Certificates of Confidentiality for CDC Funded Research

CDC awardees no longer have to apply for a Certificate of Confidentiality (CoC).

Per Section 2012 of the 21st Century Cures Act all ongoing or new research funded by CDC as of December 13, 2016 that is collecting or using identifiable, sensitive information is automatically covered by a CoC.

This applies to CDC funded:

• Grants
• Cooperative Agreements
• Contracts
• CDC’s own intramural research

How do I know if my CDC funded research project is covered by a Certificate of Confidentiality (CoC)?

Research in which identifiable, sensitive information is collected or used, including research that

• Meets the definition of human subjects research, including exempt research in which subjects can be identified
• Is collecting or using human biospecimens that are identifiable or that have a risk of being identifiable
• Involves the generation of individual level human genomic data
• Any other research that involves information about an individual where there is a small risk of identification

If your research meets any of the above criteria then your research data or information is automatically protected by a CoC from CDC.

What does having a CoC mean I need to do?

Researchers with a CoC may ONLY disclose identifiable, sensitive information in the following circumstances:

• if required by other Federal, State, or local laws, such as for reporting of communicable diseases
• if the subject consents; or
• for the purposes of scientific research that is compliant with human subjects regulations

Researchers must ensure that anyone who is conducting research as a subawardee or receives a copy of identifiable sensitive information protected by the Certificate understands that they are also subject to the disclosure restrictions, even if they are not funded directly by CDC.

For studies in which informed consent is sought, CDC expects investigators to inform research participants of the protections and the limits to protections provided by a Certificate issued by CDC.

How do I document that I have a CoC for my CDC funded Research?

CDC will no longer issue a physical CoC. Researchers may point to Terms and Conditions of Award, Guidance on Certificates of Confidentiality and the Additional Requirement #36 as documentation of the CoC protection.

Will I ever need to extend or amend my Certificates of Confidentiality?

CoCs will not need to be extended or amended. If your CDC funding will or has ended but your study has completed all enrollment and data collection, there is no need to extend the Certificate. Identifiable, sensitive research information maintained by investigators while a Certificate is in effect, is protected permanently.

If your funding will or has ended but the collection of new data from research participants will continue without CDC-funding, you will lose the CoC protection for new data collected from research participants. In this case, you may want to consider applying to NIH for a CoC for using their CoC application system.

Where can I learn more?

• Guidance on Certificates of Confidentiality
• Certificates of Confidentiality for CDC funded research
• Suggested CoC Informed Consent Language
• Office of Grant Services Additional Requirement #36
• Award Terms & Conditions, Federal Regulations and Policies

Have a CoC Question?

Contact the Privacy and Confidentiality Unit cdccoc@cdc.gov