Supporting Statement A for
Electronic Requests for NIH Certificates of Confidentiality (CoC) (OD)
OMB#: 0925-0689 Expiration Date: 12/31/2019
Date: November 15, 2019
Check off which applies:
New
√ Revision
Reinstatement with Change
Reinstatement without Change
Extension
Emergency
Existing w/o OMB approval
Federal Government Employee Information:
Name: Pamela Kearney, MD
Address: 6705 Rockledge Dr Rm 812-C Bethesda MD 20892
Telephone: 301-402-2512
Email: NIH-CoC-Coordinator@mail.nih.gov
Table of contents
A. ABSTRACT
A.1 Circumstances Making the Collection of Information Necessary
A.2. Purpose and Use of the Information COLLECTION
A.3 Use of Information Technology and Burden Reduction
A.4 Efforts to Identify Duplication and Use of Similar Information
A.5 Impact on Small Businesses or Other Small Entities
A.6 Consequences of Collecting the Information Less Frequently
A.7 Special Circumstances Relating to the Guidelines of 5 CFR 1320.5
A.8 Comments in Response to the Federal Register Notice and Efforts to Consult Outside Agency
A.9 Explanation of Any Payment of Gift to Respondents
A.10 Assurance of Confidentiality Provided to Respondents
A.11 Justification for Sensitive Questions
A.12 Estimates of Hour Burden Including Annualized Hourly Costs
A.13 Estimate of Other Total Annual Cost Burden to Respondents or Record keepers
A.14 Annualized Cost to the Federal Government
A.15 Explanation for Program Changes or Adjustments
A.16 Plans for Tabulation and Publication and Project Time Schedule
A.17 Reason(s) Display of OMB Expiration Date is Inappropriate
A.18 Exceptions to Certification for Paperwork Reduction Act Submissions
Attachments
Attachment 1 - NIH Certificate of Confidentiality (CoC) Request Form Screenshots
CoC v2 with burden disclosure
Attachment 2 - List of DHHS CoC Coordinators
Attachment 3 - Privacy Impact Assessment (PIA)
Attachment 4 - NIH Privacy Act memo: Applicability of the Privacy Act
A. Justification
Abstract: NIH is requesting a revision for three years. In 2015, NIH launched an on-line application system for researchers to request a Certificate of Confidentiality (CoC) from NIH. Information is collected to allow confirmation of eligibility for a CoC and to issue a Certificate. Eligible requestors will receive an electronic Certificate once approved.
Certificates of Confidentiality (CoCs) protect research participants, researchers, and institutions by prohibiting disclosure of identifying information about participants to persons not connected to the research, with limited exceptions. NIH, through its 24 funding Institutes and Centers (ICs), has issued Certificates of Confidentiality since 1997 to researchers who request this protection. NIH-funded researchers are now deemed to issue a Certificate upon award of NIH funding and no longer need to request a Certificate through the system. Non-NIH funded researchers may continue to request a CoC through the online system.
A.1 Circumstances Making the Collection of Information Necessary
The successful recruitment of human research participants into NIH funded studies is critical to the success of the agency’s mission to enhance health, lengthen life, and reduce the burdens of illness and disability. However, human research participants are often concerned about the confidentiality of the information, including biospecimens and data that they provide to researchers. This situation can make it difficult to recruit participants, particularly for research projects on sensitive topics. Recognizing this problem, in 1970, Congress enacted legislation to permit the Department of Health and Human Services (DHHS) to issue Certificates of Confidentiality (CoCs) to authorize covered researchers to protect the privacy of research participants by withholding their names and other identifying characteristics from those not connected with the research. The legislation was initially limited to research on the use and effect of drugs. Since then, the scope of the CoC legislation has been expanded several times, including in 1988 when it was expanded to include “biomedical, behavioral, clinical, and other research” (see Section 301(d) of the Public Health Service Act, 42 U.S.C. §241(d)). The regulations that describe DHHS implementation of this authority are codified at 42 CFR Part 2a. In 1997, DHHS delegated the authority to issue CoCs to NIH and the other DHHS agencies that fund research. In 2016, the 21st Century Cures Act enacted significant amendments to the statutory authority for CoC protections, under subsection 301(d) of the Public Health Service Act. Specifically, the amended authority requires the Secretary to issue to investigators or institutions engaged in biomedical, behavioral, clinical, or other research in which identifiable, sensitive information is collected (“Covered Information”), a Certificate to protect the privacy of individuals who are participants of such research, if the research is funded wholly or in part by the Federal Government. The authority also specifies the prohibitions on disclosure of the names of research participants or any information, documents, or biospecimens that contain identifiable, sensitive information collected or used in research by an investigator or institution with a Certificate. If the research is not federally funded, the Secretary may issue a Certificate to an investigator or institution engaged in such research, upon application.
