Use of Electronic Informed Consent: Questions and Answers

Guidance for Institutional Review Boards, Investigators, and Sponsors

Guidance for Institutional Review Boards, Investigators, and Sponsors[1]

I. INTRODUCTION

This guidance has been prepared jointly by the Department of Health and Human Services (HHS) Office for Human Research Protections (OHRP) and the Food and Drug Administration (FDA). This guidance is intended for institutional review boards (IRBs), investigators, and sponsors engaged in or responsible for oversight of human subject research under HHS and/or FDA regulations.

This guidance provides recommendations on the use of electronic systems and processes that may employ multiple electronic media to obtain informed consent for both HHS-regulated human subject research and FDA-regulated clinical investigations of medical products, including human drug and biological products, medical devices, and combinations thereof. FDA’s requirements for electronic records/electronic signatures, informed consent, and IRBs are set forth in 21 CFR parts 11, 50, and 56, respectively. HHS requirements regarding the protection of human subjects are set forth in 45 CFR part 46. The information presented to the subject, processes used for obtaining informed consent, and documentation of the electronic informed consent (eIC) must meet the requirements of these and other applicable regulations.

If the study is conducted or supported by HHS and involves an FDA-regulated product, the study is subject to both 45 CFR part 46 and 21 CFR parts 50 and 56, meaning that both sets of regulations must be followed. Where the regulations differ, the regulations that offer the greater protection to human subjects should be followed. Research not subject to 21 CFR parts 50 and 56 is also not generally subject to 21 CFR part 11 (FDA regulations regarding electronic records and electronic signatures).

For the purposes of this guidance, electronic informed consent refers to the use of electronic systems and processes that may employ multiple electronic media, including text, graphics, audio, video, podcasts, passive and interactive Web sites, biological recognition devices, and card readers, to convey information related to the study and to obtain and document informed consent.

This guidance clarifies that when implementing an eIC, a variety of approaches may be used to fulfill HHS and FDA regulatory requirements for informed consent and IRB review (45 CFR part 46 and 21 CFR parts 50 and 56) and FDA regulations for electronic records and electronic signatures (21 CFR part 11).

This guidance provides recommendations on procedures that may be followed when using an eIC to help:

• Ensure protection of the rights, safety, and welfare of human subjects
• Facilitate the subject’s comprehension of the information presented during the eIC process
• Ensure that appropriate documentation of consent is obtained when electronic systems and processes that may employ multiple electronic media are used to obtain informed consent[2]
• Ensure the quality and integrity of eIC data[3] included in FDA applications and made available to FDA during inspections

Although both OHRP and FDA affirm that the informed consent process begins with subject recruitment,[4] recommendations on using electronic media and processes for subject recruitment are outside the scope of this guidance.

In general, OHRP and FDA guidance documents do not establish legally enforceable responsibilities. Instead, guidances describe the current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word should in guidances means that something is suggested or recommended, but not required.

To enhance human subject protection and reduce regulatory burden, OHRP and FDA have been actively working to harmonize the Agencies’ regulatory requirements and guidance for human subject research. This guidance document was developed as a part of these efforts.

II. BACKGROUND

The term informed consent is often mistakenly viewed as synonymous with obtaining a handwritten signature from the subject or the subject’s legally authorized representative (LAR)[5] on a written informed consent form. However, obtaining a subject’s oral or written informed consent is only part of the overall informed consent process. Informed consent involves providing a potential subject with adequate information about the research to allow for an informed decision about the subject’s voluntary participation in a research study. Informed consent must include a process that facilitates the subject’s comprehension of the information and allows adequate opportunity for the subject to ask questions and consider whether or not to participate (45 CFR 46.116 and 21 CFR 50.20). Furthermore, this process often continues beyond obtaining the subject’s initial consent at the time of enrollment and may involve providing additional information as the research progresses or as the subject or situation requires.[6] The elements of informed consent for human subjects and the requirements for documentation of informed consent are discussed in 45 CFR 46.116 and 46.117 and 21 CFR 50.25 and 50.27, respectively.

