Informed Consent

When most people hear the phrase “informed consent,” they think of the
legal document that explains the study and contains the required dated
signatures. However, informed consent is first and foremost a continuing
process. This includes a person voluntarily agreeing to participate in a
research study after being fully informed about it via verbal discussion
with study staff, followed by documentation in a written, signed, and dated
informed consent form. A participant’s consent will be continually sought
during the course of the study, and the participant will be notified of any
changes to the study, along with any other pertinent information that may
influence their decision to remain in the study.

While documentation of informed consent is required in most clinical

studies, there are occasions when a waiver or alteration of written
informed consent is obtained from the Institutional Review Board (IRB) for
some or all study participants. The fundamental criteria for waivers and
alterations of informed consent are located in 45 CFR 46.116(c) and 45
CFR 46.116(d). Please consult the local IRB for determining when it is
appropriate to waive the requirement for written consent.

The informed consent document should contain all of the information that
the person needs to make an informed decision about taking part in the
study. Many research teams use the consent document to guide the
verbal explanation of the study to potential participants.

The participant must sign and date the informed consent document
before taking part in any study procedures. Signing the consent form is
NOT the final step in the informed consent process. The participant may
withdraw consent and decline to participate in the study at any time
before or after signing the consent document until their participation in the
study is completed.

The general requirements for informed consent in federally funded

research are spelled out in 45 CFR 46.116 and 21 CFR 50.20. Some
states have enacted requirements for informed consent that go beyond
federal regulations. This module reviews the requirements for informed
consent that are set out in federal regulations and in the Good Clinical
Practice guidelines of the International Council for Harmonization (ICH
GCP 4.8.10). It is the principal investigator’s responsibility to know and
abide by any additional state requirements.

All researchers must ensure that the process of obtaining informed

consent from study participants not only conforms to federal, state, and
local regulations but also respects each individual’s right to make a
voluntary, informed decision.

Part 2 of this module deals with the informed consent document. Part 4
deals with the informed consent process.
(ICH GCP 4.8.10)

Both the informed consent discussion and the written informed consent form and any other
written information to be provided to participants should include explanations of the
following:

1. That the trial involves research.

2. The purpose of the trial.
3. The trial treatment(s) and the probability for random assignment to each treatment.
4. The trial procedures to be followed, including all invasive procedures.
5. The participant’s responsibilities.
6. Those aspects of the trial that are experimental.
7. The reasonably foreseeable risks or inconveniences to the participant and, when
applicable, to an embryo, fetus, or nursing infant.
8. The reasonably expected benefits. When there is no intended clinical benefit to the
participant, the participant should be made aware of this.
9. The alternative procedure(s) or course(s) of treatment that may be available to the
participant, and their important potential benefits and risks.
10. The compensation and/or treatment available to the participant in the event of trial-
related injury.
11. The anticipated prorated payment, if any, to the participant for participating in the
trial.
12. The anticipated expenses, if any, to the participant for participating in the trial.
13. That the participant’s participation in the trial is voluntary and that the participant
may refuse to participate or withdraw from the trial, at any time, without penalty or
loss of benefits to which the participant is otherwise entitled.
14. That the monitor(s), the auditor(s), the IRB, and the regulatory authority(ies) will be
granted direct access to the participant’s original medical records for verification of
clinical trial procedures and/or data, without violating the confidentiality of the
participant, to the extent permitted by the applicable laws and regulations and that,
by signing a written informed consent form, the participant or the participant’s
legally acceptable representative is authorizing such access.
15. That records identifying the participant will be kept confidential and, to the extent
permitted by the applicable laws and/or regulations, will not be made publicly
available. If the results of the trial are published, the participant’s identity will
remain confidential.
 16. That the participant or the participant’s legally acceptable representative will be
informed in a timely manner if information becomes available that may be relevant
to the participant’s willingness to continue participation in the trial.
17. The person(s) to contact for further information regarding the trial and the rights of
trial participants, and whom to contact in the event of trial-related injury.
18. The foreseeable circumstances and/or reasons under which the participant’s
participation in the trial may be terminated.
19. The expected duration of the participant’s participation in the trial.
20. The approximate number of participants involved in the trial.

The consent document must state (ICH GCP 4.8.10):

 That the trial involves research.

 The purpose of the trial.
The consent document must state (ICH GCP 4.8.10):

 The trial treatment(s) and the probability for random assignment to

each treatment (if a randomized clinical trial).
 The trial procedures to be followed, including all invasive
procedures.
 The participant’s responsibilities.
 Those aspects of the trial that are experimental.
 The expected duration of the participant’s involvement in the trial.
 The reasonably foreseeable risks or inconveniences to the
participant and, when applicable, to an embryo, fetus, or nursing
infant.
 The reasonably expected benefits. When there is no intended
clinical benefit to the participant, the participant should be made
aware of this.
 The alternative procedure(s) or course(s) of treatment that may be
available to the participant, and their important potential benefits
and risks.
Points to note: IRBs often want the informed consent document to list
other therapies available for the condition under treatment in addition to
other treatment options at the facility where the study is being conducted.