The information collected via the electronic CoC request system is used by NIH to determine eligibility for a CoC and to help create the actual Certificate that will be issued to the requesting organization; see Attachment 1 for a PDF version of the request form. Additionally, the system assists NIH staff with the administrative management of requests, for example, by tracking requests and key dates (receipt of request, issuance of CoC, expiration dates) and allowing for routine internal program monitoring.
In 2015, to improve the efficency of the CoC process, NIH launched an on-line CoC request system. On December 13, 2016, the 21st Century Cures Act was enacted, which included new provisions regarding Certificates of Confidentiality. In compliance with the 21st Century Cures Act, NIH issued a policy in October 2017 that established the automatic issuance of Certificates of Confidentiality (CoCs) for NIH-funded research for project(s) involving the collection of sensitive, identifiable information or biospecimens. NIH continues to accept and process requests for Certificates of Confidentiality for non-NIH funded research through the online system. The current CoC request form includes 15 sections of information collected from research organizations. Within NIH, CoCs are issued by the Office of Extramural Research (OER). With the goal of having a consistent CoC request process across NIH, the Office of Extramural Research (OER) at NIH developed an online CoC request system. OMB approval was obtained for this system in 2014 and the system was launched in early 2015. At NIH, the issuance of CoCs has been delegated to the NIH OER in the NIH Office of the Director. NIH received 529 requests for CoCs from April 2017 through March 2018 and expects to receive approximately the same number of requests in subsequent years. In order to comply with the requirement in subsection 301(d) of the Public Health Service Act to minimize the burden to researchers, streamline the process, and reduce the time it takes to apply for a CoC, effective October 1, 2017, NIH-funded research eligible for a CoC is deemed issued a Certificate through its CoC policy; no application is necessary. For non-federally funded research, and research funded by other federal agencies (non DHHS agencies and DHHS agencies who do not issue CoCs), NIH continues to review requests and issue CoCs for eligible projects.
In order to further implement 21st Century Cures Act Requirements to streamline the CoC process, NIH plans to deploy a new online system in 2020 (see attachment 1a). As this new system will not be available by January 1, 2020, NIH has revised this clearance to address the new system in development. Screenshots of the new system will be provided and submitted to OMB have been included (see attachment 1a).
A.3 Use of Information Technology and Burden Reduction
The CoC request form is electronic; researchers access it from the CoC public internet site (http://grants.nih.gov/grants/policy/coc/ ). The request only includes information that is required by law and the CoC regulations to determine eligibility for and issue a CoC. This system reduces the burden on the requestors by allowing them to submit their request and receive their certificate electronically. System validations will allow for immediate notification to requestors if their request may be ineligible, allowing them to stop the CoC request process or contact NIH to clarify any eligibility issues prior to submission. Due to a change in NIH policy effective October 1, 2017, NIH-funded researchers are now deemed issued a CoC if within the scope of the policy and no longer need to submit a request. This policy change had reduced the number of requestors from approximately 1300 to approximately 529 annually.
The CoC request information submitted to NIH is maintained on protected NIH servers and will be accessible only to NIH staff involved in CoC administration. At NIH, only the NIH CoC Coordinators and IT staff have access to the system.
