Consent requirements and methods for data procurement can differ substantially depending on the type of data collected or used in a digital PCT. Research studies funded by the federal government that collect, use, or share health-related data where individuals can be readily identified are subject to the Common Rule and require consent from participants or an IRB-approved waiver of informed consent if:

• The research involves no more than minimal risk to the subjects;
• The research could not practicably be carried out without the requested waiver or alteration;
• If the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format;
• The waiver or alteration will not adversely affect the rights and welfare of the subjects; and
• Whenever appropriate, the subjects or legally authorized representatives will be provided with additional pertinent information after participation.

For further discussion see the Waivers and Alterations section of the Consent, Waivers of Consent, and Regulatory Notification chapter.

These allowances result in variable consent requirements for the same data used for AI/ML-enabled projects. Some data used for AI/ML projects stem from digital PCTs where participants fully consented to the primary research as well as other future uses. Other data are generated from low-risk PCTs that receive an IRB waiver of informed consent and do not obtain participant consent.  Of note, some studies conducted with a waiver of informed consent include notification about the study, the effectiveness of which is determined by the type of notification used. But the end result is when a waiver of informed consent is used, patients may misunderstand that their data have been used to train AI/ML systems, or receive a general notice that their data has been used in research when registering with the hospital for clinical care.

Investigator tip: To the extent feasible, investigators could adopt creative notification strategies for patients to learn about what AI/ML research and development activities are taking place at PCT sites where the research has an IRB waiver of consent. Investigators could also encourage transparency about data usage at the hospital or institutional level (see examples in Mechanisms of Notification).