 The compensation and/or treatment available to the participant in

the event of trial-related injury.
  The anticipated expenses, if any, to the participant for participating
in the trial.
Points to note: When research involves more than minimal risk to the
participant, the consent document must describe the treatment and
compensation that will be provided in the event that a participant sustains
a research-related injury. The language in the consent cannot appear to
limit the participant’s rights in seeking damages related to injury in a trial.

Federal regulations do not limit the definition of “injury” to a physical

injury. An injury may be psychological, social, financial, or of another
nature.

 The anticipated prorated payment, if any, to the participant for

participating in the trial.
Points to note: Payment to participants for their participation in a
research study must never be coercive in either amount or method of
distribution.

 That the participant’s participation in the trial is voluntary and that

the participant may refuse to participate or withdraw from the trial,
at any time, without penalty or loss of benefits to which the
participant is otherwise entitled.
 The foreseeable circumstances and/or reasons under which the
participant’s participation in the trial may be terminated.
 That the monitor(s), the auditor(s), the IRB, and the regulatory
authority(ies) will be granted direct access to the participant’s
original medical records for verification of clinical trial procedures
and/or data, without violating the confidentiality of the participant, to
the extent permitted by the applicable laws and regulations and
that, by signing a written informed consent form, the participant or
the participant’s legal representative is authorizing such access.
 That records identifying the participant will be kept confidential and,
to the extent permitted by the applicable laws and/or regulations,
will not be made publicly available. If the results of the trial are
published, the participant’s identity will remain confidential.
Points to note: Certificates of Confidentiality are issued by the National
Institutes of Health (NIH) to prevent investigators from having to release
(e.g., via a subpoena) names or other identifying information about
research participants.

Certificates of Confidentiality provide additional protection for participants

who are enrolled in studies in which information is being collected that, if
disclosed, could have adverse consequences for participants or could
damage their financial standing, employability, insurability, or reputation.

See related material from the Confidentiality and Privacy module for a

summary of confidentiality requirements in research involving human
participants.

 That the participant or the participant’s legally acceptable

representative will be informed in a timely manner if information
becomes available that may be relevant to the participant’s
willingness to continue participation in the trial.
 The person(s) to contact for further information regarding the trial
and the rights of trial participants in the event of trial-related injury.
 The expected duration of the participant's participation in the trial.
 The approximate number of participants involved in the trial.
Points to note: A consent form should be written in non-technical
language that participants would understand. Also, it should be written in
language consistent with the participants educational level, cultural views,
and familiarity with research.

The consent document should include the following:

 State that the study involves research.

 Briefly explain the purpose of the research, the reason(s) why the
person is being invited to participate, and the expected duration of
the person’s participation in the study.
 Describe the procedures or interventions to be carried out,
identifying which procedures are investigational and which might be
provided as standard care in another setting.
 Explain the use of research methods such as randomization and
placebo controls.
 Describe any foreseeable risks or discomforts to the participant.
Estimate how likely it is that these risks and discomforts will occur.
 Describe the steps that will be taken to prevent or minimize risks or
discomforts to the participant.
 Acknowledge that participation in the study may pose unknown and
unforeseeable risks.
 Describe any benefits to the participant or to others that the
research may reasonably be expected to produce. Estimate how
likely it is that these benefits will occur.
 Disclose any appropriate alternative procedures or courses of
treatment that may benefit the participant.
 Describe the extent to which records will be kept confidential and
provide examples of people or organizations that may have access
to research records (e.g., hospital personnel, study sponsors, staff
of the U.S. Food and Drug Administration).
 For research that involves more than minimal risk, explain and
describe any compensation and any medical treatments that are
available if participants are injured as a result of participation in the
study, where further information can be obtained, and who should
be contacted in the event of a research-related injury.
 Explain who should be contacted for answers to questions about
the research and the participant’s rights (including the name and
phone number of the principal investigator).
 State that participation in the study is voluntary and that declining to
participate or deciding to withdraw at any time will involve no
penalty or loss of benefits to which the participant is otherwise
entitled.
 State that the participant’s signature will indicate that he or she has
decided to participate in the study, having read and discussed the
information presented to him or her about the research.
 Provide any other information that prospective participants might
need to make an informed decision about whether or not to
participate in the research study, such as any recently obtained
information about the investigational drug’s toxicity in animals.
Special Requirements Concerning the Consent of Pregnant Women

When a research activity involves pregnant women as participants:

 Both mother and father must be informed about any potential

impact of the research on the fetus.
 Both mother and father must consent to the woman’s participation
in the research. However, the father’s consent is not required in the
following circumstances:
o The purpose of the research is to meet the health needs of
the mother.
o The father’s identity or whereabouts cannot be determined.
o The father is not reasonably available.
o The pregnancy resulted from rape.
 If either parent is unable to consent because of availability,
incompetence, or temporary incapacity, the informed consent of
one parent will suffice provided the criteria in the previous bullet
points are not met.
 Consent of a legally acceptable representative of either or both
parents does not suffice for informed consent.
Additional protections for pregnant women involved as participants in
research are set forth in 45 CFR 46 Subpart B.

