APPENDIX B:
SAMHSA Confidentiality Certificate Information

SAMHSA CONFIDENTIALITY CERTIFICATE INFORMATION (updated 6/26/03 )

A Confidentiality Certificate (CC) protects researchers and their contractors and cooperating agencies from having to comply with government requests (including, e.g., subpoenas, court orders, and State reporting laws) for names or other information that would identify their research participants. More information about CCs follows the application instructions.

APPLICATION INSTRUCTIONS

(For general CC information, please see below):

An example of a CC application (with all the information we need) is at the end of these instructions. Examples of CC consent-form text are included in these instructions. We try to comply with the regulations perfectly so your Certificate will survive any legal challenge.

The principal investigator (PI) of the research project (e.g., of the evaluation segment of a demonstration) applies for a Confidentiality Certificate. We suggest that the PI apply for his/her CC after the project is entirely planned and the final consent form is written. She/he would have to apply again if the consent form or anything else substantial changed, since by signing the application, he/she is legally affirming the application's description of the study. That is, the consent form and procedures of the actual study have to be what you've described in your application.

We will be glad to take a look at your consent form before you go to IRB review or apply for your CC. Also, please let us know by a call or e-mail if you need your certificate very quickly--that is, if you don't plan to start without it and you're about to recruit participants in the next week or two--and please don't hesitate to call with questions or to check the status of your application. We file applications by PI name, so please give us your PI name in every communication.

Your CC coverage starts before your paper copy of the CC arrives--it starts on the date your application (including consent forms) is complete and complies with SAMHSA's standards, so when your coverage starts is under your control. Once you have your CC, your coverage is retroactive to the start of your study and continues forever. People on your rolls or in your data are covered, even if they are no longer active.

A CC application is a letter from the principal investigator to SAMHSA SAMHSA (to SAMHSA/OA/OPPC, c/o Confidentiality Certificate Coordinator, Office of Scientific Affairs, NIAAA, Willco Building, Suite 409, 6000 Executive Boulevard, Rockville, MD 20852; 301-443-2890; FAX 301-480-1726). THE LETTER MUST PROVIDE the following, as required in the regulations (It may save time to respond very literally and exactly--or to use the example at the end of these guidelines):

a) Name & address of person primarily responsible for the conduct of the research (the principal investigator), and of the sponsor or institution with which that person is affiliated (Please have the PI's name and address on the front page.)
Name and contract or grant ID number of the project
A copy of notice of approval from the institutional review board (IRB) of every institution involved in your project. Each institution must have an SPA, MPA, or FWA ( http://ohrp.osophs.dhhs.gov for info and to apply).

b) Location of the research project and description of the facilities available for conducting the research, including the name and address of any hospital, institution, or other facility to be used in connection with the research

c) Summary of the scientific or other appropriate training and experience of the principal investigator. (The PI's resume or summary bio suffices.)

d) An outline or summary of the research protocols, including a concise statement of the rationale and purpose of the research project and the general research methods to be used (Ideally, these should include summaries of criteria and procedures for subject selection, study variables, procedures for data collection and analysis, any treatment/intervention provided, and informed consent procedure. Subject selection and informed consent procedures are especially important.)

e) Start date and estimated end date (when CC will expire) for the project

f) Specific request (e.g., "I request authority to withhold..."), signed by the individual primarily responsible for the conduct of the research, for authority to withhold the names and other identifying characteristics of program participants, and the reasons supporting that request

g) through k) are assurances that each application must provide. The application might say: A As principal investigator, I assure you of the following:

g) that my colleagues and I will comply with all the requirements of 45 CFR 46, "Protection of Human Subjects" [IRB regs; http://ohrp.osophs.dhhs.gov/ for info], and its standards for informed consent

h) that the CC will not be presented as endorsement of the research by the Secretary, DHHS, or used to coerce or pressure subjects to participate

i) that the Certificate will be used by all those covered by it, to refuse to disclose identifying characteristics of research subjects in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to compel disclosure of the identifying characteristics of research subjects

j) that all research participants under the CC will be informed that:

