__________________________________________ 
CERTIFICATES OF 
CONFIDENTIALITY 
 
Guidance for Sponsors, Sponsor-Investigators, 
Researchers, Industry,  
and Food and Drug Administration Staff 
 
Comments may be submitted at any time for Agency consideration. Submit electronic comments 
to https://www.regulations.gov. Submit written comments to the Dockets Management Staff 
(HFA-305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 
20852. All comments should be identified with the docket number listed in the notice of 
availability that publishes in the Federal Register.   
 
 
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Office of Policy 
 Center for Biologics Evaluation and Research 
Center for Drug Evaluation and Research 
Center for Devices and Radiological Health 
Center for Tobacco Products 
Center for Food Safety and Applied Nutrition 
Center for Veterinary Medicine 
Office of Chief Scientist 
 
September 2020 
 
__________________________________________________________________ 
 
1 
  Contains Nonbinding Recommendations 
 
 
 
 
CERTIFICATES OF CONFIDENTIALITY 
 
 
Guidance for Sponsors, Sponsor-Investigators, Researchers, 
Industry, and Food and Drug Administration Staff 
 
 
 
Additional copies are available from:  
Office of Policy  
Food and Drug Administration  
10903 New Hampshire Ave., Bldg. 32., Rm. 4239 
Silver Spring, MD 20993-0002  
Phone: 301-796-4850 or at  
https://www.fda.gov/RegulatoryInformation/Guidances/default.htm 
 
 
 
U.S. Department of Health and Human Services  
Food and Drug Administration  
  
September 2020 
   
 
  Contains Nonbinding Recommendations 
 
 
 
Table of Contents 
I.    Introduction 
II.   Background 
III.   Scope 
IV.   Request for Discretionary CoC From FDA 
V.   FDA Review and FDA Issuance of Discretionary CoC  
 
   
 
  Contains Nonbinding Recommendations 
 
 
CERTIFICATES OF CONFIDENTIALITY 
 
Guidance for Sponsors, Sponsor-Investigators, Researchers, 
Industry, and Food and Drug Administration Staff 
 
 
This guidance represents the current thinking of the Food and Drug  Administration (FDA or Agency) on 
this topic. It does not establish any rights for any person and is not  binding on FDA or the public.  You 
can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations. 
To discuss an alternative approach, contact the FDA staff responsible  for this guidance as listed on the 
title page. 
 
I.   Introduction 
 
This guidance1 describes FDA implementation of the revised provisions applicable to the request 
for, and issuance of, a Certificate of Confidentiality (CoC).  The 21st Century Cures Act (Cures 
Act) (Public Law 114-255) amended the Public Health Service Act (PHS Act), section 301(d) 
(42 U.S.C. 241(d)) relating to the issuance of CoCs.  A CoC is intended to help protect the 
privacy of human subject research participants from whom identifiable, sensitive information is 
being collected or used in furtherance of the research.2  Historically, a CoC generally protected a 
researcher from being compelled to disclose identifiable, sensitive information about the research 
participant, created or compiled for purposes of the human subject research.  As amended, the 
statute broadened the protections by affirmatively prohibiting holders of CoCs from disclosing 
such information unless a specific exception applies.   
 
The Cures Act simplified certain aspects of the issuance of CoCs by requiring that CoCs be 
issued for federally-funded human subject research that collects or uses identifiable, sensitive 
information (referred to in this guidance as mandatory CoCs).  For non-federally funded 
research, issuance of CoCs is not required but may be issued at the discretion of FDA (referred to 
in this guidance as discretionary CoCs). FDA intends to continue receiving and considering such 
requests and will issue discretionary CoCs as appropriate.  This guidance is intended to provide 
information on how to request a discretionary CoC, the statutory requirements for requesting 
such a CoC, and the statutory responsibilities associated with possessing a CoC.  Although the 
mandatory CoC and the discretionary CoC are issued under different processes, the protections 
                                                 
1 This guidance has been prepared by the Office of Policy in cooperation with the Center for Biologics Evaluation 
and Research, the Center for Drug Evaluation and Research, the Center for Devices and Radiological Health, the 
Center for Tobacco Products, the Center for Food Safety and Applied Nutrition, the Center for Veterinary Medicine, 
and the Office of Chief Scientist at the Food and Drug Administration.   
2 There are additional statutes and regulations that protect the privacy of human subject research participants.  These 
are outside the scope of this guidance.  
1 
  Contains Nonbinding Recommendations 
 
 
afforded by the issuance of either CoC are identical and the statutory responsibilities are the 
same.  
 
