What is a Certificate of Confidentiality?

Grantees collect data that includes personally identifiable information (PII) using GPRA Modernization Act Tools during the evaluation period of a grant. A certificate of confidentiality (CC) protects principal investigators (PIs), lead evaluators (LEs), and their contractors and cooperating agencies who conduct behavioral health research.

The term "research" is defined in the federal regulation Protection of Identity – Research Subjects, Definitions, 42 CFR Part 2a.2 as a "systematic study directed toward new or fuller knowledge and understanding of the subject studied. The term includes, but is not limited to, behavioral science studies, surveys, evaluation, and clinical investigations."

A CC protects the grantees from having to comply with subpoenas, court orders, and state reporting laws that request names or other information that would personally identify participants in the evaluation of the grant, project, or contract. The CC does not require PIs/LEs to protect the PII, but enables them to do so. PIs/LEs use CCs most often during evaluations when they ask questions of a sensitive nature.

The CC is effective from the start date to the estimated end date of the project. Coverage under the CC begins before a paper copy is received in the mail and on the date an application requesting a CC is complete. In addition, the application must comply with federal regulations, SAMHSA policies, and have a SAMHSA authorized signature.

Once PIs/LEs have a CC, coverage is retroactive to the start of the study and continues indefinitely. Coverage extends to participants who did not participate but signed up or who are included in data even if the project is no longer active.

CC protections do not extend to participants who join a project after the CC has expired or to projects that have changed significantly since SAMHSA issued the original CC. To obtain an extension or to amend the original CC, PIs/LEs need to submit a request to SAMHSA. Find details in the Extensions and Amendment of Certificates section below.

A CC applies to one project or one grant. A separate application is required for each project. SAMHSA Certificates cannot be used for research and evaluations requiring a Food and Drug Administration (FDA) Investigational New Drug (IND) or Investigational Device Exemption (IDE). The FDA must issue Certificates for projects with INDs or IDEs.

A CC cannot be used for research and evaluation related to law enforcement activities within the purview of 502(c) of the Controlled Substances Act (CSA), Title II of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (PDF | 10.64 MB), and the federal regulation Protection of Researchers and Research Subjects, Definitions, 21 CFR 1316.21.

Statutory Authority

CCs are issued under the authority of the Secretary of the Department of Health and Human Services (HHS), by the Public Health and Welfare Act, Research and Investigations Generally, 42 U.S.C. 241(d) (PDF | 161.18 KB), and the federal regulation Protection of Identity – Research Subjects, Definitions, 42 CFR Part 2a.2.

Application Process

SAMHSA only issues CCs to grantees and contractors. Requesters who do not have SAMHSA funding should contact the National Institutes of Health (NIH).

There is no application fee. PIs/LEs should only apply for a CC after the grantee completes a project plan and writes the final consent form. If the grantee changes the procedures of the actual study, the consent form, or anything else substantial, the PI/LE must apply again. By signing the application, the PI/LE is legally affirming the description of the study. 

A request for a CC consists of the following:

• A cover letter (DOC | 51.8 KB) from the PI or LE on organization stationery
• Consent forms for adults or assent forms for children
• A letter from the Institutional Review Board (IRB) on IRB stationery indicating approval of the project and forms
• A bio sketch or curriculum vitae of the requester (if the information about that person is not in the cover letter)

If multiple IRBs are involved, then the request must contain a letter of approval from the IRB of every institution in the project. Each institution must have filed a Federal-wide Assurance (FWA) with the Office for Human Research Protections (OHRP). A FWA is the only acceptable format for new filings. The goal is to comply with federal regulations so that the CC can survive any legal challenge.

If a project has a lead entity, such as a coordinating center and a number of study sites, the coordinating center may get one CC for the entire project. This one CC would protect the center and all of its contractors and other cooperating agencies involved in the project. Consent forms and IRB approval letters from all sites must be included in the application.

Send CC requests to:

Ms. Summer King
SAMHSA CC Coordinator
SAMHSA
5600 Fishers Lane
Room 15E57B
Rockville, MD 20857
240-276-1243
summer.king@samhsa.hhs.gov

In some cases, SAMHSA may review the formal request and grant the CC without a final IRB approval letter. However, grantees must include in the application a letter from the IRB that states that the IRB approved the project contingent upon receipt of the CC.

Consent Forms

A consent form that leads to genuine informed consent is a key element of adequate participant protection. The consent form should inform readers in a language they understand. This might mean reading the form aloud to participants or having it translated into other languages. In addition, be explicit with questions about drug use, mental health or substance abuse treatment, sexual activity, or any other sensitive issues.

Examples of Language to Include and Not Include in Consent Forms

Risk of Confidentiality Breach Statement

Include a risk of confidentiality breach statement for participants to consider. As a way of reassuring prospective participants, many consent forms include information about how the form will protect a participant’s confidentiality in the risk section. Some do not include language that speaks directly about confidentiality risk but include a statement like this: “The risk of participating in this study is expected to be minimal because we have taken steps to protect your privacy,” or other language to this effect.

