Certificates of Confidentiality: Guidance for Sponsors, Sponsor-Investigators, Researchers, Industry, and Food and Drug Administration Staff

Administrative guidance, not enacted legislation. This captured publisher edition preserves the listed document and attachments; later developments are not independently consolidated.

1
__________________________________________
CERTIFICATES OF
CONFIDENTIALITY
Guidance for Sponsors, Sponsor-Investigators,
Researchers, Industry,
and Food and Drug Administration Staff
Comments may be submitted at any time for Agency consideration. Submit electronic comments
to https://www.regulations.gov. Submit written comments to the Dockets Management Staff
(HFA-305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD
20852. All comments should be identified with the docket number listed in the notice of
availability that publishes in the Federal Register.
U.S. Department of Health and Human Services
Food and Drug Administration
Office of Policy
Center for Biologics Evaluation and Research
Center for Drug Evaluation and Research
Center for Devices and Radiological Health
Center for Tobacco Products
Center for Food Safety and Applied Nutrition
Center for Veterinary Medicine
Office of Chief Scientist
September 2020
__________________________________________________________________

Contains Nonbinding Recommendations
CERTIFICATES OF CONFIDENTIALITY
Guidance for Sponsors, Sponsor-Investigators, Researchers,
Industry, and Food and Drug Administration Staff
Additional copies are available from:
Office of Policy
Food and Drug Administration
10903 New Hampshire Ave., Bldg. 32., Rm. 4239
Silver Spring, MD 20993-0002
Phone: 301-796-4850 or at
https://www.fda.gov/RegulatoryInformation/Guidances/default.htm
U.S. Department of Health and Human Services
Food and Drug Administration
September 2020

Contains Nonbinding Recommendations
Table of Contents
I. 	Introduction
II. 	Background
III. 	Scope
IV. 	Request for Discretionary CoC From FDA
V. 	FDA Review and FDA Issuance of Discretionary CoC

Contains Nonbinding Recommendations
1
CERTIFICATES OF CONFIDENTIALITY
Guidance for Sponsors, Sponsor-Investigators, Researchers,
Industry, and Food and Drug Administration Staff
This guidance represents the current thinking of the Food and Drug Administration (FDA or Agency) on
this topic. It does not establish any rights for any person and is not binding on FDA or the public. You
can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations.
To discuss an alternative approach, contact the FDA staff responsible for this guidance as listed on the
title page.
I. 	Introduction
This guidance1 describes FDA implementation of the revised provisions applicable to the request
for, and issuance of, a Certificate of Confidentiality (CoC). The 21st Century Cures Act (Cures
Act) (Public Law 114-255) amended the Public Health Service Act (PHS Act), section 301(d)
(42 U.S.C. 241(d)) relating to the issuance of CoCs. A CoC is intended to help protect the
privacy of human subject research participants from whom identifiable, sensitive information is
being collected or used in furtherance of the research.2 Historically, a CoC generally protected a
researcher from being compelled to disclose identifiable, sensitive information about the research
participant, created or compiled for purposes of the human subject research. As amended, the
statute broadened the protections by affirmatively prohibiting holders of CoCs from disclosing
such information unless a specific exception applies.
The Cures Act simplified certain aspects of the issuance of CoCs by requiring that CoCs be
issued for federally-funded human subject research that collects or uses identifiable, sensitive
information (referred to in this guidance as mandatory CoCs). For non-federally funded
research, issuance of CoCs is not required but may be issued at the discretion of FDA (referred to
in this guidance as discretionary CoCs). FDA intends to continue receiving and considering such
requests and will issue discretionary CoCs as appropriate. This guidance is intended to provide
information on how to request a discretionary CoC, the statutory requirements for requesting
such a CoC, and the statutory responsibilities associated with possessing a CoC. Although the
mandatory CoC and the discretionary CoC are issued under different processes, the protections
1 This guidance has been prepared by the Office of Policy in cooperation with the Center for Biologics Evaluation
and Research, the Center for Drug Evaluation and Research, the Center for Devices and Radiological Health, the
Center for Tobacco Products, the Center for Food Safety and Applied Nutrition, the Center for Veterinary Medicine,
and the Office of Chief Scientist at the Food and Drug Administration.
2 There are additional statutes and regulations that protect the privacy of human subject research participants. These
are outside the scope of this guidance.