The required Privacy Impact Assessment (PIA) and NIH Privacy Memo are attached to this request (see Attachment 3 and 4).
A.4 Efforts to Identify Duplication and Use of Similar Information
The proposed electronic CoC request system is the only NIH CoC request system and no similar information is available that can be used or modified for use to issue CoCs for non-NIH funded research. Within DHHS, NIH is the main agency that issues CoCs for research projects that are not federally funded; other agencies either only issue CoCs for research they fund (CDC, AHRQ, HRSA, IHS, SAMSHA) or for research that clearly falls within their legislated jurisdiction (FDA). The CoC-issuing DHHS agencies other than NIH (AHRQ, CDC, FDA, HRSA, IHS and SAMSHA) each have their own processes for issuing CoCs. On the NIH CoC website, NIH instructs users funded by those agencies to contact the agency points of contact and will not issue a CoC for that research.
Only small businesses that are conducting research would potentially apply for a CoC. We estimate that 10% of requests to NIH for a CoC will be from small business entities. The procedure for and the burden associated with a CoC request for small businesses that are conducting research would be the same as for other research organization that wants to request a CoC from NIH. The impact on small business or other small entities is anticipated to be negligible.
The information collected with the on-line request is a onetime collection to request a CoC for a specific research project. Requests to NIH for a CoC are submitted as necessary to obtain a CoC. There are no request deadlines.
There are no special circumstances related to the electronic CoC request.
This proposed information collection was previously published in the Federal Register on August 14, 2019, page 40426-40427 (84 FR 40426) and allowed 60 days for public comment. No public comments were received.
A.8.2 Efforts to Consult Outside Agency
NIH maintains contact with other DHHS agencies (see Attachment 2) which issue CoCs. Centers for Disease Control and Prevention (CDC), Substance Abuse and Mental Health Services Administration (SAMHSA), Health Resources and Services Administration (HRSA), Indian Health Service (IHS), Agency for Healthcare Research & Quality (AHRQ), and Food and Drug Administration (FDA) issue their own Certificates of Confidentiality. Department of Justice also issues its own Certificates of Confidentiality. NIH issues CoCs for other DHHS and non-DHHS agencies.
No payment or gifts are provided to respondents.
NIH protects the privacy of CoC requestors to the extent allowable by law. The information collected in the NIH CoC electronic application is maintained on a secure NIH sever and requires the use of NIH login for access. The information is only used internally and is controlled via role-based access controls (i.e., only OER staff involved in CoC administration and NIH IT staff have permission to access the CoC request information). The same NIH security standards are applied to the CoC request information as to other grant information that NIH maintains.
The CoC request collects only information as required by the authorizing legislation to help NIH determine whether the applicant is eligible for a CoC and for administrative purposes. The information collected related to the Principal Investigator and requesting institution is information that would be available publicly; there is no sensitive information collected.
NIH received 529 requests for CoCs between April 2017 and March 2018. We estimate the number of COC requests will remain constant over the next 3 years. Based on our prior experience collecting COC request data and similar information in NIH systems, we estimate that each request takes 90 minutes to complete, including time needed to gather the necessary documents. Based on requests submitted between April 1, 2017 and March 31, 2018 we estimate that 70% of requests will be from private research institutions and organizations, 5% will be from state/local research institutions/organizations, 10% will be from small business research organizations, and 15% will be from federal research organizations such as the VA.
