One goal of the 21st Century Cures Act, enacted December 13, 2016, was to strengthen privacy protections law for research participants.
The new law specifically requires additional protections for sensitive information that is collected from participants as part of federally-funded research. To implement one of the law's privacy provisions, the National Institutes of Health (NIH) put forth a new policy which requires that all NIH-funded investigators who conduct sensitive, health-related human subjects research be issued Certificates of Confidentiality.
Previously, NIH issued these certificates only upon researcher request to cover studies collecting sensitive data; however, under the new policy, as of October 1, 2017, NIH-funded researchers and their institutions will automatically be issued a certificate for applicable research. Compliance with the requirements of the policy will become a term and condition of award for grant recipients collecting relevant types of data.
Certificates of Confidentiality under the new policy will prohibit researchers from disclosing names or other identifying characteristics of research subjects in response to legal demands, such as subpoenas.
More information on the new policy can be found at Notice of Changes to NIH Policy for Issuing Certificates of Confidentiality