Documenting Consent Electronically or for Remote Subjects Guidance
The purpose of this document is to provide guidance on documenting consent obtained from subjects utilizing methods other than pen and paper. Most frequently, subjects document informed consent by providing their written signature in the provided space, at the end of the consent form. This guidance describes other methods that are also sufficient documentation of informed consent.
Electronic documentation of consent may be used when researchers conduct the consent process with participants in person, as well as when potential participants are not physically present during the consent process. In either situation, the consent process itself should be designed to ensure that participants are adequately informed about the research, can easily ask and get answers to questions, and recognize that participation is voluntary.
Version Date: September 21, 2017
Federal regulations allow electronic signatures to document informed consent (see Joint Guidance on Use of Electronic Informed Consent). The revised Common Rule [implemented January 2019] also includes language that clarifies, “informed consent shall be documented by the use of a written informed consent form approved by the IRB and signed (including in an electronic format) by the subject…”
Subjects must be provided with a version of the consent form that they can retain for their records, whether it is a hard copy or an electronic version.
When the IRB reviews the study, it will consider how the electronic signature is being created, whether the signature can be shown to be legitimate, and how the research team plans to provide a version of the consent form to the potential subject for their review and retention.
Per the US Office of Human Research Protections (OHRP): “One method of allowable electronic signatures in some jurisdictions is the use of a secure system for electronic or digital signature that provides an encrypted identifiable ‘signature.’ If properly obtained, an electronic signature can be considered an ‘original’ for the purposes of recordkeeping.” In other words, it would satisfy requirements in case of an audit.
Faxing Copies of Signed Consent Forms
It is permissible for subjects to fax a signed copy of the consent form to the research team. If there are questions and/or check boxes embedded throughout the document for the subject to complete, the research team should check to ensure that these pages are included. Good Clinical Practice (GCP) or other guidelines may require that the study team receive a complete copy of the signed consent form. In cases where subjects are faxing a consent form to the research team, the subject need not provide the investigator with the original signed consent document.
Emailing Copies of Signed Consent Forms
Email is a convenient method of communication, and subjects may request to send or receive copies of documents through email. If the consent form or information sheet would reveal information about the potential subject’s health (e.g., “You have been invited to participate in this study because you have [disease/condition],”), then the subject should not email it to the study team unless you get their prior permission to communicate with each other through email for research purposes. Getting this permission requires making sure subjects are aware of the risks associated with sending health information via email. Please see our guidance regarding the use of email for research purposes for a more comprehensive discussion of these requirements.
For web-based surveys or questionnaires, the consent form may be presented online, and require participants to perform some action, such as clicking “I agree,” before proceeding with any research activities (e.g., answering survey questions on a website). This is an acceptable approach for low-risk research conducted online. However, be aware that this method does not document informed consent and therefore may only be used if the IRB has waived documentation of consent for the study. Other issues to address when using online consent:
- For research that poses more than minimal risk, the research team should consider how they will be able to evaluate a subject’s understanding of the procedures and risks related to their participation. Tools to evaluate this understanding could include a comprehension quiz requiring a score of 100% in order to proceed, or the provision of contact information of a member(s) of the study team, in order to enable direct communication for subjects who have questions or concerns, among other options.
- When research involves minors, research teams will have to take the Children’s Online Privacy and Protection Act (COPPA) into account. This law mandates parental permission in order to collect identifiable information about minors under the age of 13. The IRB application should describe how the research team will ensure compliance with COPPA. For example, the research team could first obtain parental permission in a telephone call.
Confirming Identities in Online Research
A study’s data validity or reliability could be fallible without verifying subjects’ identities. Examples include when there are critical eligibility criteria, or when there is a likelihood of repeat or fraudulent participation, whether for mischief or to collect multiple payments. When designing a research study, investigators should take into consideration the importance of identity to their study.
Studies that pose more than minimal risk, or that involve the transmission of sensitive information, may consider implementing a process by which they confirm identities using authentication that relies upon multiple factors, for example a password that is delivered to subjects by telephone or by postal service, or by using identity verification software.
For FDA-regulated studies, if any or all of the consent process takes place remotely and is not personally witnessed by study personnel, the electronic system must include a method of identity verification. Acceptable examples include state-issued ID, biometric methods, visual methods, or personal questions.
Completing the Consent and Authorization Sections of ARROW - Alteration of Informed Consent
When research teams interact with potential subjects face-to-face, they retain some control in the consent process in terms of describing research procedures, stopping to solicit information from subjects, and also observing whether potential subjects become inattentive. When making consent information available online, where the potential subject will read the information alone, researchers may wish to focus on the elements of consent most relevant to their type of study. If the research team wants to omit any of the required elements of consent (e.g., including a phone number for whom to contact with questions about research subjects’ rights), then an alteration of informed consent must be requested from the IRB.
Electronic Documentation of Consent vs. Waiving Documentation of Informed Consent
It is important to understand the difference between using methods other than paper and pencil to document informed consent, and waiving the requirement to document informed consent altogether.
When providing consent online, there are a number of ways in which an e-signature might be documented. Some examples include:
All constitute “signatures.” A waiver of documentation of informed consent is not required for these procedures.
When a consent procedure will not include a written signature, it requires a waiver of documentation of informed consent. Common examples include online consent where participants are directed to begin a survey after reading an information sheet, or eligibility screening performed over the telephone with a potential subject. In these cases, the research team must request a waiver of documentation of informed consent from the IRB. More information about requesting this waiver, as well as the requirements of both the Common Rule as well as the FDA, can be found at Oral Consent/Waiver of Consent Documentation.
- Attaching a scanned handwritten signature or using an e-signature service such as Adobe’s EchoSign;
- Typing one’s name with an accompanying check box and statement noting an intent to affix a legal signature (e.g., “By checking this box and typing my name below, I am electronically signing this consent form”); or
- Signing with a stylus in an electronic document.
Oral Consent Facilitated by Technology
When consent is obtained via audio/video real-time communication, using applications such as Skype or Facetime, the requirements are the same as if a research team were obtaining oral consent when face-to-face with a study subject. The study team must request a waiver of documentation of informed consent. More information about requesting this waiver, as well as the requirements of both the Common Rule as well as the FDA, can be found at Oral Consent/Waiver of Consent Documentation.
HIPAA and Electronic Consent
Where the HIPAA Privacy Rule applies, the Rule allows a HIPAA authorization for research to be obtained and signed electronically, provided any electronic signature is valid under applicable law. Therefore, an alteration of HIPAA would not be required when electronically documenting a subject’s signature.
As with consent, however, obtaining consent without a signature (e.g., click an OK box or providing oral consent via Skype) would require an alteration of HIPAA.