There are 3 primary sets of US federal regulations to protect human subjects who participate in research:

• Department of Health and Human Services (HHS) Human Subjects Research Regulations (subpart A of which is called the “Common Rule,” as well as subparts B, C and D),
• Food and Drug Administration (FDA) regulations
• Health Insurance Portability and Accountability Act (HIPAA).

Here, we focus on the Common Rule and then briefly introduce relevant features of FDA and HIPAA regulations.

Common Rule

The Common Rule includes general requirements for consent (45 CFR Part 46.116), which state that an investigator must obtain legally effective informed consent to involve a human being as a subject in research.  This ensures that the prospective subject or a legally authorized representative are given sufficient information with which to decide whether or not to participate. The definition of a human subject is an identifiable, alive person who will be treated with an intervention under study or whose identified data or specimens are used. Informed consent is required for research deemed more than minimal risk by the institutional review board (IRB). If the research poses no more than minimal risk, the IRB will determine if consent can be waived or altered, as described later in this chapter in the section Waivers and Alterations. Note that the IRB can require consent but waive the requirement for documentation of consent, either written or electronic.

When Does It Apply?

US human subjects research regulations apply to research involving human subjects that is conducted or supported by one of the 19 federal agencies that have signed onto the Rule. But most US institutions apply the Common rule to all human subjects’ research regardless of whether or not it is funded by one of these agencies.  Of note, the US Food and Drug Administration (FDA) is not considered a “Common Rule agency” in that it has its own human subjects regulations that slightly differ from the Common Rule. Harmonization of the FDA regulations and the Common Rule is in process (Spector-Bagdady 2021).

Consent Process

A goal of the informed consent process is to give prospective participants the opportunity to weigh the relative risks, possible benefits, and burdens of a research study before deciding whether to participate. Informed consent is obtained at the time of enrollment. During the course of the research, consent may have to be reaffirmed or, if the research significantly changes, a new consent may be required. It is also important to note that a subject can withdraw their consent at any point in the research; however, they might not be able to withdraw their data that has already been collected.

If written or oral informed consent is required, the information and process must be approved by the IRB (oral consent is discussed in the section on Different Approaches to Consent). The form contains the information a participant needs to know to make an informed decision about participation. It should be written in plain language, and the information should be presented in a way that is easy to understand. The consent form is only one part of the process of obtaining consent. Researchers must also describe how they plan to present and discuss the research to potential participants and answer any questions that may arise. While much attention is given to the form, it has been found that the conversation actually is more important for prospective participant comprehension (Beskow and Weinfurt 2019). After all questions have been answered, if a person elects to participate and signs the form, the investigator must document that consent was given and store this documentation for any future potential audit.  The regulations also permit the IRB to waive the requirement for a signature (called a waiver of documentation of consent) when the research is low risk and in other specific situations.

Basic Elements of Informed Consent (Including Key Information)

The Common Rule requires that informed consent forms begin with "key information"—a concise and focused summary of the main reasons why a person might or might not want to participate in the research. With the goal of harmonization with the Common Rule, the FDA has issued a draft guidance on key information and facilitating understanding of informed consent, which provides recommendations for the “key information” section of the informed consent document. The FDA guidance coheres with already existing recommendations, which can be gleaned from OHRP, the preamble to the 2018 Common Rule, and SACHRP, about what should be included in key information sections, suggesting that the section be relatively short (ideally no more than two pages) and cover the following topics (Gelinas et al. 2023):

• Voluntary participation and right to discontinue participation
• Purpose of the research, expected duration, and procedures to be followed
• Reasonably foreseeable risks and discomforts
• Reasonably expected benefits
• Appropriate alternative procedures
• Compensation and medical treatments for research-related injuries
• Costs related to subject participation.

Apart from the key information section, the Common Rule describes required elements that must be included in the informed consent as well as additional elements that should be considered as appropriate. The following is a list of the required elements (see 45CFR46.116(b))  A statement that the study involves research, an explanation of the purposes of the research and how long the subject’s participation is needed, as well as a description of what will happen and a description of any experimental procedures

• A description of any (reasonably foreseeable) risks or discomforts for the subject
• A description of any benefits to the subject (or others)
• Information about any appropriate alternative treatment that might be advantageous
• Information about confidentiality
• For research involving more than minimal risk, information about compensation and/or medical treatments
• Information about contact information concerning questions, rights, and/or injuries related to the research
• A statement that participation is voluntary and may be refused or discontinued at any time
• A statement about any research involving the collection of identifiable private information or biospecimens—that if identifiers are removed, the information or biospecimens could be used for future research studies, or a statement that it will not. (Department of Health & Human Services 2018)
• Additional elements of consent are considered on a study-by-study basis and can be found at (see 45CFR.116(c)).