In general, FDAs guidance documents do not establish legally enforceable responsibilities.  
Instead, guidances describe the Agencys current thinking on a topic and should be viewed only 
as recommendations, unless specific regulatory or statutory requirements are cited.  The use of 
the word should in Agency guidances means that something is suggested or recommended, but 
not required.  
 
II.  Background 
 
A CoC generally protects a researcher from being compelled to disclose identifiable, sensitive 
information about the research participant, created or compiled for purposes of the research, in 
any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding.  As 
amended, the statute broadened these protections by prohibiting disclosure of such information. 
By protecting researchers from being compelled to disclose identifiable, sensitive information 
about the research participants, CoCs help protect the identity of the research participants and 
achieve the objectives of the research. There are exceptions to the prohibition on disclosure as 
described in Section III of this guidance.  
 
FDA has the authority (by delegation) to issue CoCs related to the study of products subject to 
FDA jurisdiction and to which FDA regulations apply, in compliance with the PHS Act, and has 
done so for over 20 years.  (42 U.S.C.  241)3 The Cures Act revisions made issuance of a CoC 
mandatory for federally funded researchers engaged in biomedical, behavioral, clinical, or other 
research, in which identifiable, sensitive information is collected (including research on mental 
health and research on the use and effect of alcohol and other psychoactive drugs).  For non-
federally funded research, FDA may, upon application by a person engaged in research, issue to 
such person a certificate of confidentiality to protect the privacy of such individuals (emphases 
added) . . . .  
 
The Cures Act also directed agencies to take steps to minimize the burden to researchers, 
streamline the process, and reduce the time it takes to comply with the requirements of the 
statutory provision.  FDA has complied with this directive in implementing requirements for the 
issuance of mandatory CoCs to FDA-federally funded researchers.   
 
For non-federally funded research, FDA has been issuing discretionary CoCs pursuant to the 
amended statutory requirements, on a case-by-case basis upon application to FDA, since 
enactment of the Cures Act.  This guidance describes the revised, streamlined process for 
submission to FDA of requests for discretionary CoCs for non-federally funded research.  The 
revised process for discretionary CoCs will minimize the burden to researchers who request a 
CoC, will streamline the existing process by reducing the information currently provided in a 
request to FDA for a CoC, will clarify the statutory responsibilities associated with receiving a 
CoC and, thus, will reduce the time it takes to obtain a CoC. 
                                                 
3 FDA, by delegation from the Secretary, Department of Health and Human Services (HHS), has the authority to 
issue CoCs . (See, FDA Staff Manual Guide, 1410.26(1)(E)).  Other HHS agencies, e.g., National Institutes of 
Health (NIH), Centers for Disease Control and Prevention, also issue CoCs.  
2 
  Contains Nonbinding Recommendations 
 
 
III.  Scope   
  
To help ensure that discretionary CoCs are issued to those entities who can comply with the 
requirements of the statutory provision, we recommend that only sponsors or sponsor-
investigators, submit requests for discretionary CoCs (as defined in 21 CFR 50.3, 312.3, 
812.3) (i.e., the individual who takes responsibility for or initiates the clinical investigation).  
This will help eliminate duplicative requests to FDA for the same human subject research.  It is 
our understanding that, typically, sponsors and sponsor-investigators are the entities or 
individuals who have responsibility and control over the information and data collected and used 
in research.  Furthermore, the human subject research, for which a discretionary CoC is being 
requested, must involve the use or study of a product subject to FDAs jurisdiction and must be 
subject to FDAs regulatory authority.   
 
