2. Revised protocol (if applicable);
     3. Revised Form 1 Application;
     4. Revised informed consent document incorporating the CoC language outlined in the UTHSC IRB consent form template at https://www.uthsc.edu/research/compliance/irb/researchers/consent-forms.php; and
     5. Other pertinent documents.
        
        Upon receipt of the study revision application, the UTHSC IRB will follow the procedures outlined in SOP: Revisions in Approved Studies.
  7. Any CoC for studies other than those funded by NIH or correspondence regarding it will be maintained with the study files.