The research community is showing increasing interest in using electronic media to supplement or replace paper-based informed consent processes. An eIC may be used to provide information usually contained within the written informed consent document, evaluate the subject’s comprehension of the information presented, and document the consent of the subject or the subject’s LAR. Electronic processes to obtain informed consent may use an interactive interface, which may facilitate the subject’s ability to retain and comprehend the information. Furthermore, these electronic processes may allow for rapid notification to the subjects of any amendments pertaining to the informed consent that may affect their willingness to continue to participate. Electronic processes may also promote timely entry of any eIC data into a study database and allow for timely collection of the subject’s informed consent data from remote locations.

III. INSTITUTING AN ELECTRONIC INFORMED CONSENT process

Questions and answers

Q1. How should information in the eIC be presented to the subject?

The eIC must contain all elements of informed consent required by HHS and/or FDA regulations (45 CFR 46.116 and 21 CFR 50.25). The information must be in language understandable to the potential subject or the subject’s LAR and conveyed in a manner that minimizes the possibility of coercion or undue influence regarding the subject’s decision to participate in a study (45 CFR 46.116 and 21 CFR 50.20).[7] Understandable means that the information presented to subjects is in a language and at a level the subject can comprehend, including an explanation of scientific and medical terms. To ensure that the eIC is presented appropriately and that subjects will have enough time to dedicate to the eIC process, the subjects should be informed of approximately how long the process will take and what information will be presented to them.

Any eIC should be easy to navigate, allowing the user to proceed forward or backward within the system and to stop and continue at a later time. Hyperlinks may be provided where helpful. The eIC may also incorporate electronic strategies to encourage subjects to access all of the consent material before documenting their consent.

Electronic informed consent may be used to either supplement or replace paper-based informed consent processes in order to best address the subject’s needs throughout the course of the study. For example, some subjects may prefer one method over another. Other subjects may have difficulty navigating or using electronic systems because of, for example, a lack of familiarity with electronic systems, poor eyesight, or impaired motor skills. In such cases, the eIC process may not be appropriate for these subjects.[8] Therefore, subjects should have the option to use paper-based or electronic informed consent methods completely or partially throughout the informed consent process. Moreover, in some circumstances, it may be appropriate for investigators or study personnel to assist subjects in using the eIC technology. For example, study personnel may help the subject navigate the consent by clicking on links for the subject.

Q2. How and where may the eIC process be conducted?

The investigator is responsible for ensuring that legally effective informed consent is obtained before that subject takes part in the study (see 45 CFR 46.116 and 21 CFR 50.20, 312.60, and 812.100). If the investigator delegates this responsibility, the responsibility should be delegated to an individual qualified by education, training, and experience to perform this activity.[9] Whether part or all of the eIC process takes place on-site or remotely, the responsibility for obtaining informed consent remains with the investigator and the study personnel to which responsibility has been appropriately delegated. The investigator cannot delegate authority to obtain informed consent to the electronic system.

The consent process may take place at the study site when both the investigator and subject are at the same location, or it may take place remotely (e.g., at the subject’s home or another convenient venue) where the subject reviews the consent document in the absence of the investigator. The eIC materials may be provided for both on-site and remote access.

If the entire process takes place at the study site, the study personnel can personally verify the subject’s identification, review the eIC content, answer questions about the material, have follow-up discussions, and witness the signing of the eIC.

If any or all of the consent process takes place remotely and is not personally witnessed by study personnel, the electronic system must include a method to ensure that the person electronically signing the informed consent is the subject who will be participating in the research study or is the subject’s LAR (see 21 CFR 11.100(b)). Examples of various methods that could be used include verification of a state-issued identification or other identifying documents or use of personal questions, biometric methods, or visual methods (see Q7).

