Skip to main content
University of Wisconsin–Madison

Certificate of Confidentiality Guidance

What is a Certificate of Confidentiality (CoC)?

A Certificate of Confidentiality (CoC) is a legal protection issued by the federal government to researchers which allows the researchers to protect the privacy of research participants enrolled in biomedical, behavioral, clinical or other research. With limited exceptions, the CoC allows researchers to refuse disclosure of identifiable information about research subjects in response to legal demands, such as a subpoena, Public Records request, or Freedom of Information Act (FOIA) request.

How are CoCs issued?

CoCs are issued in two ways:

NIH Funded Research

Effective October 1, 2017, all research initiated or on-going as of December 13, 2016, that is funded by the NIH and involves identifiable, sensitive information is automatically issued a CoC.

Projects automatically covered by a CoC include NIH funded research in which identifiable, sensitive information is collected or used, including research that:

  • Meets the definition of human subjects research in 45 CFR Part 46, including most exempt research;
  • Involves the collection or use of human biospecimens that are identifiable OR for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data could be used to deduce the identity an individual;
  • Involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data are identifiable or whether identities can be readily ascertained; or
  • Involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data could be used to identify an individual.

Researchers are no longer required to apply for a CoC to cover their NIH funded research. The recently updated NIH policy regarding CoCs is now included in the NIH Grants Policy Statement as a standard term and condition of all NIH awards. UW-Madison IRBs will work with study teams to ensure they are aware their NIH funded research is covered by a CoC.

All Other Research (studies not funded by the NIH)

A UW-Madison IRB may require researchers to obtain a CoC as a condition of the IRB approval for a study that is collecting particularly sensitive data. In these cases, the researcher must apply to the appropriate federal agency to receive a CoC. For information on the application process for obtaining a CoC for a study not funded by the NIH, please visit the NIH CoC Website.

When completing the application, UW-Madison specific information as well as instructions for obtaining an Institutional Signature can be found here. If you plan to apply for a CoC through the NIH, we recommend emailing compliance@research.wisc.edu as soon as possible, and we will work with you to ensure your study is set up to be compliant with NIH requirements for CoC-protected studies. 

NOTE: If your study receives redistributed NIH funds from a campus entity (through a pilot award, competition, etc. – list can be found here), your study is likely to be considered NIH funded and is issued a CoC as described above.  If you are uncertain whether your study is funded through redistributed NIH funds, please contact the campus entity that issued your award.

What are researcher responsibilities for studies covered by a CoC?

    1. Researchers should NOT disclose or provide the sensitive, identifiable information (see above) collected during the course of the research in any Federal, State, or local civil, criminal, administrative, legislative, other proceeding, or to any other person not connected with the research without the consent of the individual.
      • Disclosure is allowed ONLY in the following circumstances:
        • When it is required by Federal, State, or local laws (e.g. mandatory reporting of abuse, reporting of communicable diseases.);
        • When it is made with the consent of the individual;
        • When it is necessary for the medical treatment of the individual;
        • When it is made for the purposes of other scientific research in compliance with the regulations governing human subjects research
    2. For studies where informed consent is sought, researchers must inform the participants about the protections and the limits of the protections provided by the CoC. Model language to be included in the informed consent documents can be found on the NIH’s CoC webpage here and in HRP-502 Template Consent Document here.
    3. Researchers must inform recipients of copies of the protected information (for example, when sending covered biospecimens or information where there is at least a small risk the information could be identified to the recipient investigator) that they are also subject to the requirements of the CoC.
    4. Researchers must inform subrecipients of NIH funded studies whose responsibilities necessitate a copy of the protected information that they are also subject to the requirements of the CoC.

How should researchers respond to requests for protected data?

Researchers who receive a legal request for protected research data (public records or FOIA request, subpoena, etc.) should immediately contact the UW Office of Legal Affairs at (608) 263-7400.

Important Links and Contact Information