Contains Nonbinding Recommendations
2
afforded by the issuance of either CoC are identical and the statutory responsibilities are the
same.
In general, FDA’s guidance documents do not establish legally enforceable responsibilities.
Instead, guidances describe the Agency’s current thinking on a topic and should be viewed only
as recommendations, unless specific regulatory or statutory requirements are cited. The use of
the word should in Agency guidances means that something is suggested or recommended, but
not required.
II. Background
A CoC generally protects a researcher from being compelled to disclose identifiable, sensitive
information about the research participant, created or compiled for purposes of the research, in
any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding. As
amended, the statute broadened these protections by prohibiting disclosure of such information.
By protecting researchers from being compelled to disclose identifiable, sensitive information
about the research participants, CoCs help protect the identity of the research participants and
achieve the objectives of the research. There are exceptions to the prohibition on disclosure as
described in Section III of this guidance.
FDA has the authority (by delegation) to issue CoCs related to the study of products subject to
FDA jurisdiction and to which FDA regulations apply, in compliance with the PHS Act, and has
done so for over 20 years. (42 U.S.C. § 241)3 The Cures Act revisions made issuance of a CoC
mandatory for federally funded researchers “engaged in biomedical, behavioral, clinical, or other
research, in which identifiable, sensitive information is collected (including research on mental
health and research on the use and effect of alcohol and other psychoactive drugs).” For non-
federally funded research, FDA “may, upon application by a person engaged in research, issue to
such person a certificate of confidentiality to protect the privacy of such individuals (emphases
added) . . . .”
The Cures Act also directed agencies to take steps to minimize the burden to researchers,
streamline the process, and reduce the time it takes to comply with the requirements of the
statutory provision. FDA has complied with this directive in implementing requirements for the
issuance of mandatory CoCs to FDA-federally funded researchers.
For non-federally funded research, FDA has been issuing discretionary CoCs pursuant to the
amended statutory requirements, on a case-by-case basis upon application to FDA, since
enactment of the Cures Act. This guidance describes the revised, streamlined process for
submission to FDA of requests for discretionary CoCs for non-federally funded research. The
revised process for discretionary CoCs will minimize the burden to researchers who request a
CoC, will streamline the existing process by reducing the information currently provided in a
request to FDA for a CoC, will clarify the statutory responsibilities associated with receiving a
CoC and, thus, will reduce the time it takes to obtain a CoC.
3 FDA, by delegation from the Secretary, Department of Health and Human Services (HHS), has the authority to
issue CoCs . (See, FDA Staff Manual Guide, 1410.26(1)(E)). Other HHS agencies, e.g., National Institutes of
Health (NIH), Centers for Disease Control and Prevention, also issue CoCs.