For Research Under the Sole Authority of 45 CFR Part 46

OHRP recognizes that it may not be possible or necessary for all types of research covered by 45 CFR part 46 to verify that the person signing the informed consent is the subject or the subject’s LAR who will be participating in the research study. OHRP encourages investigators to apply a risk-based approach to the consideration of subject identity. For example, social behavioral minimal risk research will not typically warrant such verification. In addition, informed consent may be waived for minimal risk research meeting the requirements at 45 CFR 46.116(d).

Q3. How and when should questions from subjects be answered?

Whether the eIC is obtained from the subject on-site or remotely, the eIC process must provide sufficient opportunity for the subject to consider whether to participate (see 45 CFR 46.116 and 21 CFR 50.20). The investigator should have methods in place to ensure that the eIC process allows subjects the opportunity to consider whether or not to participate and to ask questions about the study before signing consent as well as at any time during the subject’s involvement in the research. This may be accomplished by in-person discussions with study personnel or through a combination of electronic messaging, telephone calls, video conferencing, or a live chat with a remotely located investigator or study personnel. When live chat or video conferencing is used during the eIC process, investigators and study personnel should remind subjects to conduct the eIC discussion in a private location to help ensure privacy and confidentiality.

Subjects should be given a description of how and when they will receive answers to their questions, and they must be provided information on how to contact an appropriate individual for pertinent questions about the research and their rights and whom to contact in the event that they sustain a research-related injury (see 45 CFR 46.116(a)(7) and 21 CFR 50.25(a)(7)).

Q4. What steps may be taken to facilitate the subject’s understanding of the information being presented?

To assist the subject in understanding the material, the eIC may use interactive electronic-based technology, which may include diagrams, images, graphics, videos, and narration. The eIC should be appropriate for the intended audience, taking into consideration the subject’s age, language, and comprehension level.

The eIC may contain various methods to help an investigator assess the subject’s understanding of the information being presented during the eIC process. For example, the eIC may include optional questions at any time during the eIC discussion that can be used to help educate the subject about the information presented, as well as assess the subject’s understanding of the informed consent materials. Such optional questions and other methods may be used as tools to gauge subject comprehension of key study elements and highlight areas where the subject might need further explanation and discussion before signing the informed consent to enter the study.

Q5. What steps may be taken to convey additional information, including significant new findings, to the subject during the course of the research?

When appropriate, the eIC must contain a statement that significant new findings developed during the course of the research that may affect to the subject’s willingness to continue participation will be provided to the subject or the subject’s LAR (see 45 CFR 46.116(b)(5) and 21 CFR 50.25(b)(5)). If an update or amendment to an eIC is necessary and could affect the subject’s willingness to continue participation in the study, the eIC process must provide sufficient opportunity for the subject to consider whether to continue participation (see 45 CFR 46.116 and 21 CFR 50.20). If the eIC is updated or amended, the subject should be given sufficient opportunity to ask questions about the amended contents (see Q3). In such cases, the subject or the subject’s LAR must sign the amended eIC before the subject continues in the study (see 45 CFR 46.117(a) and 21 CFR 50.27). OHRP and FDA regulations permit the flexibility of using electronic and paper informed consent methods independently or in combination throughout the course of the study. Thus, amendments to the eIC do not need to be electronic in nature and can instead rely on more traditional means, such as paper-based amendments or postal mail, for conveying and transmitting the information to the subject (see Q1).

Q6. How can electronic signatures be used to document eIC?

The procedure for eIC may include an electronic method to capture the signature of the subject or the subject’s LAR. OHRP and FDA regulations permit the use of electronic signatures when written informed consent is required. OHRP permits electronic signatures if such signatures are legally valid within the jurisdiction where the research is to be conducted.

