The AHRQ Informed Consent and Authorization Toolkit for Minimal Risk Research

Chapter 3. Regulatory Requirements

The AHRQ Informed Consent and Authorization Toolkit for Minimal Risk Research

Informed Consent

A successful informed consent process must involve disclosure of the following topics in language that is understandable to the potential subject (45 CFR 46.116), unless an institutional review boards (IRB) has appropriately waived or approved an alteration in one or more of these requirements:

  • The fact that the study involves research.
  • The purposes of the research.
  • The expected duration of subject participation.
  • What will happen during the study (i.e., the procedures to be followed).
  • Which procedures are experimental.
  • Any reasonably foreseeable risks or discomforts (e.g., pain, anxiety from answering questions about sensitive topics).
  • Any benefits to subjects or to society that may reasonably be expected.
  • Any alternative procedures or courses of treatment that might be advantageous to the subjects.
  • How the confidentiality of records identifying subjects will be maintained.
  • Whom to contact to answer questions about the research and subjects' rights.
  • Whom to contact in the event of a research-related injury.
  • The fact that participation is voluntary, refusal to participate will not compromise subjects' current access to health care (or employment status, if relevant) or result in any other penalty or loss of benefits to which the subject is otherwise entitled, and that subjects may end their involvement in the research project at any time without penalty or loss of benefits to which they are otherwise entitled.

If the IRB determines that a research study involves more than minimal risk, informed consent also must involve disclosure of whether any medical treatments or compensation are available if subjects are harmed and, if so, what they consist of, or where further information may be obtained.

In addition, when appropriate, subjects must be informed about the following (45 CFR 46.116):

  • Risks that are currently unforeseeable.
  • Circumstances under which participation may be terminated by the investigator.
  • Any additional costs to the subject that may result.
  • Consequences of withdrawal from the research and procedures for termination.
  • The plan to provide subjects with significant new findings that develop during the course of the research that may influence subjects' willingness to continue participation.
  • The approximate number of subjects involved in the study.

Health Insurance Portability and Accountability Act (HIPAA) Authorization

A successful authorization process will result in subjects understanding the following (45 CFR 164.508(c)):

  • What protected health information will be used and/or shared.
  • From whom the protected health information will be obtained.
  • Who will use or have access to the protected health information.
  • With whom the protected health information will be shared.
  • The purpose of the use and/or sharing of the protected health information.
  • How long the protected health information will be used and/or shared.
  • The ability of subjects to revoke their authorization and how they can do so.
  • The limits on the subjects' ability to revoke their authorization (for example, information may still be used or disclosed as necessary to protect the integrity of the research study).
  • Any consequences of refusing to sign the authorization.
  • The fact that the Privacy Rule may not protect health information that has been disclosed.

Regulatory Exceptions

Waiver of Documentation of Informed Consent

In some research settings, obtaining consent is required but does not need to be documented. To do this, an IRB must formally grant a waiver of the requirement for the investigator to obtain a signed consent form for some or all subjects of documentation for consent (45 CFR 46.117). This does not decrease any obligation to obtain the subject's informed consent but does mean that the subject is not required to sign a written informed consent document.

A waiver of the usual requirements for documentation of informed consent requires that either:

(A) The only record linking the subject to the research would be the informed consent document, and the principal risk would be potential harm resulting from a breach of confidentiality; Each subject will be asked whether the subject wants documentation linking the subject with the research, and the subject's wishes will govern;
(B) The research involves no more than minimal risk of harm to subjects and involves no procedures for which written consent would be required outside of the research setting.

In cases in which the documentation requirement is waived, the IRB may require the investigator to provide subjects with a written statement regarding the research.

Waiver or Alteration of Informed Consent

An IRB can waive the requirement to obtain informed consent if it finds and documents the following:

  • The research involves no more than minimal risk to the subjects.
  • The waiver will not adversely affect the rights and welfare of the subjects.
  • The research could not practicably be carried out without the waiver.
  • Whenever appropriate, the subjects will be provided with additional pertinent information after participation.

Waiver or Alteration of HIPAA Authorization

The requirement for a covered entity to obtain HIPAA authorization in order to use or disclose protected health information for research can be waived or altered by an IRB or Privacy Board in the following circumstances:

  • The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least:
    • An adequate plan to protect identifiers from improper use or disclosure.
    • An adequate plan to destroy the identifiers at the earliest opportunity, consistent with the needs of the research study, the subjects' health, and applicable law.
    • Adequate written assurances from the researchers that the protected health information will not be reused or disclosed except as required by law, for authorized oversight of the research study, or for other research where the reuse or disclosure would be permitted by HIPAA.
  • The research could not practicably be conducted without the waiver or alteration.
  • The research could not practicably be conducted without access to protected health information.
Page last reviewed November 2015
Page originally created September 2012
Internet Citation: Chapter 3. Regulatory Requirements. Content last reviewed November 2015. Agency for Healthcare Research and Quality, Rockville, MD.
Back To Top