Supporting Statement A for
Electronic Requests for NIH Certificates of Confidentiality (CoC) (OD)
OMB# 0925-0689 Expiration date 02/28/2023
Date: February 17, 2022
Check off which applies:
New
√Revision
Reinstatement with Change
Reinstatement without Change
Extension
Emergency
Existing
Federal Government Employee Information:
Name: Pamela Kearney, MD
Address: 6705 Rockledge Dr Rm 812-C Bethesda MD 20892
Telephone: 301-402-2512
Email: NIH-CoC-Coordinator@mail.nih.gov
Table of contents
A. ABSTRACT
A.1 Circumstances Making the Collection of Information Necessary
A.2. Purpose and Use of the Information COLLECTION
A.3 Use of Information Technology and Burden Reduction
A.4 Efforts to Identify Duplication and Use of Similar Information
A.5 Impact on Small Businesses or Other Small Entities
A.6 Consequences of Collecting the Information Less Frequently
A.7 Special Circumstances Relating to the Guidelines of 5 CFR 1320.5
A.8 Comments in Response to the Federal Register Notice and Efforts to Consult Outside Agency
A.9 Explanation of Any Payment of Gift to Respondents
A.10 Assurance of Confidentiality Provided to Respondents
A.11 Justification for Sensitive Questions
A.12 Estimates of Hour Burden Including Annualized Hourly Costs
A.13 Estimate of Other Total Annual Cost Burden to Respondents or Record keepers
A.14 Annualized Cost to the Federal Government
A.15 Explanation for Program Changes or Adjustments
A.16 Plans for Tabulation and Publication and Project Time Schedule
A.17 Reason(s) Display of OMB Expiration Date is Inappropriate
A.18 Exceptions to Certification for Paperwork Reduction Act Submissions
ATTACHMENTS
Attachment 1 - NIH Certificate of Confidentiality (CoC) Request Form Screenshots
Attachment 2 - List of DHHS CoC Coordinators
Attachment 3 - Privacy Impact Assessment (PIA) NOV 2021
Attachment 4 - NIH Privacy Act memo: Applicability of the Privacy Act_CoC_FEB 2022
A. Justification
Abstract: NIH is requesting a revision for three years. In 2015, NIH launched an online application system for researchers to request a Certificate of Confidentiality (CoC) from NIH. In 2020, NIH launched a new CoC online request system with fewer data fields than the 2015 system, to decrease burden on the requester and NIH staff. Information is collected to allow confirmation of eligibility for a CoC and to issue a Certificate. Eligible requesters receive an electronic Certificate once approved. The revision to the CoC system data fields is to add an optional data field that allows the researcher to identify another person to receive CoC system communication and the approved CoC. Currently, there are two persons for which we request an email address (the Principal Investigator and the Institutional Official); these persons receive CoC system communications and the approved CoC.
Certificates of Confidentiality (CoCs) protect research participants by prohibiting disclosure of identifying information about participants to persons not connected to the research, with limited exceptions. NIH, through its 24 funding Institutes and Centers (ICs), has issued Certificates of Confidentiality since 1997 to researchers who request this protection. Since 2016, NIH-funded researchers are deemed issued a Certificate upon award of NIH funding and do not need to request a Certificate through the system. Non-NIH funded researchers may continue to request a CoC through the online system.
