MSU HRPP Manual Section 2-2-C
U.S. Department of Justice
This section provides additional requirements provided by the U.S Department of Justice when research is conducted within the Bureau of Prisons or funded by the US Department of Justice (DOJ) as applicable to human subject research.
In addition to the Basic DOJ policy for Protection of Human Subjects (28 CFR 46), additional requirements provide statutory protection to private information under the authority of 42 U.S.C. § 3789g and under DOJ regulations for the Confidentiality of Identifiable Research and Statistical Information found in 28 CFR Part 22.
The DOJ Confidentiality of Identifiable Research and Statistical Information regulations (28 CFR 22) govern use and revelation of research and statistical information obtained, collected, or produced either directly by Bureau of Justice Assistance (BJA), Office of Juvenile Justice and Delinquency Prevention (OJJDP), Bureau of Justice Statistics (BJS), National Institute of Justice (NIJ), or Office of Justice Programs (OJP) or under any interagency agreement, grant, contract, or subgrant awarded under the Crime Control Act, the Juvenile Justice Act, and the Victims of Crime Act.
When these regulations apply, researchers must comply with additional requirements, including the use of a Privacy Certificate and informed consent provisions. The regulations do not apply to information gained regarding future criminal conduct.
Privacy Certificate
Each applicant for BJA, OJJDP, BJS, NIJ, or OJP support either directly or under a State plan shall submit a Privacy Certificate as a condition of approval of a grant application or contract proposal which has a research or statistical project component under which information identifiable to a private person will be collected. Privacy certificates may also be required regardless of whether the project involves the collection of identifiable data. In cases where no personally identifiable information will be collected, the Privacy Certificate should contain a statement to this effect and a brief project description.
The Privacy Certificate assures that the applicant understands their responsibilities to protect the confidentiality of research and statistical information and has developed specific procedures to ensure that this information is only used or revealed in accordance with the requirements of 42 USC §3789g and 28 CFR Part 22.
The Privacy Certificate requires the grantee limit access to data to those employees having a need for such data and that such employees shall be advised of and agree in writing to comply with the regulations in 28 CFR 22 and the grantee certifies that all project personnel, including subcontractors, have been advised of and have agreed, in writing, to comply with all procedures to protect privacy and the confidentiality of personally identifiable data.
The Principal Investigator is responsible for obtaining agreements in writing that meet the requirements provided in the Privacy Certificate and for maintaining such forms.
Consent Form
When DOJ Confidentiality of Identifiable Research and Statistical Information regulations (28 CFR 22) apply, the consent document must disclose:
-
Name(s) of the funding agency
-
Extent to which confidentiality of records identifying the participant will be maintained.
-
Subject should be informed that private, identifiable information will be kept confidential and will only be used for research and statistical purposes.
-
If, due to sample size or some unique feature, the identity of the individual cannot be maintained, the subjects need to be explicitly notified.
-
If the investigator intends to disclose any information, the subject needs to be explicitly informed what information would be disclosed, under what circumstances, and to whom.
-
The subject must be informed of any potential risks which may result from this disclosure and must explicitly provide prior written consent.
-
The confidentiality statement on the consent form must state that confidentiality can only be broken if the subject reports immediate harm to subjects or others.
-
When identifiable data is collected under the DOJ privacy regulations, current or past abuse is not reportable, unless a separate consent to allow reporting is obtained from the research subject, in addition to a consent to participate in the research study.
Notification must be provided in accordance with 22 CFR 22.27.
Procedure for Review
Researchers who are applying for DOJ funding and require the signed Privacy Certificate and as needed the Human Subjects Protection Form should submit the request to the MSU HRPP office. The form with appropriate attachments should be submitted to the HRPP at least 10 business days before the grant submission deadline to allow time for review and modifications, if needed. Individuals within the HRPP office are designated as institutional representatives who review and sign the Privacy Certificate and the Human Subjects Protection Form.
See the following sections of the HRPP Manual for specific requirements:
2-2-C-ii National Institute of Justice Funded Research
This policy and procedure supersedes those previously drafted.
Approved By: Vice President of Research and Graduate Studies, 7-19-2011. Revision 1 approved by VP Research & Graduate Studies on 12-11-2015. Revision 2 approved by Associate VP Research Regulatory Support on 11-17-2025.