1. Certificates of Confidentiality:
When Are They Needed and Whom Do They Protect?
Susan Sonne, PharmD, BCPP
Associate Professor of Psychiatry
Associate Director of SCTR RKS Program
Chair, IRB II

2. What is a CoC?
Provides a layer of privacy protection for participants enrolled in studies collecting sensitive information.
Protects the INVESTIGATOR from being forced to disclose information that identifies a person as a study participant – even under subpoena or court order.
Typically issued by NIH or FDA—can be issued even for unfunded studies

3. What is a CoC (continued)
CoCs expire and must be renewed to protect new data
CoCs are permanent—any information protected under the CoC is protected permanently
CoCs can be retroactive—once a CoC is in place, it can protect all info previously collected (as long as there has not been a subpoena or court order prior to the issuance of the CoC)

4. What is the purpose of a CoC?
To enable participants to provide truthful information without risk of criminal or civil action
May improve recruitment for studies collecting sensitive information

5. What is considered sensitive?
Research on HIV, Acquired Immune Deficiency Syndrome (AIDS), and other sexually transmitted diseases (STD)
Studies that collect information on sexual attitudes, preferences, or practices
Studies on the use of alcohol, drugs, or other addictive products
Studies that collect information on illegal conduct
Studies that gather information that if released could be damaging to a participant's financial standing, employability, or reputation within the community
Research involving information that might lead to social stigmatization or discrimination if it were disclosed
Research on participants' psychological well-being or mental health
Genetic studies, including those that collect and store biological samples for future use

6. What does a CoC protect?
A CoC only protects an investigator from disclosing a participants’ identity as a research participant – not the research data.
If the identity is known, any research data would be discoverable.

7. Important Points
Information in the medical record is always subject to subpoena or court order
It cannot be guaranteed that information that identifies a person as a study participant in the medical record could be protected by a CoC (at least at MUSC).

8. What studies should not have a CoC?
Studies not collecting sensitive data
Studies collecting sensitive data solely from the medical record (MUSC policy)
Studies that require study participation to be documented in the medical record for the purposes of clinical billing to insurance (MUSC policy)

9. What is the institutional commitment?
The Institution is responsible for upholding the CoC and providing appropriate legal counsel if warranted

10. CoC Requirements
CoC is only considered valid if the PI has signed an assurance that the PI will uphold the CoC
If PI changes, there must be an assurance signed by the new PI for the CoC to still be valid
There should be sign off by the an Institutional Official (a designated individual within the Office of Research and Sponsored Programs).
There should be language in the IRB-approved informed consent document that describes the additional protections afforded by the CoC

11. Investigator-Initiated CoCs (at MUSC)
PI must obtain institutional approval for CoC by submitting a completed CoC checklist to ORSP
An authorized official within ORSP will determine the appropriateness of a CoC
The PI will maintain a copy of the CoC application as well as the CoC for review/audit
The PI will sign an assurance notice that s/he plans to uphold the CoC
If the PI changes, the new PI will also sign an assurance

12. This form is how MUSC determines if a CoC is appropriate
This form is how MUSC determines if a CoC is appropriate. Check with your institution to see how this would be done at your site.

13. Sponsor-Initiated CoCs
It should be determined whether the sponsor is expecting your site to adhere to the CoC
If MUSC is to adhere to the CoC, the PI submit a signed assurance letter, copy of the CoC and completed CoC checklist to ORSP
If the CoC is only for a portion of the study (e.g. the biorepository) and MUSC would not be under it, appropriate language should be in the consent that the holder of the CoC is the sponsor but info in the MUSC medical record could still be subject to subpoena

14. Scenario 1
An investigator is collecting information on HIV status from the medical record and interviewing participants about sexual risk behaviors.
No information regarding study participation would be in the medical record
Is a CoC appropriate?

15. Scenario 2
An investigator is conducting a chart review and obtaining information on outcomes of patients who have had hip and knee surgeries.
Is this information sensitive?
Is a CoC appropriate?

16. Scenario 3
An investigator is participating in multi-site behavioral intervention for the treatment of cocaine dependence.
The sponsor has obtained a CoC and wishes each clinical site to adhere to the CoC
No information that would identify the participant would be in the medical record
Is a CoC appropriate?

17. Scenario 4
An investigator is conducting an interview study regarding barriers to treatment with patients who have diabetes
Is this information sensitive?
Is a CoC appropriate?

18. Scenario 5
An investigator at your site is participating in multi-site medication trial for the treatment of skin cancer
Information that would identify the participant will be in the medical record since the study intervention is part of clinical care and will be billed to insurance
Does it make sense to have a CoC?

19. Scenario 5+ What if in the previous example:
Tissue samples of affected skin will be sent to a biorepository for future genetic analysis.
The sponsor has a CoC for the biorepository
Would your site fall under the CoC?
Why type of language would be in your site’s consent?

20. Summary
Investigators should only consider getting a CoC if they are collecting sensitive information
A CoC only protects a participant’s identity as a research participant. If the identity is known, any research data would be discoverable.
Medical records may be subject to subpoena or court order
If a study is only collecting information from the medical record, that information would already be discoverable and a CoC would not add additional protection

21. Where can I find more information?
NIH Certificates of Confidentiality (CoC) Kiosk
NIH Certificates of Confidentiality (CoC) FAQs
MUSC policy:
Research Toolkit kit_design.html