This draft guidance1 describes FDA implementation of the revised provisions applicable to the request for, and issuance of, a Certificate of Confidentiality (CoC). The 21st Century Cures Act (Cures Act) (Public Law 114-255) amended the Public Health Service Act (PHS Act), section 301(d) (42 U.S.C. 241(d)) relating to the issuance of CoCs. A CoC is intended to help protect the privacy of human subject research participants from whom identifiable, sensitive information is being collected or used in furtherance of the research. Historically, a CoC generally protected a researcher from being compelled to disclose identifiable and sensitive information about the research participant, created or compiled for purposes of the human subject research. As amended, the statute broadened the protections by affirmatively prohibiting holders of CoCs from disclosing such information unless a specific exception applies.
The Cures Act simplified certain aspects of the issuance of CoCs by requiring that CoCs be
issued for federally-funded human subject research that collects or uses identifiable, sensitive information (referred to in this guidance as mandatory CoCs). For non-federally funded research, issuance of CoCs is not required but may be issued at the discretion of FDA (referred to in this guidance as discretionary CoCs). FDA intends to continue receiving and considering such requests and will issue discretionary CoCs as appropriate. This guidance is intended to provide information on how to request a discretionary CoC, the statutory requirements for requesting such a CoC, and the statutory responsibilities associated with possessing a CoC. Although the mandatory CoC and the discretionary CoC are issued under different processes, the protections afforded by the issuance of either CoC are identical and the statutory responsibilities are the same.
In general, FDA’s guidance documents do not establish legally enforceable responsibilities.
Instead, guidances describe the Agency’s current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word should in Agency guidances means that something is suggested or recommended, but not required…