Supporting Statement A for
Electronic Requests for NIH Certificates of Confidentiality (CoC) (OD)
OMB# 0925-0689 Expiration date 04/30/2025
Date:
Check off which applies:
New
Revision
Reinstatement with Change
√ Reinstatement without Change
Extension
Emergency
Existing
Federal Government Employee Information:
Name: Pamela Kearney, MD
Address: 6705 Rockledge Dr Rm 812-C Bethesda MD 20892
Telephone: 301-402-2512
Email: NIH-CoC-Coordinator@mail.nih.gov
Table of contents
A. ABSTRACT
A.1 Circumstances Making the Collection of Information Necessary
A.2. Purpose and Use of the Information COLLECTION
A.3 Use of Information Technology and Burden Reduction
A.4 Efforts to Identify Duplication and Use of Similar Information
A.5 Impact on Small Businesses or Other Small Entities
A.6 Consequences of Collecting the Information Less Frequently
A.7 Special Circumstances Relating to the Guidelines of 5 CFR 1320.5
A.8 Comments in Response to the Federal Register Notice and Efforts to Consult Outside Agency
A.9 Explanation of Any Payment of Gift to Respondents
A.10 Assurance of Confidentiality Provided to Respondents
A.11 Justification for Sensitive Questions
A.12 Estimates of Hour Burden Including Annualized Hourly Costs
A.13 Estimate of Other Total Annual Cost Burden to Respondents or Record keepers
A.14 Annualized Cost to the Federal Government
A.15 Explanation for Program Changes or Adjustments
A.16 Plans for Tabulation and Publication and Project Time Schedule
A.17 Reason(s) Display of OMB Expiration Date is Inappropriate
A.18 Exceptions to Certification for Paperwork Reduction Act Submissions
ATTACHMENTS
Attachment 1 - NIH Certificate of Confidentiality (CoC) Request Form Screenshots
Attachment 2 - List of DHHS CoC Coordinators
Attachment 3 - Privacy Impact Assessment (PIA) NOV 2021
Attachment 4 - NIH Privacy Act memo: Applicability of the Privacy Act_CoC_FEB 2022
A. Justification
Abstract: NIH is requesting a reinstatement without change to continue use the online Certificate of Confidentiality (CoC) application system for the next three years. In 2015, NIH launched an online application system for researchers to request a discretionary CoC from NIH. In 2020, NIH launched a new CoC online request system with fewer data fields than the 2015 system, to decrease burden on the requester and NIH staff. Information is collected to allow confirmation of eligibility for a CoC and to issue a Certificate. Eligible requesters receive an electronic Certificate once approved. In 2022, NIH received OMB approval for the revision to the CoC system data fields to add an optional data field that allows the researcher to identify another person to receive CoC system communication and the approved CoC. Since then, there has been several non-substantial change memo requests to make minor updates to the system. For this request, NIH does not request any revisions and requests a reinstatement without change.
CoCs protect research participants by prohibiting disclosure of identifying information about participants to persons not connected to the research, with limited exceptions. NIH, through its funding Institutes, Centers, and Offices (ICOs), has issued CoC since 1997 to researchers who request this protection. Since 2016, NIH-funded researchers are deemed issued a Certificate upon award of NIH funding and do not need to request a Certificate through the system. Non-NIH funded researchers may continue to request a CoC through the online system.