Table 12-1 Estimated Annualized Burden Hours
Type of Respondents |
Number of Respondents |
Number of Responses per Respondent |
Average Burden per Response (in hours) |
Total Annual Burden Hours
|
CoC Applicants- Private |
372 |
1 |
90/60 |
558 |
CoC Applicants- State/local |
26 |
1 |
90/60 |
39 |
CoC Applicants- Small business |
53 |
1 |
90/60 |
80 |
CoC Applicants- Federal |
78 |
1 |
90/60 |
117 |
Total |
|
529 |
|
794 |
A.12-2 Annual Cost to respondent
Regardless of the type of research organization, CoC requests are generally completed by researchers or research staff. The hourly wage rate used for all burden hours ($38) was estimated as an average of the mean hourly wage figures published in May 2018 by the Bureau of Labor Statistics (http://www.bls.gov/oes/current/oes_nat.htm#19-0000 )
Table 12 - 2 Annual Cost To Respondents
Type of Respondents |
Total Annual Burden Hours |
Hourly Respondent Wage Rate* |
Respondent Cost |
Researcher |
794 |
$38 |
$30,153 |
Total |
|
|
$30, 153 |
*source: May 2018 Bureau of Labor Statistics (http://www.bls.gov/oes/current/oes_nat.htm#19-0000)
There are no special requirements for using the online CoC request system beyond internet access. Thus, there are no other costs to users.
The total costs to the Federal Government for the next three years of the CoC electronic request system is $352,848. This includes the costs of correction of minor system problems ($5,000 per year), annual maintenance costs ($6,000 per year), annual NIH IT security assessment costs ($5,000 per year), 5% annually of a GS 14-3FTE for oversight ($6,446 per year), 10% annually of a GS 12-7 FTE ($9,786) and 40% annually of Human Subjects Research Program Manager contractor ($85,383) for coordination. The average annual cost for the 3-year period is $117,616.
Cost Descriptions |
Grade/Step |
Salary |
% of Effort |
Fringe (if applicable) |
Total Cost to Gov’t |
Federal Oversight |
|
|
|
|
|
NIH Extramural CoC Administrator |
GS 14-3 |
$128,911 |
5% |
|
6,446
|
Program Analyst |
GS 12-7 |
$97,858 |
10% |
|
9,786 |
Contractor Cost |
|
|
|
|
|
Human Subjects Research Program Manager |
N/A |
$213,460 |
40% |
|
85,384 |
Travel |
|
|
|
|
|
Other Cost (NIH IT security scan and maintenance) |
|
|
|
|
16,000 |
|
|
|
|
|
|
TOTAL |
|
|
|
|
$117,616 |
The 21st Century Cures Act, enacted December 13, 2016 requires the DHHS Secretary to issue to investigators or institutions engaged in biomedical, behavioral, clinical, or other research in which identifiable, sensitive information is collected (“Covered Information”), a Certificate to protect the privacy of individuals who are subjects of such research, if the research is funded wholly or in part by the Federal Government. As a result, NIH now deems all NIH-funded research within the scope of the law and the NIH CoC policy issued a Certificate, thus a CoC request is no longer needed and no information is collected from NIH recipients. Total burden hours have decreased from 1951 to 794 from the previous submission due to automatic issuance of NIH-funded CoCs.
The Act also requires the Secretary take steps to increase the efficiency of the process of obtaining a Certificate of Confidentiality including: 1) minimizing the burden to researchers; 2) streamlining the process; and 3) reducing the time it takes to comply with the requirements associated with applying for a Certificate. NIH plans to further implement these requirements with a streamlined form and enhanced electronic system in 2020. Due to the timeline and resources needed for system development, the system will not be functional prior to expiration of the current clearance.
NIH will only use the CoC request information to tabulate internal statistics for administrative purposes only. No publications of this information are planned.
A.16 - 1 Project Time Schedule
|
|
Activity |
Time Schedule |
Continue to make researchers aware of on-line request system for all CoC requests to NIH |
ongoing |
Continue to enable system access for researchers who wish to request a CoC |
ongoing |
Monitor system and correct any unrecognized system errors |
ongoing |
Tabulate annual system administrative metrics for internal NIH use |
annually |
The OMB control number will be displayed with an expiration date.
None
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File Title | Supporting Statement 'A' Preparation - 04/05/2011 |
| Subject | Supporting Statement 'A' Preparation - 04/05/2011 |
| Author | OD/USER |
| File Modified | 0000-00-00 |
| File Created | 2021-01-14 |