The federal Certificate of Confidentiality plays an important role in research on sensitive topics by authorizing researchers to refuse to disclose identifiable research data in response to subpoenas in any legal setting. However, there is little known about how effective Certificates are in practice. This article draws on our legal and empirical research on this topic to fill this information gap. It includes a description of the purpose of Certificates, their legislative and regulatory history, and a summary of the few reported and unreported cases that have dealt with Certificates. In addition, we outline other statutory confidentiality protections, compare them to the Certificate's protections, and analyze some of the vulnerabilities of a Certificate's protections. This analysis allows us to make specific recommendations for strengthening the protections afforded to research data.