The term identifiable, sensitive information, as used in section 301(d), PHS Act, and in 
relation to CoCs, means information that is about an individual and that is gathered or used 
during the course of research covered by the statute and  
 
(A) through which an individual is identified; or (B) for which there is at least a very 
small risk, as determined by current scientific practices or statistical methods, that some 
combination of the information, a request for the information, and other available data 
sources could be used to deduce the identity of an individual. 
 
(42 U.S.C.  241(d)(4)).  An entity or individual requesting a discretionary CoC should evaluate 
its own human subject research and make its own determination as to whether the research 
involves the collection of identifiable, sensitive information (e.g., research participant names).  
This evaluation should take into account the type of information collected, whether the 
information is retained for any further use or purpose, the extent of the information, and the 
security of the data systems that contain the information.  In considering whether the individual 
information being collected is identifiable, sensitive information, sponsors, sponsor-
investigators, and other researchers should be aware of the evolving perspectives as to the 
identifiability of the information collected.  Given current technological capabilities, there is 
some support for the position that the identity of an individual participating in certain types of 
research is relatively easy to determine even with limited de-identified data.  Genomic data also 
are often considered to fall automatically into the category of identifiable, sensitive information.4 
There are various definitions of the phrase identifiable, sensitive information used by different 
government agencies and for different purposes  not all necessarily applicable in this context 
but which may be useful in an evaluation by the sponsors, sponsor-investigators, and other 
researchers of whether certain information would fall within the statutory definition.5  A 
                                                 
4 NIH considers research in which identifiable, sensitive information is collected or used, to include research that 
involves the generation of individual level, human genomic data from biospecimens, or the use of such data, 
regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of 
the human subjects can readily be ascertained.  (NIH, NOT-OD-17-109: Notice of Changes to NIH Policy for 
Issuing Certificates of Confidentiality, effective October 1, 2017). 
5 Department of Health and Human Services, Office of the Chief Information Officer. (2016). The Department of 
Health and Human Services Cybersecurity Awareness Training, FISCAL YEAR 2016. Retrieved February 26, 2020, 
from https://www.hhs.gov/sites/default/files/ocio/securityprivacy/awarenesstraining/cybersecurity-awareness.pdf. 
3 
  Contains Nonbinding Recommendations 
 
 
determination of whether any data or information collected during human subject research is 
identifiable, sensitive information should be made by the sponsors or sponsor investigators. 
 
Once a CoC is issued, the recipient must comply with the statutory disclosure protections as 
follows (section 301(d)(1), PHS Act): 
 
  (A) [defines who can apply and conditions of applying for a CoC]. 
(B) Except as provided in subparagraph (C), any person to whom a certificate is issued 
. . . to protect the privacy of individuals described in such subparagraph shall not disclose 
or provide to any other person not connected with the research the name of such an 
individual or any information, document, or biospecimen that contains identifiable, 
sensitive information about such an individual and that was created or compiled for 
purposes of the research.  
(C) The disclosure prohibition in subparagraph (B) shall not apply to disclosure or use 
that is 
(i) required by Federal, State, or local laws, excluding instances described in 
subparagraph (D); (ii) necessary for the medical treatment of the individual to 
whom the information, document, or biospecimen pertains and made with the 
consent of such individual;  (iii) made with the consent of the individual to whom 
the information, document, or biospecimen pertains; or (iv) made for the purposes 
of other scientific research that is in compliance with applicable Federal 
regulations governing the protection of human subjects in research. 
(D) Any person to whom a certificate is issued . . . to protect the privacy of an individual 
described in such subparagraph shall not, in any Federal, State, or local civil, criminal, 
administrative, legislative, or other proceeding, disclose or provide the name of such 
individual or any such information, document, or biospecimen that contains identifiable, 
sensitive information about the individual and that was created or compiled for purposes 
of the research, except in the circumstance described in subparagraph (C)(iii). 
(E) Identifiable, sensitive information . . ., and all copies thereof, shall be immune from 
the legal process, and shall not, without the consent of the individual to whom the 
information pertains, be admissible as evidence or used for any purpose in any action, 
suit, or other judicial, legislative, or administrative proceeding. 
(F) Identifiable, sensitive information collected by a person to whom a certificate has 
been issued . . ., and all copies thereof, shall be subject to the protections afforded by this 
section for perpetuity. 
(G) The Secretary shall take steps to minimize the burden to researchers, streamline the 
process, and reduce the time it takes to comply with the requirements of this subsection. 
 
