UW Research

INFORMATION SHEET Certificate of Confidentiality

Print Print

Purpose and Applicability

A federal Certificate of Confidentiality (CoC) protects sensitive identifiable information collected as part of a study and can be used to refuse to disclose study information.

This information sheet lists key facts and responsibilities for researchers who have a CoC for their study. More details can be found in the GUIDANCE Certificate of Confidentiality.

Researcher responsibilities

Disclosure and sharing of information/biospecimens

  • Do not disclose or provide information/biospecimens that contain identifiable information about the subjects except under limited circumstances
  • If information/biospecimens are shared with other individuals/institutions/repositories, ensure they understand that CoC protections continue to apply to the information/biospecimens they reveive

Responding to requests for access to CoC-protected information/biospecimens

  • Inform the department advisor or chair – and/or –
  • Inform the relevant institutional office (e.g., UW Public Records Office and WA Attorney General’s Office)

Mandatory reporting requirements

  • A CoC does not prevent researchers from complying with any state or local mandatory reporting laws that apply (e.g., UW researchers must report child abuse)

CoC protections

  • All information/biospecimens collected under an active CoC are permanently protected
  • Information/biospecimens collected prior to obtaining a CoC are permanently protected
  • Information/biospecimens collected after a CoC expires are not protected

Extending an expiration date or amending a CoC

  • The IRB can assist researchers in determining whether an extension of an expiring CoC is needed
  • Significant project changes, such as a new subject population, new PI, or collection of new sensitive identifiable information may require a CoC amendment

CoCs and research consent

  • Subjects must be informed about the CoC protections and limitations as part of any research consent process. See TEMPLATE Consent Form, Standard for HSD’s suggested language
  • If a CoC expires and will not be extended while enrollment is ongoing, the CoC language must be removed from the consent process/form

Automatic CoC

Some federal agencies automatically issue CoCs as a term of the grant or contact. If your study has an automatic CoC, note the following:

  • Automatic CoCs expire when the funding expires
  • If you need to extend or modify the CoC, refer to the appropriate agency website for details

Applied for CoC

Some federal agencies have a process by which a researcher can apply for a CoC, even without active funding from the agency. The process differs depending on the agency. Most commonly, CoCs may be obtained by applying to the NIH. The information below is specific to NIH CoCs obtained through the application process:

  • CoCs granted prior to 01/12/2021 list the expiration date
  • CoCs granted on or after 01/12/2021 expire when collection or use of sensitive identifiable information ends (i.e., the end of the study)
  • If you need to extend or modify the CoC, visit the NIH CoC webpage for instructions

Version History

Open the accordion below for version changes to this guidance.

Version History

Version Number Posted Date Implementation Date Change Notes
2.1 11.30.2022 11.30.2022 Add that CoC protections apply to data placed in repositories
2.0 10.27.2022 10.27.2022 Revise and transfer content from ACKNOWLEDGEMENT CoC to new webpage; change taxonomy to INFO SHEET; reorganize information
1.6 11.08.2019 11.08.2019 Revised language throughout for multi-site and collaborative research; added advisory language regarding CoC consent statement at funding expiration
1.5 08.28.2019 08.28.2019 Inserted the missing flow chart; corrected info about expiration and modification for auto-CoCs to align with NIH website
1.4 11.30.2018 11.30.2018 Add CDC to list of funders with auto-CoCs
Previous versions For older versions: HSD staff see the SharePoint Document Library; Others – contact hsdinfo@uw.edu.

Key words: CoC and privacy certificate