Federal Stop Work Orders & Certificates of Confidentiality (CoC)

Certificates of Confidentiality (CoCs) may be either automatic — granted by virtue of funding from agencies such as the National Institutes of Health (NIH), Centers for Disease Control and Prevention (CDC), U.S. Food and Drug Administration (FDA) — or discretionary — voluntarily requested and approved by the NIH or certain other federal agencies.

An automatic CoC expires when funding from the granting federal agency ends. While protections provided by a CoC continue in perpetuity for information already collected or used, they do not extend to any new information collected from or about already enrolled participants or from new participants enrolled after funding ends.

To maintain CoC protections for new data collection or for newly enrolled participants after the expiration of an automatic CoC, investigators must apply for and receive approval for a discretionary CoC.

• However, the NIH application system for discretionary CoCs is currently unavailable, with an expected update promised by July 2025.
• The FDA continues to accept applications for discretionary CoCs for studies that fall within the scope of its policy: FDA CoC Guidance.

Investigators with automatic CoCs who lose funding and intend to continue enrollment with new participants may submit an amendment (i.e., Modification Request; MR) to the IRB to update their consent materials (when consent is being obtained) and/or take steps to strengthen their data security plan.

Investigators with automatic CoCs who plan to continue collecting new data from existing participants may submit an amendment (i.e., Modification Request; MR) to the IRB with a plan to inform those participants about the loss of the CoC and explain the implications (provided consent was obtained and participant contact information was collected). 

If you have questions about the specific requirements for your study, email your IRB protocol number and questions to IRBSubmission@uky.edu. If your study is under the oversight of an external IRB, please consult with the external IRB’s office or Point of Contact.

Thank you for your attention to these changes.

_{Source: Modified from HRP Consulting Group, 5/14/25}