As part of the protection of the identifiable, sensitive information collected in the research, any 
other entities with whom the sponsor, sponsor-investigator, or other researcher shares the 
information (i.e., copies of the information) are also subject to the disclosure requirements.  
Such entities include contract research organizations, clinical investigators, and academic 
institutions, among others.   
 
Under FDA regulations, an Institutional Review Board (IRB) is a group that has been formally 
designated by an institution to review, approve the initiation of, and conduct periodic review of 
4 
  Contains Nonbinding Recommendations 
 
 
biomedical research involving human subjects.  (21 CFR 56.102(g)).  In accordance with FDA 
regulations, an IRB has the authority to approve, require modifications in (to secure approval), or 
disapprove such research. (21 CFR 56.109(a)).  An IRB review serves an important role in the 
protection of the rights and welfare of human research subjects.  If an IRB in reviewing research 
determines that particular data collected in a clinical trial are sufficiently sensitive to warrant 
requesting a CoC, then it is within the purview of an IRB to request that a CoC be obtained in 
order to secure IRB approval.  Any disagreement between an IRB, sponsor, and/or clinical 
investigators, regarding the need to request a CoC for a particular study should be resolved by 
appropriate communications among those parties. 
 
IV.   Request for Discretionary CoC From FDA 
 
Prior to submitting a request to FDA for issuance of a discretionary CoC, the potential requestor 
should consider the following questions: 
  Is the requestor involved in human subject research in which identifiable, sensitive 
information is collected? 
  Is the requestor a sponsor or sponsor-investigator or authorized representative (i.e., the 
individual who takes responsibility for or initiates the clinical investigation)? 
  Does the human subject research, for which a discretionary CoC is being requested, 
involve the use or study of a product subject to FDAs jurisdiction and subject to FDAs 
regulatory authority?  
  Are the requestors research measures sufficient to protect the confidentiality of the 
identifiable, sensitive information? 6 
 
We recommend that a request to FDA for the issuance of a discretionary CoC be made by those 
entities and individuals that can answer yes to all of these questions.  A request for a 
discretionary CoC also should not be made if the human subject research is federally funded.7  
We also prefer that all requests for discretionary CoCs be submitted electronically as described 
in this section and with the information and assurances as detailed in this section.  
 
To make a request to FDA for a discretionary CoC, the requestor should determine the 
appropriate Center and submit the request, in the form of a letter (e.g., as a PDF attachment to 
the email submission), through one of the following email addresses: 
 
Center for Drug Evaluation and Research (CDER) at: CDER-CoC-
Requests@fda.hhs.gov 
Center for Biologics Evaluation and Research (CBER) at: 
CBERBIMONotification@fda.hhs.gov  
Center for Devices and Radiological Health (CDRH) at: CDRH-CoC@fda.hhs.gov  
Center for Tobacco Products (CTP) at: CTP_RIHSC@fda.hhs.gov 
                                                 
6  The amendments to section 301(d) of the PHS Act, signal Congressional support for enhanced privacy protections 
for participants in research.  FDA recommends that sponsors and investigators explore ways to further enhance their 
own privacy and confidentiality procedures. 
7 As noted in Section II, CoCs for federally funded research are mandatory and outside the scope of this guidance.  
Mandatory CoCs for federally funded research are handled in a different manner than discretionary CoCs.  
5 
  Contains Nonbinding Recommendations 
 
 
Center for Food Safety and Applied Nutrition (CFSAN) at: CFSAN-CoC-
Requests@fda.hhs.gov 
Center for Veterinary Medicine (CVM) at: AskCVM@fda.hhs.gov   
 
We recommend the request letter include the following information and assurances to facilitate 
FDAs review and to expedite consideration of the request for the discretionary CoC.   
 