1) A CC has been issued
2) The persons authorized by the Certificate to protect the identity of research subjects may not be compelled to identify research subjects in any civil, criminal, administrative, legislative, or other proceedings, whether State, Federal, or local

LIMITATIONS

3) Under any of the following conditions, the CC does NOT authorize any person to refuse to reveal identifying information concerning research subjects:

i. If the subject (or guardian) consents in writing to disclosure of identifying information

ii. If release is required by the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301) or regs thereunder (21 CFR)

iii. If authorized DHHS personnel request identifying information for audit or program evaluation of a research project funded by DHHS or for investigation of DHHS grantees or contractors

4) The Certificate does not prevent voluntary disclosure of identifying information

5) The Certificate does not represent an endorsement of the research by the Secretary, DHHS

k) that all research subjects entering the study after termination of the Certificate will be told the protections do not apply to them

We ask for all these assurances, but only those that are relevant to your project must be reflected in your consent forms or other information you give to project participants.

The application letter must be complete and provide all of the information requested. The following documents should be attached to the letter:

1. Documentation of project approval by the institutional review board (IRB) of every institution involved in the study. Each institution must have an SPA, MPA, or FWA from the Office of Human Research Protections. You can get information and apply for FWAs online at ( http://ohrp.osophs.dhhs.gov/ ). SAMHSA requires IRB approval before it issues a CC.

2. A copy of each consent (and/or assent) form to be used in the project.

GENERAL INFORMATION ABOUT CONFIDENTIALITY CERTIFICATES

The Substance Abuse and Mental Health Services Administration (SAMHSA) has responsibility for issuing Confidentiality Certificates for projects it sponsors. This document is intended to help PIs develop their applications for Confidentiality Certificates.

Confidentiality Certificates (CCs) are issued under the authority vested in the Secretary, DHHS, by section 301(d) of the Public Health Service Act, 42U.S.C. §241(d), as amended. A CC authorizes "persons engaged in research on mental health, including research on the use and effect of alcohol and other psychoactive drugs, to protect the privacy of individuals who are the subject of such research by withholding from all persons not directly connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals."

In other words, a CC protects researchers from having to comply with things like subpoenas and court orders. It does not require researchers to protect information, but it enables them to. SAMHSA works to protect participants in its projects and our issuance of Confidentiality Certificates pursues this goal. CCs were tested successfully in court soon after they were enacted ( People v. Newman, 32 N.Y.2d 379, 298 N.E.2d 651, 345 N.Y.S.2d 502 (1973), cert. denied, 414 U.S. 1163 (1973)).

If an IRB approves every aspect of a project except the project's lack of a CC, then SAMHSA can proceed as if the project had IRB approval. We need a note from the IRB that approval is contingent only upon receipt of a CC. (PIs sometimes draft a note and ask the IRB chair to sign it, to save time.)

A CC applies to research, and does not cover services per se. SAMHSA CCs cannot be used for research requiring an Investigational New Drug exemption or research related to law enforcement activities within the purview of 502 (c) of Controlled Substances Act and 21 CFR 1316.21. The FDA must issue CCs for projects with INDs. A CC applies to one project; a separate application is required for each project.

If a project has a lead entity such as a coordinating center, and a number of study sites, the coordinating center may get one CC for the entire project, which would protect itself and all of its contractors and other cooperating agencies involved in the project. Consent forms and IRB approval letters from all sites must be included in the package.

CONSENT FORMS

A consent form that leads to genuine and realistic informed consent is a key element of adequate participant protection. A consent form should truly inform readers, in language they understand. In some cases, consent forms should be read out loud. If there will be questions about drug use, mental health or substance abuse treatment, sexual activity, or any other sensitive issue, this should be explicit in the consent form.

Where risks are discussed, the risk of confidentiality breach should be mentioned for participants to consider. Many consent forms follow this statement of confidentiality risk with information about how confidentiality is being protected, to reassure prospective participants. Some do not talk directly about confidentiality risk, but say in the risk section something like, "The risk of participating in this study is expected to be minimal because we have taken steps to protect your privacy," or other words to this effect. The point is to have people include confidentiality issues as they mull over the risks.

