1 

__________________________________________

CERTIFICATES OF 

CONFIDENTIALITY

Guidance for Sponsors, Sponsor-Investigators, 

Researchers, Industry, 

and Food and Drug Administration Staff

Comments may be submitted at any time for Agency consideration. Submit electronic comments 

to https://www.regulations.gov. Submit written comments to the Dockets Management Staff 

(HFA-305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 

20852. All comments should be identified with the docket number listed in the notice of 

availability that publishes in the Federal Register. 

U.S. Department of Health and Human Services

Food and Drug Administration 

Office of Policy

 Center for Biologics Evaluation and Research 

Center for Drug Evaluation and Research

Center for Devices and Radiological Health

Center for Tobacco Products

Center for Food Safety and Applied Nutrition 

Center for Veterinary Medicine

Office of Chief Scientist

September 2020 

__________________________________________________________________
Contains Nonbinding Recommendations 

CERTIFICATES OF CONFIDENTIALITY

Guidance for Sponsors, Sponsor-Investigators, Researchers, 

Industry, and Food and Drug Administration Staff

Additional copies are available from: 

Office of Policy 

Food and Drug Administration 

10903 New Hampshire Ave., Bldg. 32., Rm. 4239 

Silver Spring, MD 20993-0002 

Phone: 301-796-4850 or at 

https://www.fda.gov/RegulatoryInformation/Guidances/default.htm

U.S. Department of Health and Human Services 

Food and Drug Administration 

 

September 2020 
Contains Nonbinding Recommendations 

Table of Contents

I. Introduction

II. Background 

III. Scope

IV. Request for Discretionary CoC From FDA

V. FDA Review and FDA Issuance of Discretionary CoC 
Contains Nonbinding Recommendations 

1 

CERTIFICATES OF CONFIDENTIALITY

Guidance for Sponsors, Sponsor-Investigators, Researchers, 

Industry, and Food and Drug Administration Staff

This guidance represents the current thinking of the Food and Drug Administration (FDA or Agency) on 

this topic. It does not establish any rights for any person and is not binding on FDA or the public. You

can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations.

To discuss an alternative approach, contact the FDA staff responsible for this guidance as listed on the 

title page.

I. Introduction

This guidance1 describes FDA implementation of the revised provisions applicable to the request 

for, and issuance of, a Certificate of Confidentiality (CoC). The 21st Century Cures Act (Cures 

Act) (Public Law 114-255) amended the Public Health Service Act (PHS Act), section 301(d) 

(42 U.S.C. 241(d)) relating to the issuance of CoCs. A CoC is intended to help protect the 

privacy of human subject research participants from whom identifiable, sensitive information is 

being collected or used in furtherance of the research.2

 Historically, a CoC generally protected a 

researcher from being compelled to disclose identifiable, sensitive information about the research 

participant, created or compiled for purposes of the human subject research. As amended, the 

statute broadened the protections by affirmatively prohibiting holders of CoCs from disclosing 

such information unless a specific exception applies. 

The Cures Act simplified certain aspects of the issuance of CoCs by requiring that CoCs be 

issued for federally-funded human subject research that collects or uses identifiable, sensitive 

information (referred to in this guidance as mandatory CoCs). For non-federally funded 

research, issuance of CoCs is not required but may be issued at the discretion of FDA (referred to

in this guidance as discretionary CoCs). FDA intends to continue receiving and considering such 

requests and will issue discretionary CoCs as appropriate. This guidance is intended to provide 

information on how to request a discretionary CoC, the statutory requirements for requesting 

such a CoC, and the statutory responsibilities associated with possessing a CoC. Although the 

mandatory CoC and the discretionary CoC are issued under different processes, the protections 

 

1 This guidance has been prepared by the Office of Policy in cooperation with the Center for Biologics Evaluation 

and Research, the Center for Drug Evaluation and Research, the Center for Devices and Radiological Health, the 

Center for Tobacco Products, the Center for Food Safety and Applied Nutrition, the Center for Veterinary Medicine, 

and the Office of Chief Scientist at the Food and Drug Administration. 2 There are additional statutes and regulations that protect the privacy of human subject research participants. These 

are outside the scope of this guidance. 
Contains Nonbinding Recommendations 

2 

afforded by the issuance of either CoC are identical and the statutory responsibilities are the 

same. 