A.1 Circumstances Making the Collection of Information Necessary
The successful recruitment of human research participants into NIH funded studies is critical to the success of the agency’s mission to enhance health, lengthen life, and reduce the burdens of illness and disability. However, human research participants are often concerned about the confidentiality of the information, including biospecimens and data that they provide to researchers. This situation can make it difficult to recruit participants, particularly for research projects on sensitive topics. Recognizing this problem, in 1970, Congress enacted legislation to permit the Department of Health and Human Services (DHHS) to issue Certificates of Confidentiality (CoCs) to authorize covered researchers to protect the privacy of research participants by withholding their names and other identifying characteristics from those not connected with the research. The legislation was initially limited to research on the use and effect of drugs. Since then, the scope of the CoC legislation has been expanded several times, including in 1988 when it was expanded to include “biomedical, behavioral, clinical, and other research” (see Section 301(d) of the Public Health Service Act, 42 U.S.C. §241(d)). The regulations that describe DHHS implementation of this authority are codified at 42 CFR Part 2a. In 1997, DHHS delegated the authority to issue CoCs to NIH and the other DHHS agencies that fund research. In 2016, the 21st Century Cures Act enacted significant amendments to the statutory authority for CoC protections, under subsection 301(d) of the Public Health Service Act. Specifically, the amended authority requires the Secretary to issue to investigators or institutions engaged in biomedical, behavioral, clinical, or other research in which identifiable, sensitive information is collected (“Covered Information”), a Certificate to protect the privacy of individuals who are participants of such research, if the research is funded wholly or in part by the Federal Government. The authority also specifies the prohibitions on disclosure of the names of research participants or any information, documents, or biospecimens that contain identifiable, sensitive information collected or used in research by an investigator or institution with a Certificate. If the research is not federally funded, the Secretary may issue a Certificate to an investigator or institution engaged in such research, upon application.
The information collected via the electronic CoC request system is used by NIH to determine eligibility for a discretionary (i.e., non-NIH) CoC and to help create the actual Certificate that will be issued to the requesting organization and an accompanying cover letter; see Attachment 1 for a PDF version of the request form. Additionally, the system assists NIH staff with the administrative management of requests, for example, by tracking requests and key dates (receipt of request, issuance of CoC) and allowing for routine internal program monitoring.
In 2015, to improve the efficency of the CoC process, NIH launched an online CoC request system. On December 13, 2016, the 21st Century Cures Act was enacted, which included new provisions regarding Certificates of Confidentiality. In compliance with the 21st Century Cures Act, NIH issued a policy in October 2017 that established the automatic issuance of Certificates of Confidentiality (CoCs) for NIH-funded research for project(s) involving the collection of sensitive, identifiable information or biospecimens. NIH continues to accept and process requests for Certificates of Confidentiality for non-NIH funded research through the online system.
The current CoC request form includes 6 sections of information collected from research organizations. Within NIH, CoCs are issued by the Office of Extramural Research (OER). With the goal of having a consistent CoC request process across NIH, the OER developed an online CoC request system. OMB approval was obtained for the new CoC system in 2020 (OMB No. 0925-0689, expiration date 02/28/2023) and the new system was launched in March 2020. At NIH, the issuance of CoCs has been delegated to the NIH OER in the NIH Office of the Director. NIH received 795 requests for CoCs from January 2020 through December 2020; NIH expects to receive approximately the same number of requests in subsequent years.
In order to comply with the requirement in subsection 301(d) of the Public Health Service Act to minimize the burden to researchers, streamline the process, and reduce the time it takes to apply for a CoC, effective October 1, 2017, NIH-funded research eligible for a CoC is deemed issued a Certificate through its CoC policy; no application is necessary. For non-federally funded research, and research funded by other federal agencies (i.e., non DHHS agencies and DHHS agencies who do not issue CoCs), NIH continues to review requests and issue CoCs for eligible projects.
Since the launch of the updated system in March 2020, NIH has received unsolicited feedback from non-NIH funded investigators and institutions utilizing the CoC system, who have requested a mechanism to allow the CoC requester to identify another person to also receive system communications and a copy of the approved CoC. To address this request, NIH plans to add two optional data fields that allow the CoC requester to enter the name and email address of another person that will also receive this information.
A.3 Use of Information Technology and Burden Reduction
The CoC request form is electronic; researchers access it from the CoC public internet site (https://grants.nih.gov/policy/humansubjects/coc.htm). The request only includes information that is required by law and the CoC regulations to determine eligibility for and issue a CoC. This system reduces the burden on the requesters by allowing them to submit their request and receive their certificate electronically. System validations provide an immediate notification to requesters if their request may be ineligible, allowing them to stop the CoC request process or contact NIH to clarify any eligibility issues prior to submission. Due to a change in NIH policy effective October 1, 2017, NIH-funded researchers are deemed issued a CoC if their research is within the scope of the policy; the NIH-funded researcher does not submit a request. This policy change reduced the number of requesters from approximately 1300 to approximately 800 annually.
