Skip Navigation Links

Certificates of Confidentiality for NIH Funded Research

NIH awardees no longer have to apply for a CoC.

Per Section 2012 of the 21st Century Cures Act as implemented in the 2017 NIH Certificates of Confidentiality Policy, all ongoing or new research funded by NIH as of December 13, 2016 that is collecting or using identifiable, sensitive information is automatically issued a CoC.  Compliance requirements are outlined in the NIH Grants Policy Statement, which is a  term and condition of all NIH awards.

This policy applies to NIH funded: 

  • Grants
  • Cooperative Agreements
  • R&D Contracts
  • Other Transaction Awards
  • NIH’s own intramural research

How do I know if my NIH funded research project is covered by a CoC?

Research in which identifiable, sensitive information is collected or used, including research that

  • Meets the definition of human subjects research, including exempt research in which subjects can be identified
  • Is collecting or using human biospecimens that are identifiable or that have a risk of being identifiable
  • Involves the generation of individual level human genomic data
  • Involves any other information that might identify a person

If your research meets any of the above criteria then your research data or information is automatically protected by a CoC from NIH.

What does having a CoC mean I need to do?

  1. Researchers with a CoC may ONLY disclose identifiable, sensitive information in the following circumstances:
    • if required by other Federal, State, or local laws, such as for reporting of communicable diseases
    • if the subject consents; or
    • for the purposes of scientific research that is compliant with human subjects regulations
  2. AND you must ensure that anyone who is conducting research as a subawardee or receives a copy of identifiable sensitive information protected by the policy understand they are they are also subject to the disclosure restrictions, even if they are not funded directly by NIH.

How do I document that I have a CoC for my NIH funded Research?

NIH will no longer issue a physical certificate.  You may point to your Notice of Award and the NIH Grants Policy Statement as documentation of the CoC protection.

Will I ever need to extend or amend my CoC?

If your NIH-funding will or has ended but the collection of new data from research participants will continue without NIH-funding you will need to apply for a CoC for continuity of protections using the CoC application system. If your NIH funding will or has ended but your study has completed all enrollment and data collection, there is no need to extend the Certificate. Sensitive, identifiable research information maintained by investigators during any time a Certificate is in effect, is protected permanently.

Where can I learn more?

Read the 2017 NIH Certificates of Confidentiality Policy.

Have a CoC Question?

Please address your inquiries to: NIH Office of Extramural Research:


Back to Top