Special Requirements Concerning the Consent of Children

The CFR defines children as:

“...persons who have not attained the legal age for consent to treatments or
procedures involved in the research, under the applicable law of the
jurisdiction in which the research will be conducted.” (45 CFR 46.402)
The legal age for consent in most states is 18; persons under age 18 are
considered minors. However, in some jurisdictions, persons under age 18
can consent to treatment for substance abuse or dependence.

Additional protections for children and minors involved as participants in

research are set forth in 45 CFR 46 Subpart D.
When children or minors are involved in research, both the assent of the
child or minor and the permission of his or her parent(s) are usually
required.

Permission means the agreement of parent(s) or a legal guardian to the

participation of their child or ward in research.

Assent means a child’s agreement to participate in research. Failure to

object is not assent.

In most cases, both parents must give their permission for their child or
minor’s participation in research. However, exceptions to this
requirement are permitted in certain circumstances. An exception is also
permitted in the case of an emancipated minor.

Although children may be legally incapable of giving informed consent,

they may nevertheless be able to assent to or dissent from participation in
research.

Out of respect for children as developing persons, children should be

asked whether or not they wish to participate in the research, particularly
if:

 The research does not involve interventions that are likely to benefit
the participants, and
 The child can understand what it means to be a volunteer for the
benefit of others.
A child’s assent should be sought when the child is capable of providing
such assent, taking into account his or her age, maturity, and
psychological state. The age that a child needs to attain to give assent
varies from state to state. In certain circumstances, the IRB may
determine that research can proceed without the assent of the children
involved.

Special Requirements Concerning the Consent of Prisoners

Because of their incarceration, prisoners may be under constraints that

potentially affect their ability to make a truly voluntary decision about
whether or not to participate in a study.
45 CFR 46.303 defines a prisoner as:

“Any individual involuntarily confined or detained in a penal institution. The

term is intended to encompass individuals sentenced to such an institution
under a criminal or civil statute, individuals detained in other facilities by
virtue of statutes or commitment procedures which provide alternatives to
criminal prosecution or incarceration in a penal institution, and individuals
detained pending arraignment, trial, or sentencing.”
Additional safeguards for the protection of prisoners involved in research
(set forth in 45 CFR 46 Subpart C) include the following:

 The IRB must approve the study as prisoner research.

 The IRB that reviews and approves the study must include a
prisoner or prisoner advocate in its membership.
 A majority of the IRB members (exclusive of prisoner members)
must have no association with the prison(s) involved in the
research, apart from their membership on the IRB.
 The study must present no more than minimal risk to the
participants.
 The proposed research must involve the study of:
o The possible causes, effects, and processes of incarceration
and criminal behavior.
o Prisons as institutional structures or prisoners as incarcerated
persons.
o Conditions that particularly affect prisoners (e.g., vaccine
trials; research on hepatitis, which is more prevalent in
prisons than elsewhere; research on social and psychological
problems such as alcoholism, drug addiction and sexual
assault).
o Practices intended to improve the health or well-being of the
participants.

Part 4
To be valid, informed consent must be based on the following:
Capacity to Give Informed Consent

Before the informed consent process can begin, the potential participant
must be deemed capable of understanding his or her actions and making
a reasoned decision. If the person lacks capacity because he or she is a
minor, is ill, or for any other reason, special provisions must apply (such
as a life-threatening emergency), or the person may not be included in
the study.

A person who has a court-appointed legal guardian or who has been

determined by a court to be legally incompetent cannot sign an Informed
Consent Form even if he or she has the capacity to make a decision. This
determination is made by the legal system and not by clinicians.

Disclosure of all Relevant Information

The research team must disclose all relevant information about the study
to the potential participant. The information disclosed must be sufficient to
enable the potential participant to make an informed reasoned decision
about whether to participate. This information generally includes:

 The purpose of the study.

 The nature of the procedure or intervention that is being studied.
 Reasonable alternatives to participation in the study.
 The potential risks and benefits as well as the uncertainties of study
participation.
 The participants obligations for the duration of the study.

Comprehension by the Participant

The potential participant must understand the information disclosed to

him or her about the research study. The participant is free to ask
questions to the study team as well as take additional time to make a
decision regarding participation. The research team must be able to
evaluate the potential participant’s ability to understand what his or her
participation in the study would involve. The informed consent document
might include a quiz or other documented assessment to assess whether
the participant truly understands the study.
Voluntary Agreement by the Participant

The participant must agree to participate in the research study and his or
her agreement must be voluntary and free from coercion or undue
influence.

Right to Withdraw

The participant must be informed that he or she has a right to withdraw

from the study at any time and for any reason, without penalty or loss of
benefits that he or she would otherwise be entitled to receive.

If a participant wishes to withdraw from a study in which an experimental

drug is being tested, he or she must be informed of any procedures that
are recommended to ensure safe withdrawal from the study drug. The
participant must also be advised of any consequences of withdrawal,
such as the inability to continue taking the study medication. No further
data will be collected on the participant, but the participant will be
informed that data already collected can be used for study analysis.

The research team or principal investigator may terminate participation in

a study if it is in the best interest of the participant.