In general, FDA’s guidance documents do not establish legally enforceable responsibilities. 

Instead, guidances describe the Agency’s current thinking on a topic and should be viewed only 

as recommendations, unless specific regulatory or statutory requirements are cited. The use of 

the word should in Agency guidances means that something is suggested or recommended, but 

not required. 

II. Background 

A CoC generally protects a researcher from being compelled to disclose identifiable, sensitive 

information about the research participant, created or compiled for purposes of the research, in 

any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding. As 

amended, the statute broadened these protections by prohibiting disclosure of such information. 

By protecting researchers from being compelled to disclose identifiable, sensitive information 

about the research participants, CoCs help protect the identity of the research participants and 

achieve the objectives of the research. There are exceptions to the prohibition on disclosure as 

described in Section III of this guidance. 

FDA has the authority (by delegation) to issue CoCs related to the study of products subject to 

FDA jurisdiction and to which FDA regulations apply, in compliance with the PHS Act, and has 

done so for over 20 years. (42 U.S.C. § 241)3 The Cures Act revisions made issuance of a CoC 

mandatory for federally funded researchers “engaged in biomedical, behavioral, clinical, or other 

research, in which identifiable, sensitive information is collected (including research on mental 

health and research on the use and effect of alcohol and other psychoactive drugs).” For nonfederally funded research, FDA “may, upon application by a person engaged in research, issue to 

such person a certificate of confidentiality to protect the privacy of such individuals (emphases 

added) . . . .” 

The Cures Act also directed agencies to take steps to minimize the burden to researchers, 

streamline the process, and reduce the time it takes to comply with the requirements of the 

statutory provision. FDA has complied with this directive in implementing requirements for the 

issuance of mandatory CoCs to FDA-federally funded researchers. 

For non-federally funded research, FDA has been issuing discretionary CoCs pursuant to the 

amended statutory requirements, on a case-by-case basis upon application to FDA, since 

enactment of the Cures Act. This guidance describes the revised, streamlined process for 

submission to FDA of requests for discretionary CoCs for non-federally funded research. The 

revised process for discretionary CoCs will minimize the burden to researchers who request a 

CoC, will streamline the existing process by reducing the information currently provided in a 

request to FDA for a CoC, will clarify the statutory responsibilities associated with receiving a 

CoC and, thus, will reduce the time it takes to obtain a CoC. 

 

3 FDA, by delegation from the Secretary, Department of Health and Human Services (HHS), has the authority to 

issue CoCs . (See, FDA Staff Manual Guide, 1410.26(1)(E)). Other HHS agencies, e.g., National Institutes of 

Health (NIH), Centers for Disease Control and Prevention, also issue CoCs. 
Contains Nonbinding Recommendations 

3 

III. Scope 

 

To help ensure that discretionary CoCs are issued to those entities who can comply with the 

requirements of the statutory provision, we recommend that only sponsors or sponsorinvestigators, submit requests for discretionary CoCs (as defined in 21 CFR §50.3, §312.3, 

§812.3) (i.e., the individual who takes responsibility for or initiates the clinical investigation). 

This will help eliminate duplicative requests to FDA for the same human subject research. It is 

our understanding that, typically, sponsors and sponsor-investigators are the entities or 

individuals who have responsibility and control over the information and data collected and used 

in research. Furthermore, the human subject research, for which a discretionary CoC is being 

requested, must involve the use or study of a product subject to FDA’s jurisdiction and must be 

subject to FDA’s regulatory authority. 

The term “identifiable, sensitive information,” as used in section 301(d), PHS Act, and in 

relation to CoCs, means “information that is about an individual and that is gathered or used 

during the course of research” covered by the statute and 

(A) through which an individual is identified; or (B) for which there is at least a very 

small risk, as determined by current scientific practices or statistical methods, that some 

combination of the information, a request for the information, and other available data 

sources could be used to deduce the identity of an individual. 