For FDA-Regulated Clinical Investigations

FDA regulations found at 21 CFR part 11 set forth the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to a handwritten signature executed on paper (see 21 CFR 11.1(a)). In order to be considered equivalent to full handwritten signatures, electronic signatures must comply with all applicable requirements under 21 CFR part 11.[10] The electronic system must also capture and record the date that the subject or subject’s LAR provides consent (see 21 CFR50.27(a)).

The regulations found at 21 CFR part 11 permit a wide variety of methods to create electronic signatures, including using computer-readable ID cards, biometrics,[11] digital signatures,[12] and user name and password combinations. FDA does not mandate or specify any particular methods for electronic signatures, including any particular biometric method upon which an electronic signature may be based.

Electronic signatures based on biometrics must be designed to ensure that they cannot be used by anyone other than their genuine owners (21 CFR 11.200(b)). Therefore, suitable biometrics should be uniquely identified with the individual and should not change with time. In addition, electronic signatures based upon biometrics are accepted provided they meet the requirements found in 21 CFR part 11 (i.e., they must contain pertinent information associated with the signing (see 21 CFR 11.50(a)); they are subject to the same controls as electronic records and must be included as part of any human readable form of the electronic record (see 21 CFR 11.50(b)); and they must be linked to their respective electronic records (see 21 CFR 11.70).

IRBs, investigators, and sponsors should consider such issues as how the electronic signature is created and whether the informed consent or permission document can be produced in hard copy for review by the subject upon request. IRBs, investigators, and sponsors may rely on a statement from the vendor of the electronic system used for obtaining the electronic signature that describes how the signature is created and that the system meets the relevant requirements contained in 21 CFR part 11.

A copy of the informed consent must be provided to the person signing the form (see 21 CFR50.27(a)) (see Q9).

Q7. What methods may be used to verify the identity of the subject who will be electronically signing an eIC for FDA-regulated clinical investigations?

Compliance with the requirements in Part 11 is meant in part to prevent fraudulent use. Therefore, the regulations found at 21 CFR part 11 require that an organization verify the identity of an individual before it establishes, assigns, certifies, or otherwise sanctions an individual’s electronic signature or any element of such electronic signature (see 21 CFR 11.100(b)).

FDA regulations do not specify any particular method for verifying the identity of an individual and accepts many different methods. For example, verifying someone’s identity can be done by using information from some form of official identification, such as a birth certificate, government-issued passport, or a driver’s license. In addition, use of security questions to confirm an individual’s identity can also be considered.

Q8. What special considerations should be given to the use of eIC for pediatric studies?

The eIC process can be used to obtain assent from pediatric subjects (when required) and parental permission from their parent(s) or guardian. The general requirements for informed consent, found in 45 CFR 46.116 and 46.117 and 21 CFR50.20, 50.25, and 50.27, apply to parental permission, in addition to the requirements for permission by parents or guardians and for assent by children found at 45 CFR 46.408 and 21 CFR 50.55.[13] Therefore, parental permission may be obtained and documented using the same eIC procedures as would be used for informed consent.

Absent a waiver of the assent requirement (see 45 CFR 46.408(a) and 21 CFR 50.55(d)), or a determination that assent is not necessary (see 45 CFR 46.408(a) and 21 CFR 50.55(c)), the IRB must determine that there are adequate provisions for soliciting the assent of children when, in the IRB’s judgment, the children are capable of providing assent (see 45 CFR 46.408(a) and 21 CFR50.55(a)). When approving an eIC assent process, an IRB should consider whether the capability of a child to assent may be affected by the method used to obtain and/or document child assent. For example, if assent would otherwise be required, the method used to obtain eIC assent should not impede the child’s capability to provide assent. The language and presentation of information must be understandable to the child. In addition, when the IRB determines that assent is required, it must also determine whether and how assent must be documented (see 45 CFR 46.408(e) and 21 CFR50.55(g)).