Inviting Potential Participants to Enroll in a Research

Study
Written documentation of Institutional Review Board approval of the
study, consent document(s) and recruitment materials (where
appropriate) must be obtained and provided to the sponsor. NIDA and the
CTN Lead Investigator must give their approval before recruitment can
begin at a study site.

Members of the research team may find it helpful to keep the following
questions in mind as they go through the process of recruiting participants
for a study:

Is the participant capable of understanding information about the study

and giving informed consent voluntarily?
Adults have the capacity to consent when they possess sufficient mental
capability to:

 Understand information given to them.

 Appreciate the relevance of the information to their circumstances.
 Make a reasoned decision about whether or not to participate in a
particular study.
Capacity to consent may be affected by several factors, including:

 Age.
 Cognitive (mental) impairment.
 Illness.
 Treatments.
Capacity to consent is study-specific. A person may have sufficient
capacity to carry out daily activities and make personal decisions, but he
or she may not have sufficient capacity to appreciate the relevance of a
given research study to his or her circumstances. On the other hand, a
person may be incapacitated in daily activities but still have the capacity
to consent to study participation.

For some participants or groups of participants, the investigator or the

IRB may decide to obtain an independent capacity assessment. This may
involve consulting a psychiatrist or neurologist for a determination of an
individual’s cognitive ability and ability to understand the details and
implications of a study protocol.

If a person is unable to provide informed consent, a legal representative

may give permission for the individual to participate in research in some
circumstances. A legal representative may be:

 A parent (for minors only).

 A legal guardian, as determined by state law, who can make health
care decisions for a person who is unable to consent.
 An individual who holds a valid durable power of attorney for health
care. Because of variability in legal opinions about the authority of
the holder of a durable power of attorney for health care, the
investigator should clarify whether institutional and IRB policies
 permit the holder of a durable power of attorney for health care to
give informed consent for participation in research on behalf of a
study participant.

 Has the participant been given sufficient, accurate information about
the study?

To be informed means to have thorough knowledge of a matter. To be

able to give informed consent, participants must have sufficient, accurate
information about a study. This means that participants should be able to
answer the following questions:

 What is the purpose of the research?

 Does the study involve an experimental treatment or procedure?
 Does the study involve random assignment to one treatment or
another?
 What must I do as a study participant?
 What are the anticipated risks and benefits of participation in the
study?
 What alternative treatments or procedures are available?
 Will participants in the study receive any compensation?
 Will I have any expenses for participating in the study?
 How long will my participation in the study last?
 Will my study records be kept confidential?
 Will I be informed in a timely manner about any issues that might
affect my willingness to continue taking part in the study?
 Who is in charge of the study?
 Will I receive treatment whether I participate in the study or not?
 May I withdraw from the study at any time if I change my mind and
no longer wish to take part?
To ensure that a participant has been given sufficient, accurate
information about a study, a member of the research team should:
  Talk with the participant about the study’s purpose and
requirements.
 Provide fliers or brochures that describe the study or provide
general information about clinical research, if available.
 Invite the participant to ask questions and respond to questions
asked by the participant.
 Give the participant plenty of time to read the informed consent
document and ask questions about it.
 Give the participant a copy of the informed consent document to
take home and read before signing it. Additionally, give the
participant a copy of the consent form after he or she has signed it.
 Invite the participant to call with questions later and provide the
names and phone numbers of people to call.
Potential study participants may have difficulty focusing for an extended
period of time for various reasons. For example, in some study
populations (e.g., substance use disorders), such difficulty could be
related to co-occurring illness, chronic pain, or withdrawal from substance
use. Information must be presented in a language they can understand,
at a pace they can keep up with, and in a manner that invites questions.

Sometimes information about a study may be presented to a group of

potential participants. In this situation, it is important to meet with
participants individually, ensuring that each person has the opportunity to
ask questions in private.

Does the participant understand the information he or she has been

given about the study?

The research team must be satisfied that the participant understands

what he or she has been told about the study. Participants who are in
withdrawal, depressed, manic, or otherwise psychiatrically or cognitively
impaired may not be able to give informed consent.

The best way to be sure that the participant understands the information
he or she has been given about the study is to review the consent
document with the participant, line-by-line. Then, ask the participant
questions about the study to ascertain what information he or she has
absorbed.

It may be helpful to prepare a quiz to test the participant’s understanding

of the study. Such a quiz would have to be prepared in advance and
submitted to the IRB for review and approval along with the other consent
documents.

There are instances when it is challenging to assess that participants

understand the information they have been given. Consider the following
conditions.

A Participant has Limited Speaking Ability in

English
45 CFR 46.116 requires that:

“the information given to the participant or the representative shall be in

language understandable to the participant or the representative.” In
practice, most IRBs require the informed consent document to be translated
for potential participants who have limited or no understanding of spoken
English. Researchers must follow the procedure approved by the IRB for
obtaining consent from these participants.
It is also important to be aware of specific language differences that may
be confusing to participants who are not fluent in English. For example, in
Spanish, the word “once” means the number 11. An instruction to “take
this medication once daily” might be confusing to a Spanish-speaking
participant.