Consent forms should not over-promise the degree of protection of PII or be vague or misleading. For example, writing that “participant information will be kept in strictest confidence” is vague and misleading. Remember that HHS staff can audit your program and that the PI/LE will be reporting suspected cases of child abuse/neglect, harm to self and others, and communicable diseases (if testing for it). Thus, it is false to write in the form “Only researchers will have access to your data.”

A better strategy is to tell people about the specific steps taken to protect participants’ confidentiality, such as training staff to keep information private, keeping the code file locked away or encrypted, and your organization obtaining a CC. Examples of good privacy statements include the following:

• “The privacy of the information we collect about you will be very carefully protected.”
• “We are committed to protecting your privacy.”
• “We have taken steps to protect your privacy.”

CC Information Required by Federal Regulations and Mentioned in the FWA

The consent forms must contain specific CC information required by federal regulations and mentioned in the FWA. The consent forms should not have statements that contradict the CC language. Besides an HHS audit, there are three areas where a CC does not ensure participant confidentiality:

1. Communicable Diseases. Although CC requirements do not obligate PIs/LEs to do so, SAMHSA policy requires PIs/LEs to report communicable diseases voluntarily as if they are obeying state laws. They should do this only when projects are testing participants for diseases, which most SAMHSA projects do not do.
2. Suspected Cases of Child Abuse or Neglect. Although CC requirements do not obligate PIs/LEs to do so, SAMHSA policy requires them to report suspected cases of child abuse or neglect to the proper local authorities. It is especially important that PIs/LEs not report suspected child abuse or neglect cases to the parent(s). The PIs/LEs will agree to report these matters voluntarily as if they are following state laws. Parents and children should understand this exception to confidentiality.
3. Harm to Self and Others. Although CC requirements do not obligate PIs/LEs to do so, they should voluntarily report if there is a danger that a participant will harm himself or herself, or others.

In the consent form, PIs/LEs must make participants aware in advance about any reporting they will do and to whom they will report. Conforming to state law in terms of reporting may be the simplest way to do this. However, the consent form must clearly state that PIs/LEs are doing this voluntarily because the CC does not obligate them to comply with state reporting laws. Therefore, to ensure the CC stands up in court, the consent form must not say that PIs/LEs will obey the law or state law or will do something in accordance with state law. For example, the consent form should not say “State law requires us to report...” or “We will keep your information confidential except as required by law.”

Examples of Consent Form Language by Audience

The consent forms in the following examples are written for two specific audiences: adults and children. Modify the language to fit participant reading levels in your project.

For Adults

“To help keep information about you confidential, we have obtained a certificate of confidentiality (CC) from the Department of Health and Human Services (HHS). This CC adds special protection for the research information about you. This CC does not imply that the Secretary, HHS, approves or disapproves of the project. The CC will protect the investigators from being forced, even under a court order or subpoena, to release information that could identify you. We may release identifying information in some circumstances, however. For example, we may disclose medical information in cases of medical necessity, or take steps (including notifying authorities) to protect you or someone else from serious harm, including child abuse or neglect. Also, because this research is sponsored by HHS, staff from HHS may review records that identify you during an audit.”

For Children

“We have obtained a certificate of confidentiality (CC) from the Department of Health and Human Services (HHS) to keep anything that you tell us private. This means that we will not tell anyone what you tell us even if a judge tries to force us to identify you as a person in the study. You should know, however, that we may tell local authorities if harm to you, harm to others, or if child abuse or neglect becomes a concern. Also, the government agency that has provided the money for this project may see your information if they ask for our records to ensure we were conducting the project correctly. The CC that we have does not mean that HHS approves or disapproves this project.”

Extensions and Amendment of Certificates  

CC protection is indefinite for people who participated in studies while the CC was in effect, even if they did not participate but signed up. CC protections do not extend to participants who join a project after the CC has expired.

To obtain a CC extension, PIs/LEs on the current CC need to send to SAMHSA:

• A signed request for an extension, ideally before expiration, with the proposed new expiration date
• A statement justifying the extension
• A copy of the current IRB approval
• A copy of the current consent form
• A copy of the expiring CC
• A statement that the project has not changed in any significant way since the original CC was issued

CC protections do not extend to projects that significantly change from the description in the original CC application. If changes are significant, SAMHSA can issue a one-page amendment to the original CC. Significant changes to a project include changes in:

• PI or LE
• Consent form
• Scope and direction of the project
• Measurement instruments
• Other significant features of a project

If the consent form changes, send in both old and new forms.

SAMHSA maintains files of all issued CCs, including requests for extensions and amendments. When making a request, please include the following:

• The original requester’s name
• The contract or grant number
• The required documents for extension or amendment

Send all requests to the mailing address noted in the Application Process section.