(42 U.S.C. § 241(d)(4)). An entity or individual requesting a discretionary CoC should evaluate 

its own human subject research and make its own determination as to whether the research 

involves the collection of identifiable, sensitive information (e.g., research participant names). 

This evaluation should take into account the type of information collected, whether the 

information is retained for any further use or purpose, the extent of the information, and the 

security of the data systems that contain the information. In considering whether the individual 

information being collected is “identifiable, sensitive information,” sponsors, sponsorinvestigators, and other researchers should be aware of the evolving perspectives as to the 

identifiability of the information collected. Given current technological capabilities, there is 

some support for the position that the identity of an individual participating in certain types of 

research is relatively easy to determine even with limited de-identified data. Genomic data also 

are often considered to fall automatically into the category of identifiable, sensitive information.4

There are various definitions of the phrase identifiable, sensitive information used by different 

government agencies and for different purposes – not all necessarily applicable in this context 

but which may be useful in an evaluation by the sponsors, sponsor-investigators, and other 

researchers of whether certain information would fall within the statutory definition.

5

 A 

 

4 NIH considers research in which identifiable, sensitive information is collected or used, to include “research that 

involves the generation of individual level, human genomic data from biospecimens, or the use of such data, 

regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of 

the human subjects can readily be ascertained.” (NIH, NOT-OD-17-109: Notice of Changes to NIH Policy for 

Issuing Certificates of Confidentiality, effective October 1, 2017). 5 Department of Health and Human Services, Office of the Chief Information Officer. (2016). The Department of 

Health and Human Services Cybersecurity Awareness Training, FISCAL YEAR 2016. Retrieved February 26, 2020, 

from https://www.hhs.gov/sites/default/files/ocio/securityprivacy/awarenesstraining/cybersecurity-awareness.pdf. 
Contains Nonbinding Recommendations 

4 

determination of whether any data or information collected during human subject research is 

identifiable, sensitive information should be made by the sponsors or sponsor investigators. 

Once a CoC is issued, the recipient must comply with the statutory disclosure protections as 

follows (section 301(d)(1), PHS Act): 

(A) [defines who can apply and conditions of applying for a CoC]. 

(B) Except as provided in subparagraph (C), any person to whom a certificate is issued 

. . . to protect the privacy of individuals described in such subparagraph shall not disclose 

or provide to any other person not connected with the research the name of such an 

individual or any information, document, or biospecimen that contains identifiable, 

sensitive information about such an individual and that was created or compiled for 

purposes of the research. 

(C) The disclosure prohibition in subparagraph (B) shall not apply to disclosure or use 

that is— 

(i) required by Federal, State, or local laws, excluding instances described in 

subparagraph (D); (ii) necessary for the medical treatment of the individual to 

whom the information, document, or biospecimen pertains and made with the 

consent of such individual; (iii) made with the consent of the individual to whom 

the information, document, or biospecimen pertains; or (iv) made for the purposes 

of other scientific research that is in compliance with applicable Federal 

regulations governing the protection of human subjects in research. 

(D) Any person to whom a certificate is issued . . . to protect the privacy of an individual 

described in such subparagraph shall not, in any Federal, State, or local civil, criminal, 

administrative, legislative, or other proceeding, disclose or provide the name of such 

individual or any such information, document, or biospecimen that contains identifiable, 

sensitive information about the individual and that was created or compiled for purposes 

of the research, except in the circumstance described in subparagraph (C)(iii). 

(E) Identifiable, sensitive information . . ., and all copies thereof, shall be immune from 

the legal process, and shall not, without the consent of the individual to whom the 

information pertains, be admissible as evidence or used for any purpose in any action, 

suit, or other judicial, legislative, or administrative proceeding.

(F) Identifiable, sensitive information collected by a person to whom a certificate has 

been issued . . ., and all copies thereof, shall be subject to the protections afforded by this 

section for perpetuity. 