A Participant has Limited Reading Ability

45 CFR 46.117 states:

“[the consent] form may be read to the participant or the participant’s legally
authorized representative, but in any event, the investigator shall give either
the participant or the representative adequate opportunity to read it before it
is signed.” The participant may take the consent home and return at a later
date with a decision.
Both 45 CFR 46.117 and ICH E6 GCP 4.8.9 state that if a participant is
unable to read, a witness must be present throughout the informed
consent discussion and must sign the consent form(s).
Is the participant’s decision to participate in the study entirely voluntary or has he
or she been coerced or influenced in any way (e.g., by 
circumstances or by other people)?

Coercion occurs if an individual perceives that he or she could be harmed

or punished for refusing to take part in a study, or if he or she feels
compelled due to financial circumstances.

Historically, individuals in relationships of dependence or unequal power

have been particularly vulnerable to coercion. Coercion occurred in the
1960s at Willowbrook State School when some parents could not admit
their child to the school unless they agreed to the child’s participation in
studies in which children were deliberately infected with hepatitis.

Blatant coercion such as this, as well as coercive financial incentive, is

rare today because of the vigilance of research teams and IRBs.
However, in some cases, coercion may occur subtly and unintentionally.
This kind of coercion can be more difficult to detect.

Does the participant understand that signing the informed consent

document indicates agreement to participate in the study?

In most cases, the dated signature of the participant, or his or her legally
authorized representative, on the informed consent document indicates
that the participant understands the study and is willing to participate.
Signing the informed consent document should be the final step in the
informed consent process.

A member of the research team must sign the consent form to confirm
that:

 To the best of the team member’s knowledge, the participant has

understood the information given to him or her about the study and
is volunteering without coercion.
  The informed consent process followed the procedures authorized
by the local IRB.
ICH GCP requires that the person conducting the informed consent
discussion sign the form.

The participant should be given a copy of the signed consent document.

The original must be kept on file in the research offices per local IRB
guidelines.

Quality Control in the Informed Consent Process 

The Participant Signs the Informed Consent Form After Study
Procedures Have Begun

How did this happen?

Some studies may involve clients as they come into the clinic. An eager
staff member sees that the person who usually conducts consent
interviews is busy and tries to help by having the client “just fill out some
forms” while waiting.

Another staff member later assumes, without checking and without seeing
the completed forms, that the participant has already completed the
informed consent documentation and proceeds to enroll the person into
the study.

How can this error be prevented?

 Never assume anything. Always check that a participant’s informed
consent documentation is complete before beginning a study
procedure.
 Never perform any study assessments on potential participants
before informed consent has been obtained.
Corrective Action: Review the study and the consent form with the
participant as soon as the failure is identified. Document all steps to
correct the situation, attach them to the signed Informed Consent Form
and notify your supervisor as soon as possible.
The Consent Form is Signed by the Participant But is Missing the
Initials or Signature of the Investigator or Witness (if Applicable), or is
Not Dated

How did this happen?

The investigator may have become distracted. Perhaps the phone rang or
another client needed attention. Perhaps the participant asked a question
about another aspect of the study and the investigator turned the page,
forgetting to sign or initial the form as required or to check that the
participant has written the date on the form next to his or her signature.

It is important to remember that the principal investigator (PI) is

accountable for the informed consent process. While the PI may delegate
the task of reviewing or discussing informed consent to another research
staff member, such as the research coordinator or clinician, the PI must
provide oversight of the process and ensure that the participant is
comfortable with the discussion.

How can this error be prevented?

 Conduct consent interviews in a quiet, separate room.
 When reviewing a consent form with a participant, focus on that
task. Don’t answer the phone or respond to distractions unless
there is a genuine emergency.
 The person obtaining the participant’s consent must be present
when the consent form is signed. Having the investigator sign the
consent form later is unacceptable. Never backdate a consent form.
 Create and use a checklist to ensure that every detail in the
informed consent process is completed.

Whiteout is Used to Correct an Error on the Consent Form

How did this happen?

Failure to follow Good Clinical Practice or Good Medical Record
correction techniques is the only reason for this error. Whiteout should
never be used on any research or medical record document.
How can this error be prevented?
By following good documentation practices. If an error occurs while the
consent form is being completed, use Good Clinical Practice or Good
Medical Record correction techniques to correct it: Cross out the error
without obscuring the original entry, initial and date the crossing-out, and
enter the correct information. (See also Good Medical Record practices
to observe when writing progress notes in the Documentation and
Record-Keeping module.)

An Out-of-Date Version of the Consent Form is Used

How did this happen?

Several versions of an Informed Consent Form may be developed before
IRB approval is received. Or, if the study has been in progress for more
than 1 year, a new version of the consent form (most likely with a different
date stamp) will have been prepared. In either case, a staff member may
mistakenly pull out and use an out-of-date version of the form.

How can this error be prevented?

 Ensure that the current version of the consent form is readily
identifiable (e.g., color coded, marked with a prominent date
stamp).
 Keep copies of the current version of the consent form in a different
place than older, archived versions. Destroy copies of old, unused
consent forms and mark the old original as obsolete in the
regulatory binder.
Corrective Action: When the issue is identified reconsent the participant
using the appropriate Informed Consent Form. Attach a memo identifying
the issue and the corrective action to the new consent form.

