Certificate of Confidentiality Application Instructions
The Privacy and Confidentiality Unit (PCU) in the CDC Office of Scientific Integrity (OSI) handles the review and issuance of Certificates of Confidentiality (CoC) for research grants funded by CDC or ATSDR.
- Applicant contacts PCU to ensure that a CoC is needed and for guidance prior to submitting an application package 404-639-7570 (Voice Mailbox) or email email@example.com].
- Applicant submits draft application to OSI (by email to firstname.lastname@example.org).*
- OSI reviews draft and works with applicant to finalize.
- Application is reviewed by the CDC Confidentiality Review Group (comprised of senior scientists, managers, and general counsel). The entire review process takes approximately two to three months before a CoC is issued.
The following items must be included in the application:
- Application letter.*
- IRB protocol submitted and approved by IRB(s).
- Questionnaire or data collection forms (submit draft if not finalized).
- Introductory letter to participants (if there is one).
- Consent forms approved by local and/or CDC IRB(s).
- Copy of IRB approval letter(s) (include local IRB and CDC IRB, if CDC IRB approval is required).
- One page research summary.
* Applications submitted to CDC using NIH instructions will be required to re-submit using CDC Instructions.
References to review prior to submitting an application:
Certificate of Confidentiality - Interim Guidance
(For CDC CoC, the applicant should not prepare the text of the certificate despite instructions in the Interim Policy Statement. CDC OSI will prepare the certificate. Also, note implementing regulations have not been developed.)
Content of Application Letter:
(After the inside address, make each bold item below a heading)
Certificate of Confidentiality
Office of Scientific Integrity
Centers for Disease Control and Prevention
1600 Clifton Rd., MS D-74
Atlanta, GA 30333
II. Principal Investigator and Co-PI (if applicable) Contact Information
- Institutional affiliation(s)
- Complete mailing address(es)
- Telephone number(s)
- Fax numbers(s)
- Email address(es)
IIa. Name of Project
If the project name on the IRB form is different from the name given here, the applicant must document that the IRB approval pertains to this project.
IIb. Retention Time Information Will Be Kept in Identifiable Form
Address retention time information will be kept in identifiable form. Note: Often study ID numbers or codes are used, but generally a list linking Names with ID number must be maintained. If this is the case, identify those who will have access to this link.
IIc. Source of Funding
List the Center, Institute, or Office within CDC, or Division within ATSDR providing the funding. Include the funding mechanism (grant, cooperative agreement, contract/task order), award number, and the name and telephone number of the CDC/ATSDR Project Officer, Program Official, or Project Coordinator.
IId. Indicate When Data Collection is Expected to Begin and How Long it Will Continue
The certificate must be written to last as long as data collection is expected to continue. CDC issues certificates for five years. Certificates may be extended after five years, if identifiable data is still being collected.
Note: If data collection has already begun, indicate the date that data collection began and briefly explain why data collection was begun before a Certificate of Confidentiality was requested.
IIe. Purpose of the Project
This will be included in the formal purpose statement within the certificate. It should be limited to one or two clear sentences.
IIf. Description of the Project:
This section should be at least 3-4 paragraphs in length. Describe: 1) what the study is attempting to learn; incorporate the Purpose stated above, but expand; 2) the Method (e.g., "Five hundred women attending STD clinics will be recruited to participate, and half will receive educational interventions to increase their awareness of..."); and 3) how the subjects will be identified.
IIg. Sensitive Information
Describe in detail the sensitive information that is to be collected. Sensitive information is information that must be protected because it might cause perceivable damage to someone or something if revealed to persons not entitled to it. Sensitive information includes: Sexual attitudes, preferences, or practices; use of alcohol, drugs, other addictive products; illegal conduct; an individual's psychological mental health; genetic information; information that if released could reasonably be damaging to an individual's financial standing, employability, insurability or reputation; information normally recorded in a medical record, the disclosure of which could lead to social stigmatization.
IIh. Safeguarding Measures
Describe the safeguarding measures that will be in place to protect the data (e.g., locked cabinets, encryption of data, linking information stored in a different location from other data, access limited to small number of research staff).
IIi. Address the Effect Upon Respondents if the Project Does Not Have Confidentiality Protection
Example: Individuals may not be willing to participate or may provide inaccurate information.
IIj.Describe the Instances in Which Researchers Might be Called upon to use the Confidentiality Certificate to Withhold Data
Example: Participants are on parole and their parole officers could subpoena information on illegal activities, such as drug use.
IIk. Address Testing for Reportable Communicable Diseases.
If reportable disease testing is not being done, state: "The project does not involve testing for communicable diseases." If project is conducting testing, briefly describe the testing being conducted, and address how the project intends to comply with policies set out in the Notifiable Disease Reporting with Confidentiality Certificates memorandum.
IIl. Indicate the Project's Compliance with Protection of Human Subjects Regulation (45 CFR Part 46)
State specifically that the project has been reviewed by an Institutional Review Board (IRB) or IRBs. For each IRB approval, list the name of the IRB, the dates of the approval period, and the site of the research. Address if CDC IRB review is needed.
If IRB approval has not yet been obtained, indicate the date of submission, whether any IRB report has been received, etc. Note: CDC IRB approval is not required for grants. It may be required for cooperative agreements.
IIm. Agreement to Add CDC's Preferred Confidentiality Advisement Language to Consent Documents
[Include the following 2 paragraphs verbatim to indicate your agreement.]
The principal researcher(s) at each site involved in the collection of individually identified data for the project have agreed to add CDC's preferred confidentiality advisement language (below) to consent documents when the Certificate approval has been obtained, and to return revised consent forms to their IRB(s) for approval:
"All answers that you give will be kept private. This is because this study has been given a Certificate of Confidentiality. This means anything you tell us will not have to be given out to anyone, even if a court orders us to do so, unless you say it's okay. But under the law, we must report to the proper authorities suspected cases of child abuse or if you tell us you are planning to cause serious harm to yourself or others."
IIn. Assurances from persons requesting authorization of 301(d) protection
[End all applications with the following assurances and provide space for each person requesting authorization of 301(d) protection (PI and Co-PIs if applicable) to provide their signature and date below the assurances]
I assure: (1) that personnel involved in the conduct of the research will comply with all the requirements of 45 CFR Part 46 "Protection of Human Subjects" (Non-DHHS-supported projects must comply with 45 CFR 46 103 (c) and document legally informed consent in a manner consistent with the principles stated in 45 CFR 46); (2) that the Certificate of Confidentiality will not be represented as an endorsement of the project by the DHHS Secretary or used to coerce individuals to participate in the research project; (3) that the recipient of the Confidentiality Certificate will use the vested authority to protect the identity of research subjects; (4) that all subjects be informed that a certificate has been issued and that subjects will be provided with a description of the protection covered by the certificate; and (5) that subjects who enter the project after termination of the certificate will be informed of the termination.
Certificate of Confidentiality Requested by:
Centers for Disease Control and Prevention
1600 Clifton Rd
Atlanta, GA 30333
TTY: (888) 232-6348