(G) The Secretary shall take steps to minimize the burden to researchers, streamline the 

process, and reduce the time it takes to comply with the requirements of this subsection. 

As part of the protection of the identifiable, sensitive information collected in the research, any 

other entities with whom the sponsor, sponsor-investigator, or other researcher shares the 

information (i.e., “copies” of the information) are also subject to the disclosure requirements. 

Such entities include contract research organizations, clinical investigators, and academic 

institutions, among others. 

Under FDA regulations, an Institutional Review Board (IRB) is a group that has been formally 

designated by an institution to review, approve the initiation of, and conduct periodic review of 
Contains Nonbinding Recommendations 

5 

biomedical research involving human subjects. (21 CFR §56.102(g)). In accordance with FDA 

regulations, an IRB has the authority to approve, require modifications in (to secure approval), or 

disapprove such research. (21 CFR §56.109(a)). An IRB review serves an important role in the 

protection of the rights and welfare of human research subjects. If an IRB in reviewing research 

determines that particular data collected in a clinical trial are sufficiently sensitive to warrant 

requesting a CoC, then it is within the purview of an IRB to request that a CoC be obtained in 

order to secure IRB approval. Any disagreement between an IRB, sponsor, and/or clinical 

investigators, regarding the need to request a CoC for a particular study should be resolved by 

appropriate communications among those parties. 

IV. Request for Discretionary CoC From FDA

Prior to submitting a request to FDA for issuance of a discretionary CoC, the potential requestor 

should consider the following questions: 

 Is the requestor involved in human subject research in which identifiable, sensitive 

information is collected?

 Is the requestor a sponsor or sponsor-investigator or authorized representative (i.e., the 

individual who takes responsibility for or initiates the clinical investigation)? 

 Does the human subject research, for which a discretionary CoC is being requested, 

involve the use or study of a product subject to FDA’s jurisdiction and subject to FDA’s 

regulatory authority? 

 Are the requestor’s research measures sufficient to protect the confidentiality of the 

identifiable, sensitive information? 6

We recommend that a request to FDA for the issuance of a discretionary CoC be made by those 

entities and individuals that can answer “yes” to all of these questions. A request for a 

discretionary CoC also should not be made if the human subject research is federally funded.7 

We also prefer that all requests for discretionary CoCs be submitted electronically as described 

in this section and with the information and assurances as detailed in this section. 

To make a request to FDA for a discretionary CoC, the requestor should determine the 

appropriate Center and submit the request, in the form of a letter (e.g., as a PDF attachment to 

the email submission), through one of the following email addresses: 

Center for Drug Evaluation and Research (CDER) at: CDER-CoCRequests@fda.hhs.gov

Center for Biologics Evaluation and Research (CBER) at: 

CBERBIMONotification@fda.hhs.gov

Center for Devices and Radiological Health (CDRH) at: CDRH-CoC@fda.hhs.gov

Center for Tobacco Products (CTP) at: CTP_RIHSC@fda.hhs.gov

 

6

 The amendments to section 301(d) of the PHS Act, signal Congressional support for enhanced privacy protections 

for participants in research. FDA recommends that sponsors and investigators explore ways to further enhance their 

own privacy and confidentiality procedures.

7 As noted in Section II, CoCs for federally funded research are mandatory and outside the scope of this guidance. 

Mandatory CoCs for federally funded research are handled in a different manner than discretionary CoCs. 
Contains Nonbinding Recommendations 

6 

Center for Food Safety and Applied Nutrition (CFSAN) at: CFSAN-CoCRequests@fda.hhs.gov

Center for Veterinary Medicine (CVM) at: AskCVM@fda.hhs.gov 

We recommend the request letter include the following information and assurances to facilitate 

FDA’s review and to expedite consideration of the request for the discretionary CoC. 

Descriptive Information 

 Sponsor or Sponsor-Investigator Name or authorized representative (e.g., the individual 

who takes responsibility for or initiates the clinical investigation). 

 Sponsor or Sponsor-Investigator or authorized representative Address (same as on file 

with FDA). 