A New Consent Form is Required, But Not All Participants Signed It

How did this happen?

 Some participants were absent from the clinic during the week
when most participants signed new consent forms. When the
absent participants returned the following week, the need for them
to sign new consent forms was overlooked.
  A staff member assumes that a colleague already had the
participant sign a new consent form.

How can this error be prevented?

 Again, never assume anything. When a new consent form is
required, check on each participant’s next clinic visit to ensure that
he or she has signed the new form.
 Devise a system for flagging the files of participants who have not
yet signed new consent forms.
 Use a tracking spreadsheet.
 Ensure documentation of consent form is in the source notes.
Corrective Action: When the issue is identified have the participant
review, sign and date the new consent form. Document the reason for the
delay and attach it to the new consent form.

The Original Consent Form Has Been Lost

How did this happen?

 A staff member may mislay a participant’s consent form among
other papers on his or her desk.
 The form may have been filed incorrectly.
 The original of the consent form may have been given to the
participant by mistake.

How can this error be prevented?

 Devise written procedures for the handling of informed consent
documentation and train all staff in the use of these procedures.
Corrective Action: Report the loss of a consent form immediately to the
IRB and/or the sponsor and get another signed as soon as possible. To
avoid the appearance of fraud, carefully document the sequence of
events that led to the loss of the first consent form.
Requirements for the Documentation of Informed
Consent 
Requirements for the documentation of informed consent are set forth
in 45 CFR 46.117, 21 CFR 50.27, and ICH GCP 4.8. In brief, these
requirements are as follows.

Informed Consent Shall be Documented by the Use of a Written

Consent Form

 The IRB must approve the consent form.

 The participant or the participant’s legally authorized representative
must sign the current version of the IRB approved consent form.
 ICH GCP requires that the consent form should also be signed by
the person conducting the informed consent discussion.
 A copy of the form must be given to the person who signs it. The
study site must keep the original on file.

The Consent Form May Take One of Two Organizational Structures

 A written document that embodies the elements of informed

consent required by 45 CFR 46.116. This form may be read to the
participant or the participant’s representative. The investigator
should give the participant or representative ample time to absorb
the content of the form before signing it.
 A short-form written document stating that the elements of informed
consent were presented orally to the participant or the participant’s
representative. When the short form document is used:
o A witness must be present at the oral presentation.
o The IRB must approve a written summary of what is to be
said to the participant or representative.
o The participant or representative must sign only the short
form itself.
o The witness must sign both the short form and a copy of the
summary.
 o The person obtaining the participant’s consent must also sign
a copy of the summary.
o A copy of the summary, in addition to a copy of the short
form, must be given to the participant or the participant’s
representative.

Researchers Must Not Waive or Appear to Waive Any Legal Rights of

Participants

For example, care must be taken when describing what compensation

(beyond the provision of immediate or therapeutic intervention) the
institution is voluntarily willing to provide in an event such as a research-
related injury.

Participants should understand that, regardless of what the institution

may agree to provide as compensation for a research-related injury, they
retain the right to take legal action against the institution and/or those
responsible for the injury.

The Consent Form Must be Revised When New Information Becomes

Available that May Be Relevant to the Participant’s Consent

If a new adverse event appears to be related to the study medication

(e.g., a severe allergic reaction that occurs shortly after a medication is
given), this risk should be added to a revised consent form.

 The revised consent form must be approved by the IRB.

 The participant must be informed of the new information in a timely
manner.
 The communication of the new information to the participant must
be documented.

Other considerations for the Informed Consent Process

The investigator must document the informed consent process in the

participants’ source notes. When new information becomes available
which results in a revised informed consent form, the participant must be
informed in a timely manner and the communication of this information
must be documented in the source notes.
In obtaining and documenting the informed consent, the investigator
should comply with ethical principles that have their origin in the
Declaration of Helsinki, ICH GCP, CFR and applicable regulatory
requirements.

Non-therapeutic trials should be conducted in subjects who are capable

of personally giving consent and signing and dating the consent form.
(ICH GCP 4.8.13)

Non-therapeutic trials may be conducted with consent from a legal

representative if the following conditions are met:

 The objectives of the trial cannot be met by a participant that can

personally give consent.
 The foreseeable risks to the participants are low.
 Any negative impact on the participants’ well-being is minimized.
 The trial is not prohibited by law.
 The approval of the IRB is expressly sought on the inclusion of
such participants and is documented in a written approval letter.
These type of non-therapeutic trials should be conducted in patients
having a disease or condition for which the investigational product is
intended and they should be closely monitored.

Further Information

 45 CFR 46.116
 21 CFR 50.20
 ICH E6 GCP 4.8 — ICH GCP Guidelines
 45 CFR 46 Subpart B — Research Involving Pregnant Women
 45 CFR 46.408 — Research Involving Children
 45 CFR 46.303 — Research Involving Prisoners

Summary of Key Points 

 Informed consent is a process by which a person voluntarily agrees
to participate in a research study after being fully informed about it.
 The informed consent document should contain all of the
information that the participant needs to make an informed decision
about participating in the study.
 The participant’s signature on the informed consent document
confirms his or her voluntary agreement to take part in the study.
 The general requirements for informed consent in federally funded
research are spelled out in 45 CFR 46.116 and 21 CFR 50.20.
Some states have enacted requirements for informed consent that
go beyond federal regulations.
 All researchers have a responsibility to ensure that the process of
obtaining informed consent or assent from study participants not
only conforms to federal, state, and local regulations but also
respects each individual’s right to make an informed decision
voluntarily.
 The first step in the process of informed consent is preparing the
consent document and supporting documents for presentation to
the Institutional Review Board that must review and approve the
study and consent document. The IRB must review and approve
the consent document before the study can begin.
 Consent documents should be written in nontechnical language that
the proposed participants would understand. The language should
be consistent with the proposed participants’ educational level,
cultural views, and familiarity with research.
 The information that must be provided in an informed consent
document is specified in 45 CFR 46.116, 21 CFR 50.20, and ICH
GCP 4.8.10.
 The legal age for consent in most states is 18; persons under age
18 are considered minors. Additional protections for children
involved as participants in research are set forth in 45 CFR 46
Subpart D. In most cases, both parents must provide permission
and the child himself or herself must assent to the child’s
participation in research.
 If a person is unable to provide informed consent, a legal
representative may give permission for the individual to participate
in research in some circumstances. Only one person gives consent.
If the participant is capable and is not court ordered legally
incompetent, then he or she should sign. If the participant is not
 capable or is legally incompetent, then the legal representative or
guardian should sign. A child and the parents sign, but minor
children assent, parents provide permission, and legal guardians
consent.
 Participants must not be coerced or unduly influenced. Coercion
occurs if an individual perceives that he or she could be harmed or
punished for refusing to take part in a study. In some cases,
coercion may occur subtly and unintentionally.
 The value of an incentive for participation in a study should not be
so high that it could be considered an undue influence on an
individual’s decision to participate.
 It is important to ensure that the process of obtaining informed
consent from human participants is carried out carefully and with
vigilant attention to every detail. Failure to comply with general
requirements for informed consent (45 CFR 46.116) and
documentation of informed consent (45 CFR 46.117) may result in
suspension of a study as well as fines and penalties.

-------------------------------------------------
Confidentiality & Privacy
Federal regulations require that research records identifying the
participant be kept confidential to the extent permitted by applicable laws
and regulations. For example, if the results of a clinical study are
published, participants’ identities must remain confidential ( 45 CFR 46 ;
ICH GCP 4.8.10(o)).

Federal law also protects the confidentiality of individually identifiable

health information for all research participants. Other federal laws and
regulations protect the records and identity of vulnerable populations as
well as study participants receiving alcohol and drug abuse treatment.

This module summarizes federal laws and regulations that protect the
confidentiality and privacy of study participants.

In addition to federal laws and regulations, many states have enacted

their own laws and regulations to protect the confidentiality and privacy of
individuals receiving health care. Researchers must be familiar with the
confidentiality and privacy provisions that apply in the state where their
studies are conducted.

What records must be kept confidential?

45 CFR 46 provides protections for the confidentiality of research

participants as follows:

 Subpart A – Basic protections of human research participants

 Subpart B – Additional protections for research participants that are
pregnant women, fetuses, neonates
 Subpart C – Additional protections for participants that are
prisoners involved biomedical and behavioral research
 Subpart D – Additional protections for research participants that are
children
In addition to 45 CFR 46, the Health Insurance Portability and
Accountability Act (HIPAA) mandates privacy protections for individually
identifiable health information under 45 CFR 160 and 164. In general,
whether research related or not, all records of the identity, diagnosis,
prognosis, or treatment of any person in a clinical trial must be
maintained. This includes any record in connection with alcohol or drug
abuse prevention, education, training, treatment, rehabilitation, or
research must be kept confidential. “Identity” includes not only the
participant’s name but also any other information that could be readily
linked to the participant. Additionally, applicable information may be in
any form (e.g., paper, electronic, verbal). The HIPAA Security Rule, also
under 45 CFR 160 and 164, establishes standards to protect individuals’
electronic personal health information.

For example, clinical research staff may not disclose that a participant is
enrolled in an HIV study. This type of disclosure would be in violation of
the participant’s confidentiality and can make things difficult for the
participant given the stigma associated with the disease in certain
communities.

With certain exceptions, an alcohol or drug abuse treatment program may

not disclose to anyone outside the program that a particular person
attends the program, or disclose any information that identifies a person
as an alcohol or drug abuser, unless:

 the person consents to the disclosure in writing, or

 the disclosure is allowed by a court order and the study or research
site is not operating under a Certificate of Confidentiality (see Part 5
of this module for the provisions and exceptions of Certificates of
Confidentiality).
A breach of confidentiality is usually defined as any disclosure of
protected information about a participant to a third party without either a
court order or consent of the participant. The breach of confidentiality may
be oral or written and may occur by telephone, fax, or electronic means
(e.g., electronic mail or other internet-based method of communication).