The CoC request information submitted to NIH is maintained on protected NIH servers and will be accessible only to NIH staff involved in CoC administration. At NIH, only the NIH CoC Coordinators and IT staff have access to the system.
The required Privacy Impact Assessment (PIA) and NIH Privacy Memo are attached to this request (see Attachment 3 and 4).
The electronic CoC request system is the only NIH CoC request system and no similar information is available that can be used or modified for use to issue CoCs for non-NIH funded research. Within DHHS, NIH is the main agency that issues CoCs for research projects that are not federally funded; other agencies either only issue CoCs for research they fund (Centers for Disease Control and Prevention (CDC), Substance Abuse and Mental Health Services Administration (SAMHSA), Health Resources and Services Administration (HRSA), and Indian Health Service (IHS)) or for research that clearly falls within their legislated jurisdiction (Food and Drug Administration (FDA)). The CoC-issuing DHHS agencies other than NIH (CDC, FDA, HRSA, IHS and SAMSHA) each have their own processes for issuing CoCs. In addition, the DHHS Agency for Healthcare Research & Quality (AHRQ) and the Department of Justice have their own privacy regulations. On the NIH CoC website, NIH instructs users funded by those agencies/Department to contact the agency/Department points of contact and will not issue a CoC for that research.
Only small businesses that are conducting research would potentially apply for a CoC. We estimate that 10% of requests to NIH for a CoC are from small business entities. The procedure for and the burden associated with a CoC request for small businesses that are conducting research is the same as for other research organization that wants to request a CoC from NIH. The impact on small business or other small entities is anticipated to be negligible.
The information collected with the on-line request is a onetime collection to request a CoC for a specific research project. Requests to NIH for a CoC are submitted as necessary to obtain a CoC. There are no request deadlines.
There are no special circumstances related to the electronic CoC request.
The proposed information collection for the updated data fields in the current CoC system was previously published in the Federal Register on December 17, 2021, page 71650 (FR 86 pages 71650-71651) and allowed 60 days for public comment. No public comments were received.
NIH maintains contact with other DHHS agencies (see Attachment 2) which issue CoCs. CDC, SAMHSA, HRSA, IHS, and FDA issue their own Certificates of Confidentiality. The DHHS Agency AHRQ and the Department of Justice each have their own privacy regulations. NIH will not issue a CoC for projects funded by the Department/agencies listed above. NIH issues CoCs for other DHHS agencies and non-DHHS Departments through the online CoC system.
A.9 Explanation of Any Payment of Gift to Respondents
No payment or gifts are provided to respondents.
A.10 Assurance of Confidentiality Provided to Respondents
NIH protects the privacy of CoC requesters to the extent allowable by law. The information collected in the NIH CoC electronic application is maintained on a secure NIH sever and requires the use of NIH login for access. The information is only used internally and is controlled via role-based access controls (i.e., only OER staff involved in CoC administration and NIH IT staff have permission to access the CoC request information). The same NIH security standards are applied to the CoC request information as to other grant information that NIH maintains. The data collection is covered by NIH Privacy Act Systems of Record 09-25-0225, “NIH Electronic Research Administration (eRA) Records, HHS/NIH/OD/OER.”
A.11 Justification for Sensitive Questions
The CoC request collects only information as required by the authorizing legislation to help NIH determine whether the applicant is eligible for a CoC and for administrative purposes. The information collected related to the Principal Investigator and requesting institution is information that would be available publicly; there is no sensitive information collected.
A.12.1 Estimates of Hour Burden Including Annualized Hourly Costs
NIH received 795 requests for CoCs between January 2020 and December 2020. We estimate the number of CoC requests will remain constant over the next 3 years. Based on our prior experience collecting CoC request data and similar information in NIH systems, we estimate that each request takes 90 minutes to complete, including time needed to gather the necessary documents. Based on requests submitted between January 1, 2020 and December 31, 2020, 86% of requests were submitted from non-federal institutions and organizations and 14% were submitted from federal research organizations such as the Department of Veterans Affairs (VA) and Department of Defense (DoD). The additional optional data fields that allow the CoC requester to enter the name and email address of another person that will also receive CoC system communication and the approved Certificate are expected to have minimal impact on the burden hours associated with submitting CoC requests. Note: the CoC system no longer collects information on the type of non-federal institution and organization funding (such as small business, state and local government, and internal institutional funding).