Descriptive Information  
 
  Sponsor or Sponsor-Investigator Name or authorized representative (e.g., the individual 
who takes responsibility for or initiates the clinical investigation).  
  Sponsor or Sponsor-Investigator or authorized representative Address (same as on file 
with FDA). 
  Sponsor or Sponsor-Investigator or authorized representative Email Address. 
  FDA Application Number, as applicable, (e.g., IND/NDA/BLA/IDE/HDE/PMA/PMTA/ 
ITP)8. 
  ClinicalTrials.gov Numerical Identifier (if applicable) (number provided upon 
registration on www.ClinicalTrials.gov). 
  Research Title 
  If conducting human subject research subject to FDAs jurisdiction but the sponsor or  
sponsor-investigator is exempt from submission of an investigational application (e.g., 
IND/IDE) submit all of the above information with the exception of the FDA application 
number.  
  Signature of sponsor, sponsor-investigator, or authorized representative, submitting the 
discretionary CoC request.  
 
Assurances 
 
The requestor should include information sufficient to allow FDA to assess whether the 
requestor understands its obligations to comply with the CoC statutory provisions (section 
301(d), PHS Act, (42 U.S.C. 241(d))).  We recommend use of the following language in the 
request letter to facilitate FDAs review:  
 
The requestor is engaged in biomedical, behavioral, clinical, or other research, in which 
identifiable, sensitive information is collected or used.  
 
The requestor agrees it is responsible for complying with requirements to protect the 
confidentiality of identifiable, sensitive information that is collected or used in 
biomedical, behavioral, clinical, or other research. 
 
The requestor agrees not to disclose or provide, in any Federal, State, or local civil, 
criminal, administrative, legislative, or other proceeding, the name of such individual or 
any such information, document, or biospecimen that contains identifiable, sensitive 
                                                 
8 Investigational New Drug Application/New Drug Application/Biologics License Application/Investigational 
Device Exemption/Humanitarian Device Exemption/Premarket Application/Premarket Tobacco Product 
Application/Investigational Tobacco Product. 
6 
  Contains Nonbinding Recommendations 
 
 
information about the individual and that was created or compiled for purposes of the 
research, unless such disclosure or use is made with the consent of the individual to 
whom the information, document, or biospecimen pertains.  The requestor also agrees 
not to disclose or provide to any other person not connected with the research the name 
of such an individual or any information, document, or biospecimen that contains 
identifiable, sensitive information about such an individual and that was created or 
compiled for purposes of the research. 
 
The requestor understands that the identifiable, sensitive information collected by a 
researcher to whom a discretionary CoC has been issued, and all copies of such 
information, are subject to the protections afforded by the statute in perpetuity. 
The requestor understands and agrees that disclosure is permitted by the recipient of a 
CoC only when:  
 
  Required by Federal, State, or local laws (e.g., as required by the Federal Food, 
Drug, and Cosmetic Act, or state laws requiring the reporting of communicable 
diseases to State and local health departments), excluding instances of disclosure 
in any Federal, State, or local civil, criminal, administrative, legislative, or other 
proceeding;  
  Necessary for the medical treatment of the individual to whom the information, 
document, or biospecimen pertains and made with the consent of such individual;  
  Made with the consent of the individual to whom the information, document, or 
biospecimen pertains; or  
  Made for the purposes of other scientific research that is in compliance with 
applicable Federal regulations governing the protection of human subjects in 
research.  
 
The requestor also should note that the signature provided for this request, if a facsimile 
or e-signature, represents a true and correct signature of the sponsor, sponsor-
investigator, or that of an authorized representative, authorized to submit this request for 
a Certificate of Confidentiality and to make these assurances.  
 
V. FDA Review and FDA Issuance of Discretionary CoC  
 
After a request has been sent to the appropriate Center responsible for the FDA-regulated 
product, a review will be conducted to ensure the requestor has submitted all the information and 
assurances, described in Section IV.  After FDA completes its review, the Center will send an 
electronic response letter to the requestor indicating whether or not the discretionary CoC has 
been granted.  If granted, that electronic response letter will serve as the CoC.  It is expected that 
most discretionary requests will be granted provided these are in compliance with the statutory 
requirements.  The recipient of the CoC is expected to carry out the statutory assurances 
provided in the request and reiterated in the FDA electronic response letter for the protection of 
the individuals participating in the human subject research.   
7