Overview
A growing number of researchers are either conducting research at a distance (e.g., by telephone; over the internet) or are moving to an entirely computer-based approach where all data and correspondence are collected and stored electronically. This guidance is designed to clarify the various approaches available to obtain and document consent to participate in a research study and HIPAA authorization for research access and use of medical records from a covered entity.
Minimal Risk Research
According to the federal regulations [45 CFR 46.117(c)(2)], the IRB may waive the requirement for the investigator to obtain a signed consent if it finds that:
a. the research presents no more than minimal risk of harm AND
b. involves no procedures for which written consent is normally required outside of the research context.
(Note: Signed consent cannot be waived if the study involves procedures like a blood draw or which requires a HIPAA authorization.)
Otherwise, investigators conducting minimal risk research may request from the IRB a waiver of the requirement for signed consent, but must describe how they will (a) inform subjects about the study and (b) document their agreement to participate. Ordinarily, a consent script or form that includes all required elements of informed consent must be included with the IRB application; subjects must also be provided a copy of the script or an information sheet that describes the study and their rights as a research subject.
In this situation, an ‘electronic signature’ is not required but investigators using an interactive computer-based system may want to document the person’s agreement by having them click a button (“I agree”). (Note: this mechanism is NOT applicable to HIPAA authorization requests.)
Greater than Minimal Risk Research and/or HIPAA Authorizations
Electronic signatures may be used for documenting consent and for HIPAA authorizations, but they must meet the following standards, according to Pennsylvania’s adoption of the Uniform Electronic Transactions Act (UETA):
An “electronic signature” is an electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record (73 PS 2260.103). This should be:
- Unique to the signer
- Capable of being verified
- Under the signer’s sole control
- Linked to the record in a way that it can be determined if anything in the document was changed after the signature was applied
- Created by a reliable method for the purpose in which the signature was used
In lieu of a traditional written signature (e.g., on paper, or with a stylus on an electronic touch pad), researchers may collect the following information which taken together, constitute an electronic signature:
- Subject’s full name
- Subject’s birthdate
- Subject’s answer to one of the following verifiable questions (note: either all three may be available as in a drop-down list, or only a single question need be presented)
- Mother’s maiden name
- Subject’s place of birth
- Name of subject’s high school
Subjects should be provided with the opportunity to receive a copy of this consent form. There is no requirement that the document be hand-signed.
The use of an electronic signature in the consent process must be described in the IRB application. Subjects must also be provided the opportunity to discuss the research with a member of the research team (by phone, email, text message, or other procedure) prior to providing electronic consent to participate.
Investigators will also need to describe in their IRB application how this information will be encrypted and secured. The process of protecting participant data must meet all Lehigh data security requirements (see: Guidance: Data Security).
One option for collecting digital signatures at Lehigh is DocuSign. Researchers can incorporate DocuSign electronic signatures in their approved consent forms. For more information on using DocuSign, please see DocuSign at Lehigh: Getting Started.
The IRB provides templates for the standard and short-form consent forms; these templates contain all of the required elements of informed consent and should be adapted by researchers for use in their study.
Please contact the Research Integrity office with any specific questions concerning the documentation of electronic informed consent.
(This guidance was adapted with permission from the University of Pittsburgh “Electronic Signatures” guidance.)
Additional Resources
Pennsylvania: Electronic Transactions Act (1999)
Lehigh IRB: Informed Consent Templates
Required and Additional Elements of Informed Consent
Guidance: Assessing Risk Level Using Magnitude of Harm
DocuSign at Lehigh: Getting Started
DocuSign Digital Signatures FAQ
Example: Statement of Electronic Consent
I have read the above information. I have had the opportunity to ask questions and have my questions answered. I consent to participate in the study by clicking the “I agree to participate” box and by completing the fields below.
You may print this page to save a copy of this consent form for your records.
▒ I agree to participate.
Full Name: ▒▒▒▒▒▒▒▒▒▒
Birthdate: ▒▒▒▒▒▒ (mm/dd/year)
Answer to ONE of the following three questions:
• What is your mother’s maiden name?
• In what city were you born?
• What high school did you attend?
Example: Statement of Electronic Consent and HIPAA Authorization
I have read the above information. I have had the opportunity to ask questions and have my questions answered. I consent to participate in the study and to allow the use and disclosure of my medical record information for the purposes described above by clicking the “I agree to participate” box and by completing the fields below.
You may print this page to save a copy of this consent form for your records.
▒ I agree to participate.
Full Name: ▒▒▒▒▒▒▒▒▒▒
Birthdate: ▒▒▒▒▒▒ (mm/dd/year)
Answer to ONE of the following three questions:
• What is your mother’s maiden name?
• In what city were you born?
• What high school did you attend?