 Sponsor or Sponsor-Investigator or authorized representative Email Address. 

 FDA Application Number, as applicable, (e.g., IND/NDA/BLA/IDE/HDE/PMA/PMTA/

ITP)8.

 ClinicalTrials.gov Numerical Identifier (if applicable) (number provided upon 

registration on www.ClinicalTrials.gov).

 Research Title

 If conducting human subject research subject to FDA’s jurisdiction but the sponsor or 

sponsor-investigator is exempt from submission of an investigational application (e.g., 

IND/IDE) submit all of the above information with the exception of the FDA application 

number. 

 Signature of sponsor, sponsor-investigator, or authorized representative, submitting the 

discretionary CoC request. 

Assurances

The requestor should include information sufficient to allow FDA to assess whether the 

requestor understands its obligations to comply with the CoC statutory provisions (section 

301(d), PHS Act, (42 U.S.C. 241(d))). We recommend use of the following language in the 

request letter to facilitate FDA’s review: 

The requestor is engaged in biomedical, behavioral, clinical, or other research, in which 

identifiable, sensitive information is collected or used. 

The requestor agrees it is responsible for complying with requirements to protect the 

confidentiality of identifiable, sensitive information that is collected or used in 

biomedical, behavioral, clinical, or other research. 

The requestor agrees not to disclose or provide, in any Federal, State, or local civil, 

criminal, administrative, legislative, or other proceeding, the name of such individual or 

any such information, document, or biospecimen that contains identifiable, sensitive 

 

8 Investigational New Drug Application/New Drug Application/Biologics License Application/Investigational 

Device Exemption/Humanitarian Device Exemption/Premarket Application/Premarket Tobacco Product 

Application/Investigational Tobacco Product. 
Contains Nonbinding Recommendations 

7 

information about the individual and that was created or compiled for purposes of the 

research, unless such disclosure or use is made with the consent of the individual to 

whom the information, document, or biospecimen pertains. The requestor also agrees 

not to disclose or provide to any other person not connected with the research the name 

of such an individual or any information, document, or biospecimen that contains 

identifiable, sensitive information about such an individual and that was created or 

compiled for purposes of the research. 

The requestor understands that the identifiable, sensitive information collected by a 

researcher to whom a discretionary CoC has been issued, and all copies of such 

information, are subject to the protections afforded by the statute in perpetuity. 

The requestor understands and agrees that disclosure is permitted by the recipient of a 

CoC only when: 

• Required by Federal, State, or local laws (e.g., as required by the Federal Food, 

Drug, and Cosmetic Act, or state laws requiring the reporting of communicable 

diseases to State and local health departments), excluding instances of disclosure 

in any Federal, State, or local civil, criminal, administrative, legislative, or other 

proceeding; 

• Necessary for the medical treatment of the individual to whom the information, 

document, or biospecimen pertains and made with the consent of such individual; 

• Made with the consent of the individual to whom the information, document, or 

biospecimen pertains; or 

• Made for the purposes of other scientific research that is in compliance with 

applicable Federal regulations governing the protection of human subjects in 

research. 

The requestor also should note that the signature provided for this request, if a facsimile 

or e-signature, represents a true and correct signature of the sponsor, sponsorinvestigator, or that of an authorized representative, authorized to submit this request for 

a Certificate of Confidentiality and to make these assurances. 

V. FDA Review and FDA Issuance of Discretionary CoC 

After a request has been sent to the appropriate Center responsible for the FDA-regulated 

product, a review will be conducted to ensure the requestor has submitted all the information and 

assurances, described in Section IV. After FDA completes its review, the Center will send an 

electronic response letter to the requestor indicating whether or not the discretionary CoC has 

been granted. If granted, that electronic response letter will serve as the CoC. It is expected that 

most discretionary requests will be granted provided these are in compliance with the statutory 

requirements. The recipient of the CoC is expected to carry out the statutory assurances 

provided in the request and reiterated in the FDA electronic response letter for the protection of 

the individuals participating in the human subject research.