Contains Nonbinding Recommendations
3
III. Scope
To help ensure that discretionary CoCs are issued to those entities who can comply with the
requirements of the statutory provision, we recommend that only sponsors or sponsor-
investigators, submit requests for discretionary CoCs (as defined in 21 CFR §50.3, §312.3,
§812.3) (i.e., the individual who takes responsibility for or initiates the clinical investigation).
This will help eliminate duplicative requests to FDA for the same human subject research. It is
our understanding that, typically, sponsors and sponsor-investigators are the entities or
individuals who have responsibility and control over the information and data collected and used
in research. Furthermore, the human subject research, for which a discretionary CoC is being
requested, must involve the use or study of a product subject to FDA’s jurisdiction and must be
subject to FDA’s regulatory authority.
The term “identifiable, sensitive information,” as used in section 301(d), PHS Act, and in
relation to CoCs, means “information that is about an individual and that is gathered or used
during the course of research” covered by the statute and
(A) through which an individual is identified; or (B) for which there is at least a very
small risk, as determined by current scientific practices or statistical methods, that some
combination of the information, a request for the information, and other available data
sources could be used to deduce the identity of an individual.
(42 U.S.C. § 241(d)(4)). An entity or individual requesting a discretionary CoC should evaluate
its own human subject research and make its own determination as to whether the research
involves the collection of identifiable, sensitive information (e.g., research participant names).
This evaluation should take into account the type of information collected, whether the
information is retained for any further use or purpose, the extent of the information, and the
security of the data systems that contain the information. In considering whether the individual
information being collected is “identifiable, sensitive information,” sponsors, sponsor-
investigators, and other researchers should be aware of the evolving perspectives as to the
identifiability of the information collected. Given current technological capabilities, there is
some support for the position that the identity of an individual participating in certain types of
research is relatively easy to determine even with limited de-identified data. Genomic data also
are often considered to fall automatically into the category of identifiable, sensitive information.4
There are various definitions of the phrase identifiable, sensitive information used by different
government agencies and for different purposes – not all necessarily applicable in this context
but which may be useful in an evaluation by the sponsors, sponsor-investigators, and other
researchers of whether certain information would fall within the statutory definition.5 A
4 NIH considers research in which identifiable, sensitive information is collected or used, to include “research that
involves the generation of individual level, human genomic data from biospecimens, or the use of such data,
regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of
the human subjects can readily be ascertained.” (NIH, NOT-OD-17-109: Notice of Changes to NIH Policy for
Issuing Certificates of Confidentiality, effective October 1, 2017).
5 Department of Health and Human Services, Office of the Chief Information Officer. (2016). The Department of
Health and Human Services Cybersecurity Awareness Training, FISCAL YEAR 2016. Retrieved February 26, 2020,
from https://www.hhs.gov/sites/default/files/ocio/securityprivacy/awarenesstraining/cybersecurity-awareness.pdf.

Contains Nonbinding Recommendations
4
determination of whether any data or information collected during human subject research is
identifiable, sensitive information should be made by the sponsors or sponsor investigators.
Once a CoC is issued, the recipient must comply with the statutory disclosure protections as
follows (section 301(d)(1), PHS Act):
(A) [defines who can apply and conditions of applying for a CoC].
(B) Except as provided in subparagraph (C), any person to whom a certificate is issued
. . . to protect the privacy of individuals described in such subparagraph shall not disclose
or provide to any other person not connected with the research the name of such an
individual or any information, document, or biospecimen that contains identifiable,
sensitive information about such an individual and that was created or compiled for
purposes of the research.
(C) The disclosure prohibition in subparagraph (B) shall not apply to disclosure or use
that is—
(i) required by Federal, State, or local laws, excluding instances described in
subparagraph (D); (ii) necessary for the medical treatment of the individual to
whom the information, document, or biospecimen pertains and made with the
consent of such individual; (iii) made with the consent of the individual to whom
the information, document, or biospecimen pertains; or (iv) made for the purposes
of other scientific research that is in compliance with applicable Federal
regulations governing the protection of human subjects in research.
(D) Any person to whom a certificate is issued . . . to protect the privacy of an individual
described in such subparagraph shall not, in any Federal, State, or local civil, criminal,
administrative, legislative, or other proceeding, disclose or provide the name of such
individual or any such information, document, or biospecimen that contains identifiable,
sensitive information about the individual and that was created or compiled for purposes
of the research, except in the circumstance described in subparagraph (C)(iii).
(E) Identifiable, sensitive information . . ., and all copies thereof, shall be immune from
the legal process, and shall not, without the consent of the individual to whom the
information pertains, be admissible as evidence or used for any purpose in any action,
suit, or other judicial, legislative, or administrative proceeding.
(F) Identifiable, sensitive information collected by a person to whom a certificate has
been issued . . ., and all copies thereof, shall be subject to the protections afforded by this
section for perpetuity.
(G) The Secretary shall take steps to minimize the burden to researchers, streamline the
process, and reduce the time it takes to comply with the requirements of this subsection.
As part of the protection of the identifiable, sensitive information collected in the research, any
other entities with whom the sponsor, sponsor-investigator, or other researcher shares the
information (i.e., “copies” of the information) are also subject to the disclosure requirements.
Such entities include contract research organizations, clinical investigators, and academic
institutions, among others.
Under FDA regulations, an Institutional Review Board (IRB) is a group that has been formally
designated by an institution to review, approve the initiation of, and conduct periodic review of

