There are 3 primary sets of US federal regulations to protect human subjects who participate in research:

• Department of Health and Human Services (HHS) Human Subjects Research Regulations (subpart A of which is called the “Common Rule,” as well as subparts B, C and D),
• Food and Drug Administration (FDA) regulations
• Health Insurance Portability and Accountability Act (HIPAA).

Here, we focus on the Common Rule and then briefly introduce relevant features of FDA and HIPAA regulations.

Common Rule

The Common Rule includes general requirements for consent (45 CFR Part 46.116), which state that an investigator must obtain legally effective informed consent to involve a human being as a subject in research so that the prospective subject or a legally authorized representative can be given sufficient information with which to decide whether or not to participate. The definition of a human subject is an identifiable, alive person who will be treated with an intervention under study or whose identified data or specimens are used. Informed consent is required for research deemed more than minimal risk by the institutional review board (IRB). If the research poses no more than minimal risk, the IRB will determine if consent can be waived or altered, as described later in this chapter in the section Waivers and Alterations. Note that the IRB can also waive the requirement for documentation of consent, either written or electronic.

When Does It Apply?

US human subjects research regulations apply to research involving human subjects that is conducted or supported by one of the 19 federal agencies that have signed onto the Rule. Of note, the US Food and Drug Administration (FDA) is not considered a “Common Rule agency” in that it has its own human subjects regulations that slightly differ from the Common Rule. Harmonization of the FDA regulations and the Common Rule is in process (Spector-Bagdady 2021).

Consent Process

A goal of the informed consent process is to give prospective participants the opportunity to weigh the relative risks, possible benefits, and burdens of a research study before deciding whether to participate. Informed consent is obtained at the time of enrollment. During the course of the research, consent may have to be reaffirmed or, if the research significantly changes, a new consent may be required. It is also important to note that a subject can withdraw their consent at any point in the research; however, they might not be able to withdraw their data that has already been collected.

If informed consent is required, the form and process must be approved by the IRB. The form contains the information a participant needs to know to make an informed decision about participation. It should be written in plain language and the information should be presented in a way that is easy to understand. The consent form is only one part  of the process of obtaining consent. Researchers must also describe how they plan to present/discuss the research to potential participants and answer any questions that may arise. While much attention is given to the form, it has been found that the conversation actually is more important for prospective participant comprehension (Beskow and Weinfurt 2019). After all questions have been answered, if a person elects to participate and signs the form, the investigator must document that consent was given and store this documentation for any future potential audit.

Basic Elements of Informed Consent (Including Key Information)

The informed consent form should begin with "key information"—a concise and focused summary of the main reasons why a person might or might not want to participate in the research.

The Common Rule describes required elements that must be included in the informed consent as well as additional elements that should be considered as appropriate. The following is a list of the required elements (see 21 CFR 50.25):

• A statement that the study involves research, an explanation of the purposes of the research and how long the subject’s participation is needed, as well as a description of what will happen and a description of any experimental procedures
• A description of any (reasonably foreseeable) risks or discomforts for the subject
• A description of any benefits to the subject (or others)
• Information about any appropriate alternative treatment that might be advantageous
• Information about confidentiality
• For research involving more than minimal risk, information about compensation and/or medical treatments
• Information about contact information concerning questions, rights, and/or injuries related to the research
• A statement that participation is voluntary and may be refused or discontinued at any time
• A statement about any research involving the collection of identifiable private information or biospecimens—that if identifiers are removed, the information or biospecimens could be used for future research studies, or a statement that it will not. (Department of Heath & Human Services 2018)

Example from a NIH Collaboratory Trial

• TSOS Consent Form

Short Form

A short form may be used stating that the elements of informed consent as required by §46.116 were presented orally. The short form must be reviewed and approved by the IRB. Although this consent document is shorter, the consent process itself may be longer (McKinney et al 2015). A typical example of when a short form may be used is when a researcher encounters a non-English speaking participant. According to §46.117, the requirements for using a short form include:

• A witness to the oral presentation
• An IRB-approved written summary of what is to be said to the participant (or representative)
• Signatures, as follows:
  • Short form to be signed by participant (or representative) and witness
  • Copy of the summary to be signed by witness and person actually obtaining consent

The BeatPain Utah NIH Collaboratory Trial is using a short form with oral consent process, as approved by its IRB.

Broad Consent

The revised Common Rule includes a new pathway for obtaining broad consent for the use of identifiable information or identifiable biospecimens. We include this for completeness, but note that the actual use  of broad consent is rare in pragmatic research

Documenting Informed Consent

To document informed consent, the subject or the subject's legally authorized representative can sign and date a written consent form approved by the IRB. A copy of the signed and dated consent form must be given to the person signing the form, and the investigator must also keep a copy. Of note, electronic consent is now also acceptable and being used increasingly for remotely conducted research (De Sutter et al 2020; Skelton et al 2020). The Office for Human Research Protections (OHRP) and the Food and Drug Administration (FDA) published a Guidance for Institutional Review Boards, Investigators, and Sponsors on use of electronic consent.

Of note, the IRB can approve a waiver of documentation if: potential harm from breach of confidentiality when the consent is the only record linking the subject to the research; the research is no more than minimal risk and does not include any procedure that normally requires written consent or if subject’s cultural norm does not include signing forms – and the research is no more than minimal risk and there is another mechanism for documenting that consent was obtained (Common Rule Section 47.117(c)).

FDA Requirements

FDA regulations cover clinical investigations regulated by the FDA as well as clinical research that supports applications for FDA approval of a regulated product (eg, drug, biologic, device). FDA requirements for the protection of human subjects differ only slightly from the Common. Rule. Section § 50.25 describes the elements of informed consent for FDA research.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) allows covered entities and their business associates to release protected health information (PHI) for research in certain controlled situations. The default is to obtain an authorization from the patient who is contributing data, but a waiver or alteration can be approved if specified criteria are met (McGraw et al 2015). These criteria overlap with those of the Common Rule and include a few more stringent requirements. HIPAA does allow use of a limited dataset, which has certain identifiers (such as name and address) removed or masked, without authorization, waiver, or alteration of authorization.

Researchers should work with the IRB and their institution regarding how HIPAA requirements will be met. A full description of HIPAA can be found in the Gaining Permission to Use Real-World Data section of the Acquiring Real-World Data chapter of the Living Textbook.