A Certificate of Confidentiality may sometimes be required by granting agencies such as NIH to provide additional protection for vulnerable populations. The following is a summary of policies from Health and Human Services.
The Public Health Service Act §301(d), 42 U.S.C. §241(d), "Protection of privacy of individuals who are research subjects," states:
The Secretary may authorize persons engaged in biomedical, behavioral, clinical, or other research (including research on mental health, including research on the use and effect of alcohol and other psychoactive drugs) to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals.
The privacy of the research subjects referred to in §301(d) is protected through the issuance of Certificates of Confidentiality. These certificates of Confidentiality provide protection against compelled disclosure of identifying information about subjects enrolled in sensitive biomedical, behavioral, clinical, or other research. This protection is not limited to federally supported research.
Guidance: OHRP does not issue Certificates of Confidentiality. Certificates of Confidentiality are issued by the National Institutes of Health (NIH) and other HHS agencies to protect identifiable research information from forced or compelled disclosure. They allow the investigator and others who have access to research records to refuse to disclose identifying information on research participants in civil, criminal, administrative, legislative, or other proceedings, whether federal, state, or local. Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for subjects, such as damage to their financial standing, employability, insurability, or reputation. By protecting researchers and institutions from being compelled to disclose information that would identify research subjects, Certificates of Confidentiality help to minimize risks to subjects by adding an additional level of protection for maintaining confidentiality of private information.
Certificates of Confidentiality protect subjects from compelled disclosure of identifying information but do not prevent the voluntary disclosure of identifying characteristics of research subjects. Researchers, therefore, are not prevented from voluntarily disclosing certain information about research subjects, such as evidence of child abuse or a subject's threatened violence to self or others.
However, if a researcher intends to make such voluntary disclosures, the consent form should clearly indicate this. Furthermore, Certificates of Confidentiality do not prevent other types of intentional or unintentional breaches of confidentiality. As a result, investigators and IRBs must ensure that other appropriate mechanisms and procedures are in place to protect the confidentiality of the identifiable private information to be obtained in the proposed research.