A.1 Circumstances Making the Collection of Information Necessary
The successful recruitment of human research participants into NIH funded studies is critical to the success of the agency’s mission to enhance health, lengthen life, and reduce the burdens of illness and disability. However, human research participants are often concerned about the confidentiality of the information, including biospecimens and data that they provide to researchers. This situation can make it difficult to recruit participants, particularly for research projects on sensitive topics. Recognizing this problem, in 1970, Congress enacted legislation to permit the Department of Health and Human Services (DHHS) to issue CoCs to authorize covered researchers to protect the privacy of research participants by withholding their names and other identifying characteristics from those not connected with the research. The legislation was initially limited to research on the use and effect of drugs. Since then, the scope of the CoC legislation has been expanded several times, including in 1988 when it was expanded to include “biomedical, behavioral, clinical, and other research” (see Section 301(d) of the Public Health Service Act, 42 U.S.C. §241(d)). The regulations that describe DHHS implementation of this authority are codified at 42 CFR Part 2a. In 1997, DHHS delegated the authority to issue CoCs to NIH and the other DHHS agencies that fund research. In 2016, the 21st Century Cures Act enacted significant amendments to the statutory authority for CoC protections, under subsection 301(d) of the Public Health Service Act. Specifically, the amended authority requires the Secretary to issue to investigators or institutions engaged in biomedical, behavioral, clinical, or other research in which identifiable, sensitive information is collected (i.e., Covered Information), a Certificate to protect the privacy of individuals who are participants of such research, if the research is funded wholly or in part by the Federal Government. The authority also specifies the prohibitions on disclosure of the names of research participants or any information, documents, or biospecimens that contain identifiable, sensitive information collected or used in research by an investigator or institution with a Certificate. If the research is not federally funded, the Secretary may issue a Certificate to an investigator or institution engaged in such research, upon application.
The information collected via the electronic CoC request system is used by NIH to determine eligibility for a discretionary (i.e., non-NIH funded) CoC and to help create the actual Certificate that will be issued to the requesting organization and an accompanying cover letter; see Attachment 1 for a PDF version of the request form. Additionally, the system assists NIH staff with the administrative management of requests, for example, by tracking requests and key dates (receipt of request, issuance of CoC) and allowing for routine internal program monitoring.
In 2015, to improve the efficiency of the CoC process, NIH launched an online CoC request system. On December 13, 2016, the 21st Century Cures Act was enacted, which included new provisions regarding CoC. In compliance with the 21st Century Cures Act, NIH issued a policy in October 2017 that established the automatic issuance of CoCs for NIH-funded research for project(s) involving the collection of sensitive, identifiable information or biospecimens. NIH continues to accept and process requests for CoCs for non-NIH funded research through the online system.
The current CoC request form includes a total of 25 questions through 6 sections of information collected from research organizations. At NIH, the issuance of CoCs has been delegated to the Office of Extramural Research (OER) in the NIH Office of the Director. With the goal of having a consistent CoC request process across NIH, the OER developed an online CoC request system. OMB approval was obtained for the new CoC system in 2020 (OMB No. 0925-0689, expiration date 02/28/2023) and the new system was launched in March 2020. Then, NIH received another OMB approval for the CoC system in 2022 for revision and extension (OMB No. 0925-0689, expiration date 04/30/2025). The revisions in the 2022 OMB approval included adding two optional data fields that allow the CoC requesters to enter the name and email address of another person to receive system communications, which was based on unsolicited feedback from non-NIH funded investigators and institutions utilizing the CoC system. There have been four non-substantial change memo requests approved by OMB in 2023 and 2024, to make minor edits to the Institutional Assurance statements in the system. A non-substantial change to one of the Institutional Assurance statements in the system to clarify NIH’s expectation of the institution requesting the Certificate. This modification does not change the scope of the inquiry, the method of collection, the population of participants outlined in the original application, or the estimated burden of the collection. The current language in the statement is as follows: “The research will be conducted in accordance with 45 CFR Part 46 and relevant Subparts (even if not specifically required by regulation), as well as all applicable federal, state, and local laws and regulations throughout the life of the study.” NIH would like to add clarification at the end of the statement. The proposed new statement is as follows: “The research will be conducted in accordance with 45 CFR 46 and relevant Subparts (even if not specifically required by regulation), as well as all applicable federal, state, and local laws and regulations throughout the life of the study. The Cooperative Research mandate at 45 CFR 46.114 is an exception. Single IRB will be used at institutional discretion.” NIH received 865 requests for CoCs from January 2024 through December 2024, and NIH expects to receive approximately the same number of requests in subsequent years.
In order to comply with the requirement in subsection 301(d) of the Public Health Service Act to minimize the burden to researchers, streamline the process, and reduce the time it takes to apply for a CoC, effective October 1, 2017, NIH-funded research eligible for a CoC is deemed issued a Certificate through its CoC policy; no application is necessary. For non-federally funded research, and research funded by other federal agencies (i.e., non DHHS Departments and agencies and DHHS agencies who do not issue CoCs), NIH continues to review requests and issue CoCs for eligible projects.
A.3 Use of Information Technology and Burden Reduction
The CoC request form is electronic; researchers access it from the CoC public internet site (https://grants.nih.gov/policy/humansubjects/coc.htm). The request only includes information that is required by law and the CoC regulations to determine eligibility for and issue a CoC. This system reduces the burden on the requesters by allowing them to submit their request and receive their certificate electronically. System validations provide an immediate notification to requesters if their request may be ineligible, allowing them to stop the CoC request process or contact NIH to clarify any eligibility issues prior to submission. Due to a change in NIH policy effective October 1, 2017, NIH-funded researchers are deemed issued a CoC if their research is within the scope of the policy; the NIH-funded researcher does not need to submit a request. This policy change reduced the number of requesters that NIH receives from the NIH-funded researchers.
The CoC request information submitted to NIH is maintained on protected NIH servers and will be accessible only to NIH staff involved in CoC administration. At NIH, only the NIH CoC Coordinators and IT staff have access to the system.
The required Privacy Impact Assessment (PIA) and NIH Privacy Memo are attached to this request (see Attachment 3 and 4).
The electronic CoC request system is the only NIH CoC request system, and no similar information is available that can be used or modified for use to issue CoCs for non-NIH funded research. Within DHHS, NIH is the main agency that issues CoCs for research projects that are not federally funded; other agencies either only issue CoCs for research they fund (Centers for Disease Control and Prevention (CDC), Substance Abuse and Mental Health Services Administration (SAMHSA), Health Resources and Services Administration (HRSA), Indian Health Service (IHS), and Biomedical Advanced Research and Development Authority (BARDA)) or for research that clearly falls within their legislated jurisdiction (Food and Drug Administration (FDA)). The CoC-issuing DHHS agencies other than NIH (CDC, FDA, HRSA, IHS, BARDA, and SAMSHA) each have their own processes for issuing CoCs. In addition, the DHHS Agency for Healthcare Research & Quality (AHRQ) and the Department of Justice have their own privacy regulations. On the NIH CoC website, NIH instructs users funded by those agencies/Department to contact the agency/Department points of contact and will not issue a CoC for that research.
Only small businesses that are conducting research would potentially apply for a CoC. We estimate that 10% of requests to NIH for a CoC are from small business entities. The procedure for and the burden associated with a CoC request for small businesses that are conducting research is the same as for other research organization that wants to request a CoC from NIH. The impact on small business or other small entities is anticipated to be negligible.
The information collected with the on-line request is a onetime collection to request a CoC for a specific research project. Requests to NIH for a CoC are submitted as necessary to obtain a CoC. There are no request deadlines.
There are no special circumstances related to the electronic CoC request.
The 60-day comment request for Electronic Application for NIH Certificates of Confidentiality (CoC E-application System) was posted on Federal Register website on April 16, 2025; Vol. 90, No. 72, Page 15989. No public comments were received.
NIH maintains contact with other DHHS agencies (see Attachment 2) which issue CoCs. CDC, SAMHSA, HRSA, IHS, BARDA, and FDA issue their own CoCs. The DHHS Agency AHRQ and the Department of Justice each have their own privacy regulations. NIH will not issue a CoC for projects funded by the Department/agencies listed above. NIH issues CoCs for other DHHS agencies and non-DHHS Departments through the online CoC system.
A.9 Explanation of Any Payment of Gift to Respondents
No payment or gifts are provided to respondents.
A.10 Assurance of Confidentiality Provided to Respondents
NIH protects the privacy of CoC requesters to the extent allowable by law. The information collected in the NIH CoC electronic application is maintained on a secure NIH sever and requires the use of NIH login for access. The information is only used internally and is controlled via role-based access controls (i.e., only OER staff involved in CoC administration and NIH IT staff have permission to access the CoC request information). The same NIH security standards are applied to the CoC request information as to other grant information that NIH maintains.
A.11 Justification for Sensitive Questions
The CoC request collects only information as required by the authorizing legislation to help NIH determine whether the applicant is eligible for a CoC and for administrative purposes. The information collected related to the Principal Investigator and requesting institution is information that would be available publicly; there is no sensitive information collected.
