Informed Consent

When conducting research, it is the ethical obligation of the research team to obtain informed consent from research participants. The process of obtaining informed consent ensures that participants understand the nature of the research project and any risks and/or benefits of participating and allows them to decide whether they would like to participate in the research.

Generally speaking, informed consent must be obtained from participants in order to be included in research if individually identifiable participant information is collected (45 CFR 46.116(a); 21 CFR 50.25(a)). Unless waived by the IRB, informed consent must be obtained from individuals providing data or specimens for research registries, databases, and repositories.

What Does Informed Consent Include?

In order to establish informed consent, information shared with participants about a research registry, database, or repository should include:

• A clear description of
  • The operation of the database/registry/repository;
  • The specific types of research to be conducted;
  • The conditions under which data will be released to recipient‐investigators; and
  • Procedures for protecting the privacy of subjects and maintaining the confidentiality of data.
• A statement regarding future withdrawal of the data from the study (i.e., state whether subjects may, in the future, request that their data be destroyed or that all personal identifiers be removed from data).

Other information, such as the length of time that data will be stored, subjects’ access to information learned from the research, and secondary uses of the samples should be considered as appropriate. Below is a list of other topics that should be included, where relevant:

• Withdrawals – Part of the informed consent process requires informing the participant of his/her rights to withdraw from the study. In cases where the registry data does not include identifiers or a coding system, allowing participants to withdraw their data will not be possible. Be sure the consent form specifies whether withdrawing from the study means that 1) all of the participant’s data will be removed and not used in analysis, or that 2) future data on that participant will cease to be collected, but that previously collected data will remain part of the database and included in analyses.
• Recontacts – Initial registry consent should include as much information as possible about purpose of and plans for the registry. It should also specify under what circumstances recontact for additional permissions will be made. In cases where all data is de-identified, be sure to explain that recontact will not be possible.
• Data Security and Privacy – Consent forms should clearly describe what measures will be taken to ensure the security and confidentiality of data and/or specimens, the procedures for protecting the privacy of subjects, and what risks may remain. If you are taking appropriate precautions to ensure security and privacy and describing them clearly in your consent process, this will likely make participants more comfortable with participation in the registry.
• HIPAA: Health Insurance Portability and Accountability Act – The HIPAA authorization form is the document that a patient would sign to allow an entity (such as UNC Healthcare) to share specific health information with the research investigator or research team. If a registry created for research purposes will include protected health information (PHI), the standard requirement is also to obtain a written HIPAA authorization allowing access to the participants’ health data.

Waiver of written documentation of informed consent

Depending on the nature and purpose of your registry, the IRB may allow a study team to alter the standard approach of obtaining written informed consent. For example, the IRB may approve a consent process that does not require a subject to sign the consent document or allows that a subject click a box in an online survey to indicating their agreement to participate in the registry. These approaches would fall under the category of waiver or alteration of consent requirements, which includes a waiver of written documentation of informed consent.

Your study may be eligible to receive a waiver or alteration of consent requirements (i.e., written documentation) if you are conducting minimal risk research and:

1. The waiver or alteration of consent will not affect the rights of the subjects
2. The research cannot reasonably be carried out without the waiver
3. When appropriate, subjects will be provided information after participation

Your study may be eligible to receive a waiver of written documentation if you are conducting research where:

1. The only record linking the subject and the research would be the consent document and the principal risk would be potential harm resulting from a breach of confidentiality.
2. The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context.

It is important to note that receiving a waiver for the requirement of signed consent, does not waive the requirement for any form of informed consent. There are several potential approaches to obtain consent from a research registry participant without the signed document:

• Full consent form minus the signature lines
• Information or fact sheet
• Online consent form with electronic agreement
• Consent statement incorporated into a survey itself
• Verbal consent obtained in person or via the phone

Waiver of requirement for informed consent

In more limited scenarios, the IRB may waive the requirement for informed consent in its entirety. Federal regulation 45 CFR 46.116(d) establishes four criteria for waiving consent:

1. The research involves no more than minimal risk
2. The waiver or alteration will not adversely affect the rights and welfare of the subjects
3. The research could not practicably be carried out without the waiver
4. Whenever appropriate, the subjects will be provided with additional pertinent information after participation.

Meeting all four of these criteria is most common in retrospective chart-review studies, so not likely to be applicable for registries, in which there is typically potential contact or ongoing prospective chart review.

Registries with the purpose of recruiting subjects for research studies

Participants must consent to inclusion in registries that are designed for the purpose of identifying potential participants for future research opportunities. However, researchers may use a staged consent process in which preliminary consent is granted by participants when they are included in the registry and additional consent is obtained when those participants agree to participate in a study.

Informed consent for future use of data / specimens

It is important to consider potential future uses of data and/or specimens after completion of a study, as additional questions may arise in the future that can be addressed using the same dataset or leftover specimens. If there is an intent to set up a registry or repository, then the informed consent document of the original study should include language for subjects to opt-in or opt-out of storage of their data / specimens for future research purposes. The subject’s decision as indicated on the consent/authorization form must be respected and tracked.

Generally, IRB oversight is required for each new research protocol that uses identifiable or re-identifiable information contained in the database.

Repositories and/or Registries should have data submission policies to ensure that the data are collected in an ethical manner, with informed consent and IRB approval. The repository should have a sample storage and management plan and written policies on:

• Data and tissue submission requirements
• Informed consent
• IRB review of research using the samples or data
• Physical and procedural mechanisms for the secure receipt, storage, and transmission of information and specimens
• Policies on sharing / release of information and specimens: coding, release of identifier, certificates of confidentiality

Recipient‐investigators should have a written agreement with the repository. The agreement should specify under what conditions the data are being released to the recipient‐investigator(s).