For FDA-Regulated Clinical Investigations

Depending on the method of identity verification used to satisfy the regulations in 21 CFR part 11 for electronic signatures in FDA-regulated clinical investigations, a child may lack the documentation necessary to verify their identity for the purposes of preventing fraudulent use of electronic signatures (e.g., driver’s license) (see Q7). If so, depending on the clinical investigation, it may be reasonable for the parent to initially document the child’s assent, which can then be verified when the investigator first sees the child.

Q9. Should subjects receive a copy of their eIC and have easy access to the materials and information presented to them in their eIC?

Yes. HHS and FDA regulations require that the person signing the informed consent (i.e., the subject or the subject’s LAR or the parents or guardians of subjects who are children) be given a copy of the written informed consent form (45 CFR 46.117(a) and 21 CFR50.27(a)), unless the requirement for documentation of informed consent has been waived under 45 CFR 46.117(c) and 21 CFR 56.109(c)). Although FDA regulations do not require that the subject’s copy include a signature, FDA recommends that a copy of the signed informed consent form that includes the date when the eIC was signed be provided to the subject.

The copy provided to the subject can be paper or electronic and may be provided on an electronic storage device or via email. If the copy provided includes one or more hyperlinks to information on the Internet, the hyperlinks should be maintained and information should be accessible until study completion. Note that if the eIC uses hyperlinks or other Web sites or podcasts to convey information specifically related to the research, the information in these hyperlinks should be included in any printed paper copy, if one is provided.

Q10. What steps can be taken to help ensure privacy, security, and confidentiality of the eIC information?

For FDA-regulated clinical investigations, the electronic system that supports the eIC must be secure with restricted access (see 21 CFR 11.10 and 11.30) and should include methods to ensure confidentiality regarding the subject’s identity, study participation, and personal information after informed consent has been obtained.[14]

If the entity holding the subject’s personal information is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law No.104-191)[15] or acting as a business associate of a HIPAA-covered entity, the requirements in the HIPAA Privacy, Security, and Breach Notification Rules apply (see 45 CFR parts 160 and 164). For example, the subject’s information within an electronic system must be encrypted, unless the entity documents why encryption is not reasonable and appropriate in their specific circumstances and implements a reasonable and appropriate equivalent measure.

Q11. Can HIPAA authorizations for research, which are frequently combined with informed consent documents, be obtained electronically?^[16]

Yes. HIPAA authorizations may be obtained electronically, provided that the signature of the subject (or the subject’s personal representative) is a valid electronic signature under applicable laws and regulations.[17] The Electronic Signatures in Global and National Commerce Act (E-Sign Act) (Public Law 106-229) addresses what constitutes a valid electronic signature and provides that a signature may not be denied legal effect because it is in electronic form.

The HIPAA Privacy Rule requires that when a covered entity seeks an authorization from a subject (or a subject’s personal representative), the covered entity must provide the individual with a copy of the signed authorization; this requirement also applies where a HIPAA authorization is obtained electronically.[18]

Q12. What eIC materials should the investigator submit to the IRB?

The investigator should submit to the IRB copies of all forms (electronic and paper forms) and informational materials, including any videos and Web-based presentations, which the subject will receive and view during the eIC process. The investigator must obtain IRB approval for any subsequent modifications to the study-related information, whether electronic or in hard copy (see 45 CFR 46.109 and 21 CFR 56.109). OHRP and FDA recommend that an investigator discuss plans for using eIC with the IRB before finalizing development of the eIC to ensure that the IRB agrees that such a format may be used for the applicable research for obtaining informed consent.

Q13. What are the IRB’s responsibilities in the eIC process?

HHS and FDA regulations require that an IRB review and have authority to approve, require modifications in (to secure approval), or disapprove all research activities covered by the applicable regulations (see 45 CFR 46.109(a) and 21 CFR 56.109(a)). A critical part of this responsibility is for the IRB to ensure there is an adequate informed consent process that protects the rights and welfare of subjects participating in HHS-regulated research and FDA-regulated clinical investigations (see 45 CFR 46.109(b) and 21 CFR 56.109(b) and 56.111(a)(4)). Therefore, the IRB must review and approve the eIC and any amendments to the eIC that the subject will receive and view (see 45 CFR 46.109(a) and 21 CFR 56.109(a)). The IRBs must maintain and retain copies of materials that have been reviewed in accordance with 45 CFR 46.115 and 21 CFR 56.115.