Contains Nonbinding Recommendations
5
biomedical research involving human subjects. (21 CFR §56.102(g)). In accordance with FDA
regulations, an IRB has the authority to approve, require modifications in (to secure approval), or
disapprove such research. (21 CFR §56.109(a)). An IRB review serves an important role in the
protection of the rights and welfare of human research subjects. If an IRB in reviewing research
determines that particular data collected in a clinical trial are sufficiently sensitive to warrant
requesting a CoC, then it is within the purview of an IRB to request that a CoC be obtained in
order to secure IRB approval. Any disagreement between an IRB, sponsor, and/or clinical
investigators, regarding the need to request a CoC for a particular study should be resolved by
appropriate communications among those parties.
IV. 	Request for Discretionary CoC From FDA
Prior to submitting a request to FDA for issuance of a discretionary CoC, the potential requestor
should consider the following questions:
 	Is the requestor involved in human subject research in which identifiable, sensitive
information is collected?
 	Is the requestor a sponsor or sponsor-investigator or authorized representative (i.e., the
individual who takes responsibility for or initiates the clinical investigation)?
 	Does the human subject research, for which a discretionary CoC is being requested,
involve the use or study of a product subject to FDA’s jurisdiction and subject to FDA’s
regulatory authority?
 	Are the requestor’s research measures sufficient to protect the confidentiality of the
identifiable, sensitive information? 6
We recommend that a request to FDA for the issuance of a discretionary CoC be made by those
entities and individuals that can answer “yes” to all of these questions. A request for a
discretionary CoC also should not be made if the human subject research is federally funded.7
We also prefer that all requests for discretionary CoCs be submitted electronically as described
in this section and with the information and assurances as detailed in this section.
To make a request to FDA for a discretionary CoC, the requestor should determine the
appropriate Center and submit the request, in the form of a letter (e.g., as a PDF attachment to
the email submission), through one of the following email addresses:
Center for Drug Evaluation and Research (CDER) at: CDER-CoC-
Requests@fda.hhs.gov
Center for Biologics Evaluation and Research (CBER) at:
CBERBIMONotification@fda.hhs.gov
Center for Devices and Radiological Health (CDRH) at: CDRH-CoC@fda.hhs.gov
Center for Tobacco Products (CTP) at: CTP_RIHSC@fda.hhs.gov
6 The amendments to section 301(d) of the PHS Act, signal Congressional support for enhanced privacy protections
for participants in research. FDA recommends that sponsors and investigators explore ways to further enhance their
own privacy and confidentiality procedures.
7 As noted in Section II, CoCs for federally funded research are mandatory and outside the scope of this guidance.
Mandatory CoCs for federally funded research are handled in a different manner than discretionary CoCs.