Table 12-1 Estimated Annualized Burden Hours
Form Name |
Type of Respondents |
Number of Respondents |
Number of Responses per Respondent |
Average Burden Per Response (in hours) |
Total Annual Burden Hours |
A |
Private sector |
795 |
1 |
90/60 |
1193 |
Total |
|
795 |
795 |
|
1193 |
A.12-2 Annual Cost to respondent
Regardless of the type of research organization, CoC requests are generally completed by researchers or research staff. The hourly wage rate used for all burden hours ($51.94) was estimated as an average of the mean hourly wage for Life Scientists staff figures published in May 2020 by the U.S. Bureau of Labor Statistics
Table 12-2 Annualized Cost to Respondents
Type of Respondents |
Total Annual Burden Hours |
Hourly Respondent Wage Rate* |
Respondent Cost |
Life Scientists |
1,193 |
$51.94 |
$61,964
|
TOTAL |
|
|
$61,964 |
*source: May 2020 Bureau of Labor Statistics https://www.bls.gov/oes/current/naics4_541700.htm
A.13 Estimate of Other Total Annual Cost Burden to Respondents or Record Keepers
There are no special requirements for using the online CoC request system beyond internet access. Thus, there are no other costs to users.
The total costs to the Federal Government for the next three years of the CoC electronic request system is $248,241. This includes the costs of correction of minor system problems ($5,000 per year), annual maintenance costs ($6,000 per year), annual NIH IT security assessment costs ($5,000 per year), 5% annually of a GS 14-9 FTE for oversight ($7,995 per year), 50% annually of a GS 13-4 FTE ($58,752) for coordination and process. The average annual cost for the 3-year period is $82,747.
Cost Descriptions |
Grade/Step |
Salary |
% of Effort |
Fringe (if applicable) |
Total Cost to Gov’t |
Federal Oversight |
|
|
|
|
|
NIH Extramural CoC Administrator |
GS 14-9 |
$159,894 |
5% |
|
$7,995 |
Program Analyst |
GS 13-4 |
$117,505 |
50% |
|
$58,752 |
Travel |
|
|
|
|
|
Other Cost (NIH IT security scan and maintenance) |
|
|
|
|
$16,000 |
|
|
|
|
|
|
TOTAL |
|
|
|
|
$82,747 |
**the Salary in table above is cited from https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/22Tables/html/DCB.aspx
A.15 Explanation for Program Changes or Adjustments
The 21st Century Cures Act, enacted December 13, 2016 requires the DHHS Secretary to take steps to increase the efficiency of the process of obtaining a Certificate of Confidentiality including: 1) minimizing the burden to researchers; 2) streamlining the process; and 3) reducing the time it takes to comply with the requirements associated with applying for a Certificate. NIH implemented these requirements with a streamlined form and enhanced electronic system in 2020. The proposed revision of adding an optional data field that allows the researcher to identify another person to receive CoC system communications and the approved CoC is addressing a request from multiple researchers and will reduce the administrative burden to researchers associated with maintaining their CoC. NIH received 795 requests for CoCs from January 2020 through December 2020, which is a difference of 266 more requests from what was previously approved by OMB; NIH expects to receive approximately the same number of requests in subsequent years
A.16 - 1 Project Time Schedule
|
|
Activity |
Time Schedule |
Continue to make researchers aware of on-line request system for all CoC requests to NIH |
ongoing |
Continue to enable system access for researchers who wish to request a CoC |
ongoing |
Monitor system and correct any unrecognized system errors |
ongoing |
Tabulate annual system administrative metrics for internal NIH use |
annually |
NIH will only use the CoC request information to tabulate internal statistics for administrative purposes only. No publications of this information are planned.
A.17 Reason(s) Display of OMB Expiration Date is Inappropriate
The OMB control number is displayed with an expiration date.
A.18 Exceptions to Certification for Paperwork Reduction Act Submissions
None
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| Subject | Supporting Statement A |
| Author | Lopez, Maria (NIH/NICHD) [E] |
| File Modified | 0000-00-00 |
| File Created | 2023-07-29 |