Certificates of Confidentiality: When Are They Needed and Whom Do They Protect? Susan Sonne, PharmD, BCPP Associate Professor of Psychiatry Associate Director of SCTR RKS Program Chair, IRB II

What is a CoC? Provides a layer of privacy protection for participants enrolled in studies collecting sensitive information. Protects the INVESTIGATOR from being forced to disclose information that identifies a person as a study participant – even under subpoena or court order. Typically issued by NIH or FDA—can be issued even for unfunded studies

What is a CoC (continued) CoCs expire and must be renewed to protect new data CoCs are permanent—any information protected under the CoC is protected permanently CoCs can be retroactive—once a CoC is in place, it can protect all info previously collected (as long as there has not been a subpoena or court order prior to the issuance of the CoC)

What is the purpose of a CoC? To enable participants to provide truthful information without risk of criminal or civil action May improve recruitment for studies collecting sensitive information

What is considered sensitive? Research on HIV, Acquired Immune Deficiency Syndrome (AIDS), and other sexually transmitted diseases (STD) Studies that collect information on sexual attitudes, preferences, or practices Studies on the use of alcohol, drugs, or other addictive products Studies that collect information on illegal conduct Studies that gather information that if released could be damaging to a participant's financial standing, employability, or reputation within the community Research involving information that might lead to social stigmatization or discrimination if it were disclosed Research on participants' psychological well-being or mental health Genetic studies, including those that collect and store biological samples for future use

What does a CoC protect? A CoC only protects an investigator from disclosing a participants’ identity as a research participant – not the research data. If the identity is known, any research data would be discoverable.

Important Points Information in the medical record is always subject to subpoena or court order It cannot be guaranteed that information that identifies a person as a study participant in the medical record could be protected by a CoC (at least at MUSC).

What studies should not have a CoC? Studies not collecting sensitive data Studies collecting sensitive data solely from the medical record (MUSC policy) Studies that require study participation to be documented in the medical record for the purposes of clinical billing to insurance (MUSC policy)

What is the institutional commitment? The Institution is responsible for upholding the CoC and providing appropriate legal counsel if warranted

CoC Requirements CoC is only considered valid if the PI has signed an assurance that the PI will uphold the CoC If PI changes, there must be an assurance signed by the new PI for the CoC to still be valid There should be sign off by the an Institutional Official (a designated individual within the Office of Research and Sponsored Programs). There should be language in the IRB-approved informed consent document that describes the additional protections afforded by the CoC

Investigator-Initiated CoCs (at MUSC) PI must obtain institutional approval for CoC by submitting a completed CoC checklist to ORSP An authorized official within ORSP will determine the appropriateness of a CoC The PI will maintain a copy of the CoC application as well as the CoC for review/audit The PI will sign an assurance notice that s/he plans to uphold the CoC If the PI changes, the new PI will also sign an assurance

This form is how MUSC determines if a CoC is appropriate This form is how MUSC determines if a CoC is appropriate. Check with your institution to see how this would be done at your site.

Sponsor-Initiated CoCs It should be determined whether the sponsor is expecting your site to adhere to the CoC If MUSC is to adhere to the CoC, the PI submit a signed assurance letter, copy of the CoC and completed CoC checklist to ORSP If the CoC is only for a portion of the study (e.g. the biorepository) and MUSC would not be under it, appropriate language should be in the consent that the holder of the CoC is the sponsor but info in the MUSC medical record could still be subject to subpoena

Scenario 1 An investigator is collecting information on HIV status from the medical record and interviewing participants about sexual risk behaviors. No information regarding study participation would be in the medical record Is a CoC appropriate?

Scenario 2 An investigator is conducting a chart review and obtaining information on outcomes of patients who have had hip and knee surgeries. Is this information sensitive? Is a CoC appropriate?

Scenario 3 An investigator is participating in multi-site behavioral intervention for the treatment of cocaine dependence. The sponsor has obtained a CoC and wishes each clinical site to adhere to the CoC No information that would identify the participant would be in the medical record Is a CoC appropriate?

Scenario 4 An investigator is conducting an interview study regarding barriers to treatment with patients who have diabetes Is this information sensitive? Is a CoC appropriate?

Scenario 5 An investigator at your site is participating in multi-site medication trial for the treatment of skin cancer Information that would identify the participant will be in the medical record since the study intervention is part of clinical care and will be billed to insurance Does it make sense to have a CoC?

Scenario 5+ What if in the previous example: Tissue samples of affected skin will be sent to a biorepository for future genetic analysis. The sponsor has a CoC for the biorepository Would your site fall under the CoC? Why type of language would be in your site’s consent?

Summary Investigators should only consider getting a CoC if they are collecting sensitive information A CoC only protects a participant’s identity as a research participant. If the identity is known, any research data would be discoverable. Medical records may be subject to subpoena or court order If a study is only collecting information from the medical record, that information would already be discoverable and a CoC would not add additional protection

Where can I find more information? NIH Certificates of Confidentiality (CoC) Kiosk http://grants.nih.gov/grants/policy/coc/index.htm NIH Certificates of Confidentiality (CoC) FAQs http://grants.nih.gov/grants/policy/coc/faqs.htm#366 MUSC policy: http://academicdepartments.musc.edu/research/policies/ Research Toolkit http://academicdepartments.musc.edu/sctr/tools_links/tool kit_design.html