Consent forms should not over-promise the degree of protection or be vague or misleading. For example, stating that "participant information will be kept in strictest confidence" is vague and false since DHHS can audit and you may be reporting child abuse. "Only researchers will have access to your data" is similarly false. SAMHSA asks PIs to revise statements like these.

Better than such general (and often false) statements is to tell people about the specific steps that have been taken to protect participants' confidentiality, such as training staff to keep information private, keeping the code file locked away or encrypted, and getting a CC. Then, you may want to use a sentence about risk--one you didn't already use discussing risks. SAMHSA also accepts statements like, "The privacy of the information we collect about you will be very carefully protected," or, "We are committed to protecting your privacy," or, "We have taken steps to protect your privacy."

SAMHSA CC projects' consent forms (or other pre-consent information forms) must have 1) CC information required by the regulations and mentioned in the assurances, and 2) information related to requirements that are based on DHHS and SAMHSA requirements. HHS and SAMHSA ask researchers to report communicable diseases voluntarily as if they were obeying State laws (generally, if they are testing for diseases; most SAMHSA projects do not do this). SAMHSA also does not want to protect child abuse information with its CCs, but it asks researchers to report apparent child abuse voluntarily, as they might under their State laws. We also ask researchers to take appropriate steps, including reporting confidential information, if they discover that there is danger that someone will harm him-/herself or others. Researchers must notify participants (usually in consent forms) in advance about any reporting they will do.

Since imminent harm or child abuse might be discovered in the research setting, and if researchers are testing for a communicable disease, researchers should establish a reporting policy. Having it conform with State law may be the most simple way to do this, but you are doing this voluntarily. The CC protects you from having to comply with State reporting laws. To ensure this stands up in court, your consent form must not make statements that you are going to obey the law or the state law. For example, the consent form should not say things like, "We are required to report...." or "We will keep your information confidential except as required by law."

If you can, you may want to say you are invited to participate in this study because you are in X program, rather than because you are a substance abusing prisoner.

Consent forms may leave out what is not germane. For example, if a project does not fall within the purview of the FDC Act, then SAMHSA does not ask that consent forms include information about the CC limitation regarding the FDC Act, even though you will have signed all the assurances, including the one about the FDC Act.

Consent forms differ, but the following are examples of consent-form language about CCs that have been formally approved as suitable for some projects:

a) Two informal, more readable, short versions that many PIs prefer:

1) We have [applied for] a Confidentiality Certificate (CC) from the US Dept. of Health and Human Services (DHHS) to protect the researchers from being forced to identify you (for example, by court order or subpoena). We may voluntarily report medical information in medical necessity, likely harm to yourself or others, including child abuse, however, and DHHS may see your information if it audits us. This CC does not imply DHHS approval or disapproval. [communicable disease reporting and any other exceptions should be included]

2) We have also obtained [applied for] a Confidentiality Certificate (CC) from the US Department of Health and Human Services (DHHS) to protect the researchers from being forced, even by court order or subpoena, to identify you. (The CC does not imply approval or disapproval of the project by the Secretary of DHHS.) You should know, however, that we may provide information to appropriate individuals or agencies if harm to you, harm to others, or child abuse becomes a concern. In addition, the federal agency funding this research may see your information if it audits us. [communicable disease reporting and any other exceptions should be included]

b) Other, softer, text that has been used regarding child abuse is the following:

... We may release identifying information in some circumstances, however. If we see something that would immediately endanger you or others, such as child abuse, we may discuss it with you, if possible, or seek help. Also, because this research is sponsored by SAMHSA, staff from that and other DHHS agencies may review records that identify you. [communicable disease reporting and any other exceptions should be included]

c) A formal version, designed by lawyers:

