Certificate of Confidentiality (CoC)

Certificates of Confidentiality (CoC) protect the privacy of research participants by prohibiting disclosure of identifiable, sensitive research information to anyone not connected to the research except when the participant consents (or in a few other specific situations). 

With limited exceptions, researchers may not disclose names or any information, documents or biospecimens containing identifiable, sensitive information. In addition, if there is at least a very small risk that information, documents or biospecimens can be combined with other available data sources to determine the identity of an individual, then they also are protected by the CoC. The CoC prohibits disclosure in response to legal demands, such as a subpoena.

The protection of the CoC extends to all copies of information collected and shared for other research by investigators as well.  

If your study will involve the collection or use of identifiable, sensitive information that, if disclosed, could harm research participants, then applying for a CoC may be advised. Harm to participants may include negatively impacting a participant’s financial standing, employability, insurability or reputation. Examples of sensitive information may include but is not limited to substance abuse, illegal activities, sexual behaviors, mental health and genetic information. Eligible research studies that are funded by the National Institutes of Health (NIH) are automatically issued a CoC. See the question below about NIH-funded studies.

CoCs are issued by the National Institutes of Health (NIH). The process for applying/obtaining a CoC is different depending on whether your study is NIH-funded or not. 

Please see the next two questions below for more detail based on your project’s funding and visit the NIH website for additional information:

• CoCs for NIH-funded research
• CoCs for research not funded by NIH
  • Requesting a Certificate of Confidentiality for non-NIH-funded research

No. Eligible research studies that are funded by the NIH are automatically issued a CoC. NIH will not provide documentation that specifies NIH-funded-studies are covered by a CoC. 

The following serve as documentation of the issuance of a CoC for a specific study:

• NIH CoC Policy (NOT-OD-17-109)
• NIH Grants Policy Statement (See 4.1.4.1)
• Subsection 301(d) of the Public Health Service Act

For more information, please visit CoCs for NIH-funded research.

Yes. The IRB may request that you apply for a CoC or you may elect to apply for one on your own if your research involves the collection or use of identifiable, sensitive information. You may request a CoC by utilizing the NIH online CoC system. 

When prompted, list the MU Institutional Official (IO)* as Michele Kennett (kennettmr@missouri.edu). Please do not email the IO; just include this information in your CoC application, and NIH will notify the IO.

It is up to the discretion of NIH to issue the CoC. Examples of studies that would be ineligible to receive a Co are those that are:

• Not research-based.
• Not collecting or using identifiable, sensitive information pertaining to research participants,
  a research program, rather than an individual research study/project.
• Establishing and maintaining a data and/or biospecimen repository where the main source of the data and/or biospecimens was originally obtained for clinical care or other purposes, rather than research purposes.
• Not focused on a topic that is within a mission area of the NIH or the Department of Health and Human Services.

There are no costs or fees associated with requesting a CoC for non-federally funded research. Requests for CoCs should be submitted at least three months prior to the date on which you expect to begin enrollment for the research.

You must submit your CoC approval to the IRB. If this isn’t done with the initial application, it can be submitted using our Support Documentation Form or possibly an Amendment Form (if the consent form needs to be revised to update CoC wording).

*The Institutional Official (IO) will receive an automated email from the CoC system after an investigator submits a request in the NIH online CoC system. The IO will be asked to verify and officially submit the CoC request. For more information, please visit:

• CoCs for research not Funded by NIH
• Requesting a Certificate of Confidentiality for non-NIH-funded research
• NIH online CoC system

The authorized Institutional Official (IO) is the individual named by the requesting institution who is authorized to act for that institution and assumes on behalf of the institution the obligations imposed by the CoC as well as obligations imposed by federal laws, regulations and other requirements.

If your study is not NIH-funded and you are applying for a CoC, you will be prompted to list the MU IO. Please enter Michele Kennett (kennettmr@missouri.edu). Please do not email the IO; just include this information in your CoC application, and NIH will notify the IO.

Disclosure of information, physical documents or biospecimens protected by a Certificate of Confidentiality must be done when such disclosure is:

• Required by other federal, state or local laws, such as for public health reporting of communicable diseases or child or elder abuse reporting.
• Made with consent of the subject.
• Made for the purposes of scientific research that is compliant with human subjects' regulations.

The protection of the CoC lasts in perpetuity. However, data collected after a CoC expires, or NIH funding ends, may not be protected.

• For NIH-funded research, a CoC protects the information that you collect or use during the period in which your research is funded by NIH.
• If the study continues after your NIH funding ends, and you want CoC protection for new information that will be collected, you should request a CoC following the process for non-NIH-funded research (see previous FAQ on this topic).
• If a research project was issued a CoC and continues under a no-cost extension, the research is covered by the CoC for the duration of the no-cost extension.

Note that information protected by a CoC, and all copies thereof, is protected by a CoC in perpetuity, even after the research is no longer funded by NIH. Therefore, if a secondary researcher receives information protected by a CoC, the secondary researcher is required to uphold the protections of the CoC. NIH expects recipients of a CoC to inform secondary researchers when information disclosed to them is protected by a CoC.

Any researcher issued a CoC shall not:

• Disclose or provide covered information in any federal, state or local civil, criminal, administrative, legislative or other proceeding.
• Disclose or provide covered information to any other person not connected with the research.

Researchers with a CoC may only disclose identifiable, sensitive information in the following circumstances:

• If required by other federal, state or local laws, such as for public health reporting of communicable diseases or child or elder abuse reporting.
• If the subject consents.
• For the purposes of scientific research that is compliant with human subjects’ regulations.

When a researcher is issued a CoC and will obtain informed consent from participants, subjects must be informed about the protections afforded by the CoC and any exceptions related to those protections. 

Please see our Example Consent Text for Study-Specific Items template located on the Researcher Resources page for suggested consent language. The NIH human subjects website also has suggested consent language that researchers may refer to.