Contains Nonbinding Recommendations
6
Center for Food Safety and Applied Nutrition (CFSAN) at: CFSAN-CoC-
Requests@fda.hhs.gov
Center for Veterinary Medicine (CVM) at: AskCVM@fda.hhs.gov
We recommend the request letter include the following information and assurances to facilitate
FDA’s review and to expedite consideration of the request for the discretionary CoC.
Descriptive Information
 	Sponsor or Sponsor-Investigator Name or authorized representative (e.g., the individual
who takes responsibility for or initiates the clinical investigation).
 	Sponsor or Sponsor-Investigator or authorized representative Address (same as on file
with FDA).
 	Sponsor or Sponsor-Investigator or authorized representative Email Address.
 	FDA Application Number, as applicable, (e.g., IND/NDA/BLA/IDE/HDE/PMA/PMTA/
ITP)8.
 	ClinicalTrials.gov Numerical Identifier (if applicable) (number provided upon
registration on www.ClinicalTrials.gov).
 	Research Title
 	If conducting human subject research subject to FDA’s jurisdiction but the sponsor or
sponsor-investigator is exempt from submission of an investigational application (e.g.,
IND/IDE) submit all of the above information with the exception of the FDA application
number.
 	Signature of sponsor, sponsor-investigator, or authorized representative, submitting the
discretionary CoC request.
Assurances
The requestor should include information sufficient to allow FDA to assess whether the
requestor understands its obligations to comply with the CoC statutory provisions (section
301(d), PHS Act, (42 U.S.C. 241(d))). We recommend use of the following language in the
request letter to facilitate FDA’s review:
The requestor is engaged in biomedical, behavioral, clinical, or other research, in which
identifiable, sensitive information is collected or used.
The requestor agrees it is responsible for complying with requirements to protect the
confidentiality of identifiable, sensitive information that is collected or used in
biomedical, behavioral, clinical, or other research.
The requestor agrees not to disclose or provide, in any Federal, State, or local civil,
criminal, administrative, legislative, or other proceeding, the name of such individual or
any such information, document, or biospecimen that contains identifiable, sensitive
8 Investigational New Drug Application/New Drug Application/Biologics License Application/Investigational
Device Exemption/Humanitarian Device Exemption/Premarket Application/Premarket Tobacco Product
Application/Investigational Tobacco Product.

Contains Nonbinding Recommendations
7
information about the individual and that was created or compiled for purposes of the
research, unless such disclosure or use is made with the consent of the individual to
whom the information, document, or biospecimen pertains. The requestor also agrees
not to disclose or provide to any other person not connected with the research the name
of such an individual or any information, document, or biospecimen that contains
identifiable, sensitive information about such an individual and that was created or
compiled for purposes of the research.
The requestor understands that the identifiable, sensitive information collected by a
researcher to whom a discretionary CoC has been issued, and all copies of such
information, are subject to the protections afforded by the statute in perpetuity.
The requestor understands and agrees that disclosure is permitted by the recipient of a
CoC only when:
• 	Required by Federal, State, or local laws (e.g., as required by the Federal Food,
Drug, and Cosmetic Act, or state laws requiring the reporting of communicable
diseases to State and local health departments), excluding instances of disclosure
in any Federal, State, or local civil, criminal, administrative, legislative, or other
proceeding;
• 	Necessary for the medical treatment of the individual to whom the information,
document, or biospecimen pertains and made with the consent of such individual;
• 	Made with the consent of the individual to whom the information, document, or
biospecimen pertains; or
• 	Made for the purposes of other scientific research that is in compliance with
applicable Federal regulations governing the protection of human subjects in
research.
The requestor also should note that the signature provided for this request, if a facsimile
or e-signature, represents a true and correct signature of the sponsor, sponsor-
investigator, or that of an authorized representative, authorized to submit this request for
a Certificate of Confidentiality and to make these assurances.
V. FDA Review and FDA Issuance of Discretionary CoC
After a request has been sent to the appropriate Center responsible for the FDA-regulated
product, a review will be conducted to ensure the requestor has submitted all the information and
assurances, described in Section IV. After FDA completes its review, the Center will send an
electronic response letter to the requestor indicating whether or not the discretionary CoC has
been granted. If granted, that electronic response letter will serve as the CoC. It is expected that
most discretionary requests will be granted provided these are in compliance with the statutory
requirements. The recipient of the CoC is expected to carry out the statutory assurances
provided in the request and reiterated in the FDA electronic response letter for the protection of
the individuals participating in the human subject research.