Example from a NIH Collaboratory Trial

• TSOS Consent Form

Different Approaches to Consent

There are different approaches to informed consent, including full written consent (described above) and a short form, which includes all of the elements of informed consent described above. The minimal risk informed consent models recommended by SACHRP fall into this category, as they comply with 45 CFR 46.116 and do not require a waiver or alteration of consent (described in Section 3).

An alteration of consent, by contrast, involves leaving out some required elements of consent.

Short Form

A short form may be used stating that the elements of informed consent as required by §46.116 were presented orally. The short form must be reviewed and approved by the IRB. Although this consent document is shorter, the consent process itself may be longer (McKinney et al 2015). A typical example of when a short form may be used is when a researcher encounters a non-English speaking participant; in fact, some IRBs limit the use of the short form to these situations.  According to §46.117, the requirements for using a short form include:

• A witness to the oral presentation
• An IRB-approved written summary of what is to be said to the participant (or representative)
• Signatures, as follows:
  • Short form to be signed by participant (or representative) and witness

Copy of the summary to be signed by a witness and the person actually obtaining consent

Oral Consent

Oral consent relies entirely on verbal communication between the researcher and the participant. To use an oral consent process, the research must be minimal risk with adult subjects and no vulnerable populations, and the IRB would need to grant a waiver of documentation of consent, which it could do under 45 CFR 46.117(c)(2).

Case example

The BeatPain Utah NIH Collaboratory Trial is using an oral consent process, as approved by its IRB (Fritz et al. 2022). BeatPain Utah is comparing the effectiveness of nonpharmacologic intervention strategies for patients with back pain seeking care in 13 federally qualified health centers (FQHCs) throughout Utah. The strategies being evaluated are designed to overcome barriers specific to rural and low-income communities served by FQHC clinics through the innovative use of an electronic referral (through the EHR) and telehealth resources. The intervention consists of counseling, physical therapy (PT), and brief consultation sessions delivered via telehealth. After a remote/virtual connection is made between a referred patient and a pain teleconsultant, an explanation of the study will be provided to the patient. If the patient is eligible and interested, oral consent will be obtained. The IRB approved the study team’s request for a waiver of documentation of consent, so signatures of the participants were not required. Oral consent was documented in REDCap.

Broad Consent

The revised Common Rule includes a new pathway for obtaining broad consent for the use of identifiable information or identifiable biospecimens. We include this for completeness but note that the actual use of broad consent is rare in pragmatic research and indeed generally. 45 CFR §46.116(d).

Opt-In/Opt-Out

Opt-in is best understood in relation to opt-out. The basic difference is that opt-in requires an active choice or action on the part of someone to be enrolled or participate in the activity in question, whereas opt-out does not. With opt-out, individuals who do nothing are by default enrolled in the study. For example, an opt-in approach could require individuals to (say) check a box to be included in a research activity, with only people who check the box being included; whereas an opt-out approach would require individuals to check a box if they do not want to be included, with everyone who does not check the box being included by default.

It is controversial whether opt-out models of consent involve genuine consent. Because opt-out (like opt-in) approaches can in principle involve disclosing all the required elements of consent, in theory the only thing that differs between opt-in and opt-out approaches may be the action one takes to enroll in a study—say, checking a box for opt-in, declining to check a box for opt-out. However, empirical research suggests this difference in how the choice is framed influences participation rates for various activities and that opt-out approaches in particular lead to higher participation rates  (Kahneman and Tversky 1979; Johnson and Goldstein 2003). This is likely due at least in part to a tendency for individuals to overlook or ignore the choice, and relevant information with it, resulting in enrollment by default on opt-out approaches, rather than because one has made a reasoned or careful choice about whether to participate. Because of this, when opt-out approaches are used in the regulatory context, they will typically demand an alteration or full waiver of consent, in addition to a waiver of documentation.  Note that if opt-out is an option, there must be a mechanism for tracking those who opt out such that their data are not collected.

Opt-in, by contrast, can qualify as a form of full research informed consent, depending on how it is used. Opt-in has been used within healthcare privacy regulations (like HIPAA, codified under 45 CFR Part 164) where individuals must opt-in to allow their health information to be shared for research purposes. When opt-in is used for a PCT and includes all the regulatory elements of consent, it does not require a waiver or alteration (discussed in more detail in Section 3). Prospective participants are asked (either in writing or orally) if they would like to participate in a research trial, and are included if they say “yes” (a.k.a. opt-in). Further, if checking the box or opting-in is accompanied by a requirement for a signature, opt-in need not involve a waiver of documentation of consent, either.

