UC Davis Health
Compliance and Privacy Services

Regulatory Requirements | Compliance and Privacy Services | UC Davis Health​

Regulatory Requirements​

Access to certain links may require logging into the UC Davis Health Intranet or Electronic Policy Management System. For more information, please contact us.

Certificates of Confidentiality (CoC) protect the privacy of research participants by prohibiting disclosure of identifiable, sensitive research information. Specifically, a CoC prohibits disclosure for Federal, State, or local civil, criminal, administrative or other proceeding without consent of the individual(s) unless a specific exception applies.

The 21st Century Cures Act (P.L. 114-255 (PDF) Section 2012) requires the Department of Health and Human Services (HHS) to issue a CoC for federally-funded research that collects or uses identifiable, sensitive information that involves:

  • Human subjects,
  • Collection or use of specimens identifiable to an individual,
  • Risk that the data or specimens could be used to identify an individual, or
  • Generation of individual level human genomic data.

A CoC may also be issued for non-funded research by request.

The National Institutes of Health (NIH), an Operating Division of HHS, automatically issues a CoC as a term and condition of the research award, and a stand-alone certificate is not provided.

CoC protections apply to information which is collected during the CoC effective period, and the CoC protections never expire. For NIH-funded research, the CoC effective period is generally during the NIH-award term.

See also:

CoC Recipient Responsibilities

Recipients of a CoC are responsible to:

  1. Inform participants about the CoC protections and exceptions to the CoC protections;
  2. Not release participant’s identifiable sensitive information unless an exception applies;
  3. Uphold CoC protections, including with collaborators, contractors, and vendors; and
  4. Inform investigators and institutions that receive CoC-protected information of the CoC and their obligations to safeguard the protected information.

Information protected by a CoC may be disclosed under the following exceptions:

  • When required by Federal, State, or local laws such as communicable disease or abuse reporting;
  • When the participant consents to the disclosure; or
  • When released for purposes of scientific research compliant with human subjects’ regulations.

Certificates of Confidentiality and the Medical Record

For a study with a CoC, the research subject’s consent is required before study information may be documented in the medical record. UC Davis IRB consent templates include appropriate language for obtaining such consent.

To support investigators and UC Davis Health in meeting our CoC responsibilities, researchers conducting a study that documents research information in medical records must request a “Release of Information (ROI) Special Attention” field in the electronic health record system. The EMR of patients linked to the study with a ROI Special Attention field will display a warning that the study information may never be released. See this Guidebook link for more information:

Certificates of Confidentiality - UC Davis Clinical Research Guidebook - Confluence

Additionally, Policy 2317, Documentation of Research Patient Status in the Electronic Medical Record, sets standards for identification of research information in Epic, including the requirement to request a “Release of Information (ROI) Special Attention” field.

NIH CoC Resources

Overview

In 2000, ClinicalTrials.gov was created to establish a registry of clinical trials involving investigational drugs as a result of the Food and Drug Administration Modernization Act of 1997 (FDAMA). Subsequently, the FDA Amendments Act of 2007, Section 801 (FDAAA 801) required additional types of trials to register on the ClinicalTrials.gov website and submit certain data elements. In September 2016, the Department of Health and Human Services (DHHS) issued a Final Rule clarifying and expanding the registration and results information submission requirements under FDAAA 801. In parallel to the Final Rule, the National Institutes for Health (NIH) issued a complementary policy outlining the requirements for registering and submitting results information to ClinicalTrials.gov.

Federal enforcement of ClinicalTrials.gov registration and results-reporting requirements have been under particular scrutiny since 2020. Department of Health and Human Services (DHHS), Office of Inspector General (OIG), initiated audits of the National Institutes of Health’s (NIH) and the Food and Drug Administration’s (FDA) enforcement of ClinicalTrials.gov results-reporting compliance in 2021 and 2024, respectively. The results of the NIH audit were published in 2022. The results of the FDA audit will be published in 2025. Increased enforcement activities are anticipated because of these OIG audits.