To help keep information about you confidential, we have obtained [applied for] a Confidentiality Certificate from the Department of Health and Human Services (DHHS). This Certificate does not imply that the Secretary, DHHS, approves or disapproves of the project. The Confidentiality Certificate will protect the investigators from being forced, even under a court order or subpoena, to release information that could identify you. We may release identifying information in some circumstances, however. For example, we may disclose medical information in cases of medical necessity, or take steps (including notifying authorities) to protect you or someone else from serious harm, including child abuse. Also, because this research is sponsored by SAMHSA, staff from that and other DHHS agencies may review records that identify you for audit. [and any other exceptions (e.g., communicable disease reporting if you test for a communicable disease) should be included as steps the researchers may take voluntarily]

More information about adequate Informed Consent Forms and other aspects of participant protection can be found in the 45 CFR 46 regs, available at http://ohrp.osophs.dhhs.gov/ under the title "Protection of Human Subjects."

EXTENSIONS and AMENDMENTS OF SAMHSA CCs

CC protection is permanent with regard to subjects who participated (even by being on its rolls) in a covered study while the CC was in effect. CC protections do not extend, however, to participants who join a project after its CC has expired. To get a CC extension, the principal investigator on the current CC sends SAMHSA a signed request for an extension, ideally before expiration, with the proposed new expiration date, the justification for the extension, a copy of the current IRB approval, a copy of the current consent form, a copy of the expiring CC, and a statement that the project has not changed in any significant way since the original CC was issued. That is, the primary staff, consent form, scope and direction, instruments, and other significant features must be the same as when the certificate was issued.

CC protections also do not extend to a research project that changes significantly from its description in the original CC application. If the PI, the consent form, scope and direction, instruments, or other significant features of a project change, the PI should notify SAMHSA. If the consent form changes (in any way at all), it is helpful to send both old and new forms. If the changes are judged significant--if they increase risks to participants--the regulations require a full new application, and we ask also for a copy of the original CC. If the changes do not affect risk to participants, the PI will be notified that his/her CC remains in effect with the project changed as described.

AN EXAMPLE OF A SAMHSA CONFIDENTIALITY CERTIFICATE (CC) APPLICATION:

Confidentiality Certificate Coordinator
SAMHSA/OA/OPPC
NIH/NIAAA/OSA
Willco Building, Suite 409
6000 Executive Boulevard
Rockville, MD 20852

Dear Confidentiality Certificate Coordinator :

I am writing to request a confidentiality certificate for the project described below.

a) Principal investigator's name and address:

John Doe, Ph.D., Director of Studies, Services Research Institute, Suite 400, 3300 Dupont Avenue, Fremont, MD 20999.

I can be reached at 301-123-4567 (voice), 301-123-8910 (fax), jdoe@SRI.org. [quick-contact info]

My study is CSAT grant no. TI01234, "Evaluation of Project HEALTH." Our project officer at SAMHSA is Ken Ncadi.

b) Location and description of study sites:

The study sites are residential substance abuse treatment facilities in three Oklahoma counties. Treatment will be provided and all interviews will be conducted at these sites. Data analysis is housed at Services Research Institute. The project sites are as follows: [Please give names and addresses of any hospital, institution, or other facility to be used in connection with the research. Your cooperating agencies also are covered by your CC, and it's good to identify them in the application. If what they do isn't obvious, please also give a brief description.]

c) Information about investigator(s):

[Not needed for SAMHSA grantees. Resumes or brief summaries, including names and addresses, of the scientific or other appropriate training and experience--of all personnel having major responsibilities in the research project, and the training and experience requirements for major positions not yet filled. The PI's resume or summary is sufficient.]

d) An outline or summary of the research protocols:

1. [This should be a short, clear statement of the purpose of the research project and the general research methods to be used. Generally, this should include criteria and procedures for subject selection, study variables, procedures for data collection and analysis, any treatment/intervention provided, and informed consent procedure. Subject selection and informed consent procedures are important.

2. [In addition, please include a separate, very short statement summarizing the purpose of the research and the other key characteristics in one or two paragraphs, such as the following:]

The purpose of the study is to evaluate the effectiveness of... and.... by comparing their outcomes over a period of.... years. Using a pre/post research design, the researchers will conduct baseline and three follow-up interviews, at 3, 6, and 12 months after discharge. We will also use information from..... and administer urine tests. A total of 200 adult clients and their children are expected to participate. Some of the data will be used in a cross-site study.

3. My project has the following plans for [Please briefly describe your plans for handling the following]

a) reporting suspected child abuse: [e.g., We plan to report to local authorities.]

b) reporting communicable diseases we test for--[e.g., We plan to report to state public health officers, or, We are not testing for a communicable disease.]

c) reporting harm to self or others: [e.g., We plan to report to participant's physician. ]

d) dealing with pregnant substance abusers: [e.g., We plan to test for pregnancy and to provide counseling or referral to local substance abuse treatment providers or physicians as appropriate.]

e) other reporting we plan to do:

e) Start date and estimated end date (CC will expire at end date) for the project:

The project began 10/1/97 and will end 9/30/2000. We expect to begin recruiting participants by 12/1/97, and we will/will not wait until our CC is in place. [Knowing when your CC must be done helps us plan the work on it. Please note also that the OGC recently decided that CC coverage does not start until your CC starts, but once you have a CC, it covers anyone who is in your study while the CC is in effect, for the entire study, including the time before you got your CC. So if you recruit before your CC protection starts, information you get before the CC date will be protected by your CC for people who are participating (e.g., on your rolls) during the CC coverage period.]

f) Signed specific request with reasons:

I request authority to withhold the names and other identifying characteristics of the participants in my study, "Evaluation of Project HEALTH." My reasons for this request are that I am collecting sensitive substance abuse and mental health data, and the CC will protect my participants' privacy and help me recruit participants. [reasons you want authority to protect your participants should very briefly be summarized here. This should include how the Certificate will benefit participants in your project.]

____[signature]__________ John Doe, Ph.D., PI

g) - k) Assurances:

I assure you of the following:

g) that my colleagues and I will comply with all the requirements of 45 CFR 46, "Protection of Human Subjects" and its standards for informed consent;

h) that the CC will not be presented as endorsement of the research by the Secretary, DHHS, or used to coerce or pressure subjects to participate;

i) that the Certificate will be used by all those covered by it, to refuse to disclose identifying characteristics of research subjects in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to compel disclosure of the identifying characteristics of research subjects;

j) that all research participants under the CC will be informed that:

1. A CC has been issued

2. The persons authorized by the Certificate to protect the identity of research subjects may not be compelled to identify research subjects in any civil, criminal, administrative, legislative, or other proceedings, whether State, Federal, or local

LIMITATIONS
3. Under any of the following conditions, the CC does NOT authorize any person to refuse to reveal identifying information concerning research subjects:

i. If the subject (or guardian) consents in writing to disclosure of identifying information

ii. If release is required by the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301) or regs thereunder (21 CFR)

iii. If authorized DHHS personnel request identifying information for audit or program evaluation of a research project funded by DHHS or for investigation of DHHS grantees or contractors

4. The Certificate does not prevent voluntary disclosure of identifying information

5. The Certificate does not represent an endorsement of the research by the Secretary, DHHS;

k) that all research subjects entering the study after termination of the Certificate will be told the protections do not apply to them.

[We ask for all these assurances, but only those that are relevant to your project must be reflected in the consent forms or other information given to project participants.]

I include copies of the notice of final approval from all IRBs [or "the only IRB"] that must approve our project and of every [or "the only"] consent form that will be used in the project.

The Assurance Number(s) on file with the Office for Human Research Protections for these IRBs is (are) as follows:
Services Research Institute (applicant)--FWA 000000012
Health Services, Inc. (Study site)--FWA00000034.

I understand that if this project is not completed by the expiration date I can request an extension of the Certificate (preferably prior to the expiration date) by sending SAMHSA my reasons for the extension, a copy of the most recent IRB approval, the new expiration date, copies of current consent forms, a copy of the original CC, and a statement that the project has not changed in any significant way since the original CC was issued.

I understand that if the project changes in any significant way (if there are modifications to the consent form, protocols, key personnel, or other significant elements of the project), regulations require me to notify SAMHSA of the changes before the changes are implemented.

Sincerely yours, John Doe, Ph.D. Principal Investigator