The IRBs should also review any optional questions or methods used to gauge subject comprehension of key study elements. The IRB should also review the usability of the eIC materials to ensure that they are easy to navigate. If the program uses hyperlinks to convey study-related information, IRBs should review the contents to which subjects are referred in order to determine if the study-related information that has been supplied is accurate and appropriate. Because Web sites are often modified over time, IRBs must maintain the version of the Web site information that contains the study-related information that the IRB reviews and approves, either electronically or as a hard copy (see 45 CFR 46.115 and 21 CFR 56.115).

Q14. What eIC documentation does FDA require for submission with applications?

Investigational new drug application (IND) regulations do not specifically require submission of informed consent documents to FDA as part of an IND application; however, the Center for Drug Evaluation and Research (CDER) and the Center for Biologics Evaluation and Research (CBER) may request submission of the informed consent form for review[19] under certain circumstances (e.g., when unusual known clinical toxicity is associated with the study drug or class of drugs; when the study population is particularly vulnerable; when the clinical investigation has significant potential for serious risks to human subjects; or for a postmarket safety clinical trial, required under section505(o) of the Federal Food, Drug, and Cosmetic Act (FD&C Act)[20] to assess a serious risk).[21] Although all informed consent documents used in FDA-regulated clinical investigations must be reviewed by an IRB (see 21 CFR 56.103), there are situations in which CDER and CBER review of an informed consent in addition to IRB review is particularly important to determine whether a clinical investigation may safely proceed under 21 CFR part312.

Investigational device exemption (IDE) regulations state that IDE applications must include copies of all forms and informational materials to be provided to subjects to obtain informed consent (see 21 CFR 812.20(b)(11)). When FDA approval of an IDE application is required, a sponsor must not begin an investigation until the IDE application and informed consent materials have been reviewed and approved by FDA (see 21 CFR 812.20(a) and (b)).

The sponsor should submit to FDA the same eIC materials that will be presented to subjects to obtain eIC for their participation in the clinical investigation. For example, as part of an electronic submission to FDA, the sponsor should submit copies of all forms and informational materials including any videos, Web-based presentations, hyperlinks or other Web sites or podcasts that are used to convey information specifically related to the investigation. The sponsor should also submit any written information related to the clinical investigation that is provided to the subject on paper. Hyperlinks or other Web sites or podcasts containing incidental information not related to the clinical investigation need not be submitted to FDA. The eIC materials should be provided in an electronic format acceptable to FDA, on an electronic storage device, or as a link to the eIC Web page that is accessible to FDA for viewing these eIC materials.[22]

Q15. What steps can be taken to ensure the system archives the eIC materials appropriately for FDA-regulated clinical investigations?

FDA regulations do not specify a preferred method for archiving documents; however, the eIC process should incorporate procedures to ensure that electronic documents can be archived appropriately and that all versions of the IRB-approved eIC can be retrieved easily. All procedures must be in compliance with applicable FDA regulations for electronic records.[23]

Q16. What materials or documents will FDA require during an inspection?

During inspections of clinical investigation sites,[24] FDA regulations require that FDA be granted access to records and reports made by the investigator, including site-specific versions of the eIC, the materials submitted to IRBs for review and approval, all amendments to the site-specific eICs, and all subject-specific signed eICs.[25] These should be available at the site either in electronic or paper form. FDA reserves the right to review the content of the eIC program or informed consent document and the corresponding informed consent of the subject or the subject’s LAR and the signature of a witness, where applicable, along with the date that the eIC was signed. Any updates to the documentation should also be available for review.