A.12.1 Estimates of Hour Burden Including Annualized Hourly Costs
NIH received 865 requests for CoCs between January 2024 and December 2024. We estimate the number of CoC requests will remain constant over the next 3 years. Based on our prior experience collecting CoC request data and similar information in NIH systems, we estimate that each request takes 90 minutes to complete, including time needed to gather the necessary documents. Based on requests submitted between January 1, 2024 and December 31, 2024, 86% of requests were submitted from non-federal institutions and organizations, 11% were submitted from federal research organizations such as the Department of Veterans Affairs (VA) and Department of Defense (DoD), and 3% were submitted from other HHS agencies. Note: The CoC system no longer collects information on the type of non-federal institution and organization funding (such as small business, state and local government, and internal institutional funding).
Table 12-1 Estimated Annualized Burden Hours
Form Name |
Category of Respondent |
No. of Respondents |
No. of Responses per Respondent |
Time per Response (in hours) |
Total Burden Hours |
A |
Individuals
|
865 |
1 |
90/60 |
1,298 |
Totals |
|
|
865 |
|
A.12-2 Annual Cost to respondent
Regardless of the type of research organization, CoC requests are generally completed by researchers or research staff. The hourly wage rate used for all burden hours ($49.03) was estimated as an average of the mean hourly wage for Life Scientists staff figures published in May 2024 by the U.S. Bureau of Labor Statistic.
Table 12-2 Annualized Cost to Respondents
Category of Respondent |
Total Burden Hours |
Wage Rate* |
Total Burden Cost |
Individuals |
1,298 |
Life Scientists at a Mean rate of $ 49.03 |
$63,641 |
Totals |
1,298 |
|
*Source of the mean Hourly Wage Rate is provided by the Bureau of Labor Statistics, Occupation title “Life Scientists” 19-1000,
https://data.bls.gov/oes/#/industry/000000
A.13 Estimate of Other Total Annual Cost Burden to Respondents or Record Keepers
There are no special requirements for using the online CoC request system beyond internet access. Thus, there are no other costs to users.
The total costs to the Federal Government for the next three years of the CoC electronic request system is $380,880. This includes the costs of correction of minor system problems ($5,000 per year), annual maintenance costs ($6,000 per year), annual NIH IT security assessment costs ($5,000 per year), 10% annually of a GS 15-6 FTE for oversight ($19,520 per year), 65% annually of a GS 13-6 FTE ($ 91,440) for coordination and process. The average annual cost for the 3-year period is $126,960.
Cost Descriptions |
Grade/Step |
Salary** |
% of Effort |
Fringe (if applicable) |
Total Cost to Gov’t |
Federal Oversight |
|
|
|
|
|
NIH Extramural CoC Administrator |
GS 15-6 |
$ 195,200 |
10% |
|
$ 19,520 |
Program Analyst |
GS 13-6 |
$ 140,677 |
65% |
|
$ 91,440 |
Other Cost (NIH IT security scan and maintenance) |
|
|
|
|
$ 16,000 |
Total |
|
|
|
|
$ 126,960 |
**the Salary in table above is cited from https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/pdf/2025/DCB.pdf
A.15 Explanation for Program Changes or Adjustments
There is no revision included in this request. However, NIH received 865 requests for CoCs from January 2024 through December 2024, and NIH expects to receive approximately the same number of requests in subsequent years which is an increase of 70 respondents from our previous estimated figures.
NIH will only use the CoC request information to tabulate internal statistics for administrative purposes only. No publications of this information are planned.
A.16 - 1 Project Time Schedule |
|
Activity |
Time Schedule |
Continue to make researchers aware of on-line request system for all CoC requests to NIH |
Ongoing |
Continue to enable system access for researchers who wish to request a CoC |
Ongoing |
Monitor system and correct any unrecognized system errors |
Ongoing |
Tabulate annual system administrative metrics for internal NIH use |
Ongoing |
A.17 Reason(s) Display of OMB Expiration Date is Inappropriate
The OMB control number is displayed with an expiration date.
A.18 Exceptions to Certification for Paperwork Reduction Act Submissions
None
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| Subject | Supporting Statement A |
| Author | Lopez, Maria (NIH/NICHD) [E] |
| File Modified | 0000-00-00 |
| File Created | 2025-07-16 |