• Opt-in is sometimes used in studies with a consent form or a script that does not provide all the required elements. In these cases, it is approvable only when it meets the conditions for waiver/alteration.
• When opt-in involves a checkbox or some other mechanism rather than a documented signature, the study must be minimal risk and meet the other criteria for waiver of documented informed consent.
• In addition, it should be stressed that inclusion in the study REQUIRES checking the box or other mechanism; if a potential participant does not actively check the box or opt-in (e.g., if you do nothing), then they are not enrolled.

Case Example: PPACT Opt In

The goal of the Collaborative Care for Chronic Pain in Primary Care/Pain Program for Active Coping and Training (PPACT) trial was to coordinate and integrate services for helping patients adopt self-management skills for managing chronic pain, limit use of opioid medications, and identify exacerbating factors amenable to treatment that are feasible and sustainable within the primary care setting (Debar et al. 2012; DeBar et al. 2022). Prospective participants were sent a letter explaining the program and indicating that someone from the PPACT team may call to explain more about the program. The letter provided a phone number to call if the individual would prefer no further contact with the investigative team, i.e., to opt out. When the PPACT team member subsequently contacted a potential participant and discussed the program, the individual was given the opportunity to opt in, which was recorded in the EHR.

Case Example: STOP CRC and Opt Out

The Strategies and Opportunities to Stop Colorectal Cancer in Priority Populations (STOP CRC) trial was designed to improve rates of colorectal cancer screening among the predominantly minority and low-income patients who receive healthcare services through Federally Qualified Health Centers (FQHCs; Coronado et al 2014, Coronado et al 2018). Prospective participants were identified in the EHR as being aged 50 to 74 years old and not up-to-date with colorectal cancer screening guidelines. Investigators sent these individuals an Introduction Letter explaining the program and provided an option to opt out of the mailed program by contacting the FQHC (Coronado et al 2014). The letter said: “If you have had a colonoscopy in the past 9 years or prefer that we not mail you a test, please contact us at xxx-xxx-xxxx.” Patients who did not opt out subsequently received a fecal immunochemical test (FIT) kit in the mail with a letter and a set of wordless instructions with pictograms of each step. Participants who did not opt out were also reminded by postcard or phone to complete their tests.

Documenting Informed Consent

To document informed consent, the subject or the subject's legally authorized representative can sign and date a written consent form approved by the IRB. A copy of the signed and dated consent form must be given to the person signing the form, and the investigator must also keep a copy. Of note, electronic consent is now also acceptable and being used increasingly for remotely conducted research (De Sutter et al 2020; Skelton et al 2020). The Office for Human Research Protections (OHRP) and the Food and Drug Administration (FDA) published a Guidance for Institutional Review Boards, Investigators, and Sponsors on the use of electronic consent.

Of note, the IRB can approve a waiver of documentation if there is a potential for harm from breach of confidentiality when the consent is the only record linking the subject to the research; the research is no more than minimal risk and does not include any procedure that normally requires written consent; or if a subject’s cultural norm does not include signing forms – and the research is no more than minimal risk and there is another mechanism for documenting that consent was obtained (Common Rule Section 46.117(c)).

FDA Requirements

FDA regulations cover clinical investigations regulated by the FDA, which include clinical research that supports applications for FDA approval of a regulated product (e.g., drug, biologic, device). FDA requirements for the protection of human subjects differ only slightly from the Common. Rule. Section § 50.25 describes the elements of informed consent for FDA research.  Efforts to harmonize the Common Rule and FDA regulations are currently underway.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (Pub.L.104-191) is distinct from the Common Rule and FDA regulations but is often implicated in research. Oversight of HIPAA for research is usually conducted by an IRB but can also be conducted by a Privacy Board.

HIPAA allows covered entities and their business associates to release protected health information (PHI) for research in certain controlled situations. The default is to obtain written permission, called authorization, from an individual when protected health information is being used or disclosed for research. The required elements of authorization include some additional details not required by the Common Rule or FDA regulations. These include:

• Description of the PHI to be used or disclosed and for what purpose
• The person authorized to make the disclosure
• The person to whom the disclosure will be made
• An expiration date

HIPAA authorization can be a stand-alone document or the required elements can be included in the informed consent form.

A waiver or an alteration of authorization for research purposes is allowed if specific criteria are met (McGraw et al 2015). These criteria overlap with those of the Common Rule and include a few more stringent requirements as noted below:

• The disclosure of PHI must present minimal risk to the privacy of the individual
• The research activities could not be conducted without the requested PHI
• The research could not practicably be conducted without the waiver.

HIPAA does allow use of a limited dataset, which has certain identifiers (such as name and address) removed or masked, without authorization, waiver, or alteration of authorization. Researchers should work with the IRB and their institution regarding how HIPAA requirements will be met. A full description of HIPAA can be found in the Gaining Permission to Use Real-World Data section of the Acquiring Real-World Data chapter of the Living Textbook.