Waivers and Alterations under OHRP, FDA and HIPAA

Generally, an individual’s consent to participate in a research study must be a free choice, informed by knowledge of the risks, potential benefits, and alternatives to research participation, and of other “elements of consent” relevant to decision-making. The participant’s consent is documented by signature on an Informed Consent Document (ICD). The participant receives a copy of the ICD reiterating the information provided.

When applicable (most often), IRBMED consent documents include a HIPAA authorization explaining how and why Protected Health Information (PHI) is used or disclosed in the study. For these, a signed and dated copy must be provided to the participant (45 CFR 164.508(c)(4)), and included in the medical record if the participant is a Michigan Medicine patient (Mich Med Policy 01-04-310; usually by scanning ICD into MiChart).

An IRB may

• approve an altered consent document, modifying or omitting some of the elements of information provided to participants (usually for research involving deception or concealment),

  or

• waive the requirement to obtain informed consent altogether,

only if the IRB finds and documents that:

1. the research^a involves no more than minimal risk to the participants;
2. the research could not practicably^b be carried out without the waiver or alteration;
3. the research could not practicably be carried out without access to the private information or biospecimens in an identifiable format;^c
4. the waiver or alteration will not adversely affect the rights and welfare of the participants;

   and

5. whenever appropriate, the participants (including their physicians, as applicable) are provided with additional pertinent information after participation.

^a IRBMED interprets this to refer to the research procedures that will be conducted under the alteration/waiver of consent. It is permissible for greater than minimal risk research, for which documented informed consent is obtained, to have a subset of procedures covered under consent alteration/waiver.

^b Federal regulations do not define the word practicably.  Black’s Law Dictionary, on which courts sometimes rely in interpreting legislative or administrative agency intent, defines the term as: “reasonably capable of being accomplished; feasible.” An advisory group to HHS emphasizes the criterion is “that it is impracticable to perform the research, and not just impracticable to obtain consent.”

^c FDA guidance does not mention this criterion; however, it is required of all consent waiver requests to IRBMED.

Waiver or alteration of parental permission for child participants follows the same criteria as above; waiver of assent by child participants is separate (45 CFR 46.408). See Assent of Children in Research.

When a research study intends a use or disclosure of HIPAA Protected Health Information (PHI) without a signed HIPAA authorization from the participant, the IRB must document that the waiver/alteration satisfies HIPAA requirements. These mirror points (1), (2), and (3) above, except that HIPAA specifies regarding minimal risk (point (1)):

Any use or disclosure of PHI in connection with the research project involves no more than a minimal risk to the privacy of individuals, as demonstrated by the following: 

1. there is an adequate plan to protect any identifiers from improper use or disclosure (e.g., they are kept in a locked cabinet only available to the researchers, or they are maintained in a password-protected database and only the researchers have access to the password);
2. there is an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining the identifiers, or retention is otherwise required by law (e.g., there is a plan to break any links to identifiable information, unless the links need to be maintained, in which case a reason should be given);

   and

3. there are adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of PHI would be permitted by HIPAA (e.g., “the information will not be used or disclosed for any purpose other than this specific research project”);

In non-FDA regulated research, an IRB may require the process of consent but waive the requirement for the investigator to obtain a signed consent document (45 CFR 46.117(c)) only if the IRB finds and documents that:

1. The only record linking the participant and the research would be the consent document and the principal risk would be potential harm resulting from a breach of confidentiality (in this case, each subject must be asked whether the subject wants documentation linking the subject with the research, and the subject’s wishes must govern); or
2. The research involves no procedures for which written consent is normally required outside of the research context (no more than minimal risk research only); or
3. Participants are members of a distinct cultural group or community in which signing forms is not the norm, the research presents no more than minimal risk of harm to participants, and there is an appropriate alternative mechanism for documenting that informed consent was obtained (no more than minimal risk research only).

Point (2), the most commonly used, is also applicable to FDA-regulated research (21 CFR 56.109(c)).

When the consent documentation requirement is waived, the IRB may require the investigator to provide the participant with a written statement concerning the research, which often has the same content as an informed consent document that would be signed.

A waiver of documentation of consent does not affect applicable requirements for HIPAA authorization.

Electronic processes and systems, or other long-distance communication methods like mail and telephone, often make it possible for a study team to conduct a fully compliant informed consent process with documented consent (signature) from participants in cases where the study team and participants may not meet face-to-face. See IRBMED guidance Informed Consent Procedures Using Electronic Systems and Remote Use of Paper Documents.