Investigators with study registration and/or results-reporting obligations should ensure timeliness standards are met to avoid lapses in NIH funding and civil monetary penalties. Support for ClinicalTrials.gov registration and results-reporting is available through the UC Davis Health Clinical and Translational Science Center (CTSC).

Resources

Regulatory Actions and Site Visits

Researchers who become aware of regulatory agency citations, complaints, requests to review/audit UC Davis Health records, documents or practices, or allegations of non-compliance related to clinical research must notify UC Davis IRB and Compliance and Privacy Services as described in Policy 1506, Clinical Research Regulatory Agency Review. The policy also describes documentation that must be submitted to the IRB and Compliance and the specific elements of a final report that will be generated by the UC Davis IRB or Compliance.

Once notified, Compliance will make logistical arrangements for conduct of the site visit, such as conference room and other work-space reservations, document storage accommodations, parking arrangements for the regulatory visitor, if available, and cardkey access as needed.

Notify Compliance by email at HS-ResearchCompliance@ucdavis.edu and include related email communications and/or letters of notification from the regulatory agency.

Resources for Preparing for an FDA Inspection

Overview

The National Institutes of Health (NIH) issued its final NIH Policy for Data Management and Sharing (DMS Policy), effective January 25, 2023, to promote the management and sharing of scientific data generated from NIH-funded or conducted research. The Policy applies to research funded by NIH or conducted by NIH that results in the generation of scientific data, regardless of funding amount. Under the DMS policy, NIH expects that investigators and institutions seeking funding:

  • Plan and budget for the managing and sharing of data, and
  • Submit a DMS plan for review when applying for funding.

Approved DMS Plans become a term and condition of the NIH award. Awardees are expected to:

  • Manage and share data as described in the approved DMS Plan,
  • Provide updates on data management and sharing activities in annual progress reports, and
  • Prospectively work with the NIH Program Officer to review and obtain approval of any necessary DMS Plan modifications.

NIH will monitor compliance with Plans over the course of the funding period during regular reporting intervals (e.g., at the time of annual Research Performance Progress Reports (RPPRs)). Noncompliance with Plans may result in the NIH adding special Terms and Conditions of Award or termination of the award. If award recipients are not compliant with Plans at the end of the award, noncompliance may be factored into future funding decisions.

Individual NIH Institutes, Centers, or Offices may have additional policies and expectations (see NIH Institute and Center Data Sharing Policies).

Resources

UC Davis Clinical and Translational Science Center Tools and Subject Matter Expert Support:

NIH Scientific Data Sharing Website:

The Food and Drug Administration (FDA) may authorize the sponsor of a clinical trial or expanded access protocol to charge for an investigational drug for which an Investigational New Drug (IND) application is in effect. FDA will withdraw the authorization if charging interferes with development of a drug or if the criteria for the authorization to charge are no longer being met.

Sponsor requirements:

  • Must obtain prior written authorization from the FDA to charge for an investigational drug.
  • Must provide evidence that the drug has a potential clinical benefit.
  • Must demonstrate that the clinical trial could not be conducted without charging because the cost of the drug is extraordinary to the sponsor.
  • May recover only direct costs for making the investigational drug available.
  • Must provide documentation of costs and a statement that an independent certified public accountant reviewed and approved the calculations.

FDA guidance states that its authorities do not extend to reimbursement policy or reimbursement decisions for the investigational drugs it has authorized charging. The FDA recommends that questions pertaining to third-party payor reimbursement be directed to the third-party payors the sponsor seeks to charge. It is important to note that the FDA’s authorization to charge does not constitute a marketing or commercial distribution approval for the investigational product.

A crosswalk of the federal laws and policies related to charging costs in clinical trials to Medicare, Medicaid (or Medi-Cal), and private insurers is available at the link below. See exceptions to coverage.

See also:

FDA resources: