AMA Journal of Ethics^®

Enrollment in research studies is often limited by the fear that one’s personal information cannot be kept private. One way researchers can address this is by obtaining a certificate of confidentiality (CoC) for their study. This article briefly reviews what a certificate of confidentiality is, how to obtain one, and the Marshfield Clinic’s experience in recruiting for the Personalized Medicine Research Project.

Protecting the privacy and confidentiality of participants is paramount in the recruitment for research studies. In developing research protocols, therefore, efforts to protect the information that participants will disclose need to be thoroughly planned, implemented, and communicated to participants. A certificate of confidentiality is one of the resources available for maintaining privacy and confidentiality [1].

Issued by certain Department of Health and Human Services (DHHS) agencies, a CoC allows researchers to “refuse to disclose identifying information on research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level” [2]. This additional level of protection helps researchers maintain participants’ privacy and confidentiality and promotes enrollment in the research study by reassuring participants.

A study qualifies for a CoC if:

1. This study will collect sensitive personally identifiable information; and/or
2. This study will maintain consent forms with identifiable information other than names (e.g., social security numbers, addresses, etc.).
3. This study cannot be conducted anonymously—that is, the research itself relies on personally identifiable data to gather data.
4. The study subject matter falls within the research mission of the NIH and its Institutes, Centers, and Offices.
5. Data is maintained within the United States [3].

Once a CoC has been obtained, the study subjects must be informed of its existence, protections, and limitations. The institution obtaining the CoC must also submit an amendment application 3 months in advance of making any significant changes in personnel who have a major role in conducting the study, the aim of the study, or drugs being administered.

Marshfield Clinic’s Personalized Medicine Research Project

The Personalized Medicine Research Project (PMRP) is studying a large cohort of residents of Central and Northern Wisconsin [4]. This database, which contains genetic, medical, and environmental information, is maintained by the Marshfield Clinic Research Foundation [5]. The main goals of the project are to better understand the roles of genetics, environment, and behavior in the development of disease and response to medications and how to use this information to enhance personalized patient care. The power of the associations among genetics, phenotypes, and the environment goes up as enrollment in the study increases because results yield a more accurate representation of the population. To boost enrollment, the PMRP applied for, and received, a CoC.

At an enrolling appointment, information about participation is thoroughly reviewed with the potential participant by a person or at a computer kiosk [6]. Our current informed consent processes and the frequently asked questions page on our web site include this (or similar) language about the CoC:

To help us protect your privacy, we have obtained a certificate of confidentiality from the National Institutes of Health. With this Certificate, the researchers cannot be forced to disclose information that may identify you, even by a court subpoena, in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding [7].

Government involvement may or may not promote participation; some prospective participants have confidence in the government involvement, some are neutral, and some distrust it. Some people choose not to participate due to privacy concerns, especially related to insurance, and no security measure will be enough to outweigh those concerns. This is understandable, as there is never a total guarantee of protection under any security system.

Ultimately, the level of trust and confidence a person has in the facility or institution conducting the research is the main determinant of his or her participation. This is why it is necessary to explain what measures are in place to protect privacy and confidentiality. Having layers of protection—internal, external, and governmental—is a way of showing how seriously researchers take maintaining the security of participants’ information.