Federal regulations identify certain exceptions to the confidentiality

requirements for alcohol and drug abuse participant records. Consider the
following circumstances for disclosure:

“Need to Know” (42 CFR 2.12(c)(3))

Information in a participant's medical record can be disclosed to people

within a health program, or between a health program and an entity
having direct administrative control over that health program, as they may
need this information to perform duties related to the participant's
diagnosis and treatment. For example, a physician at the research site
may provide participant information for the purpose of referral for
treatment of alcohol or drug abuse to another health entity within the site
or program.

Criminal Activity (42 CFR 2.12(c)(5))

Information in a participant's medical record can be disclosed to law

enforcement officers when the participant has committed or threatened to
commit a crime on program premises or against program staff.

The information disclosed must be limited to the circumstances of the

incident, including the participant's:

 Participant status.
 Name and address.
  Last known whereabouts.

Suspected Child Abuse or Neglect (42 CFR 2.12(c)(6))

Information in a participant's medical record can be disclosed when it is

necessary to report suspected child abuse or neglect to state or local
authorities. However, original participant records may not be used in civil
or criminal proceedings that arise from the report.

Armed Forces and Veterans Administration (42 CFR 2.2(e))

The confidentiality regulations do not apply to the exchange of information

regarding suspected child abuse and neglect within the Armed Forces or
between the Armed Forces health care facilities operated by the U.S.
Veterans Administration (VA). The regulations do not apply to the
reporting of child abuse or neglect under State law.

In addition, disclosure of confidential information without a participant's

consent is permitted in the situations described below ( 42 CFR 2.51 ).

Medical Emergencies (42 CFR 2.51(a))

Confidential information about a participant may be given to medical

personnel in a medical emergency for the purpose of treating a condition
that poses an immediate threat to the health of any person and requires
immediate medical intervention.

Research Activities (42 CFR 2.52)

Confidential information about a participant may be disclosed for research

purposes, provided that the recipient of the information:

 Is qualified to conduct the research.

 Has a research protocol that ensures the information will be kept
secure and will not be re-disclosed except to the source from which
it was obtained.
 Will not identify any individual participant in any report of the
research.
In addition, a group of at least three independent persons must review the
protocol to ensure that:
  The rights and welfare of participants will be adequately protected.
 The risks of disclosing information about participants are
outweighed by the potential benefits of the research.

Audit and Evaluation Activities (42 CFR 2.53)

Confidential information about a participant may be disclosed for

management audits, financial audits, or program evaluation activities
provided that the information:

 Is not re-disclosed except to the source from which it was obtained.

 Is used only to carry out an audit or evaluation purpose or to
investigate or prosecute criminal or other activity as authorized by a
court order.

Danger to Self (42 CFR 2.51; 45 CFR 164.512(j)(4))

If a participant speaks of an intention to kill himself or herself, the

participant must be evaluated by a qualified mental health professional. If
the participant is found to be at risk for suicide, confidential information
may be disclosed to ensure his or her safety. Specifically, it may be
necessary to admit the participant to a hospital or to notify an emergency
response team.

A member of the research team who suspects a participant is in danger of

harming himself or herself should notify a supervisor, qualified counselor,
or physician.

Danger to Others (42 CFR 2.51; 45 CFR 164.512(j)(4))

If a participant speaks of an intention to harm another person, he or she

must be evaluated by a qualified mental health professional. If the threat
is considered credible, a report must be made both to the police (42 CFR
2.12(c)(5)) and to the identified target. A member of the research team
who suspects a participant is in danger of harming another person should
notify a supervisor, qualified counselor, or physician.
Communicable Diseases

Confidential information about a participant may be disclosed when the

participant has a disease that poses a risk to public health. All states
require that cases of selected communicable diseases be reported to
local health authorities. Since 1999, certain infectious diseases have also
been designated as notifiable to the National Notifiable Diseases
Surveillance System (NNDSS) of the U.S. Centers for Disease Control
and Prevention. However, state reporting to the NNDSS is voluntary. All
states generally report the internationally quarantinable diseases (e.g.,
cholera, plague, yellow fever) in compliance with the World Health
Organization's International Health Regulations.

State, local, or institutional policies may also require that communicable

diseases be reported to other agencies. Researchers should contact their
state health departments to obtain current and complete information
about communicable disease reporting requirements in individual states.

Court Order

Disclosure of confidential information about a participant may be

authorized by a court order if the disclosure is:

 Necessary to protect against a threat to life or a threat of serious

bodily injury (e.g., child abuse, neglect, and threats against third
parties) (42 CFR 2.63(a)(1)).
 Necessary to the investigation or prosecution of a serious crime
(e.g., homicide, rape, kidnapping, armed robbery, and assault with
a deadly weapon) (42 CFR 2.63(a)(2)).
 Relevant to a legal or administrative proceeding in which the
participant offers evidence that pertains to the confidential
disclosure (42 CFR 2.63(a)(3)).
A court order alone does not compel disclosure of confidential
information. A subpoena or other legal mandate must be issued to
compel disclosure.

Requirements of State Law

States may determine additional exceptions to the requirements for

confidentiality of alcohol and drug abuse participant records. In some
states, health care providers must report suspected domestic violence to
authorities. Members of the research team should be familiar with their
state's laws and regulations. Copies of relevant state laws should be on
file at each study site.

When the research is protected by a Certificate of

Confidentiality (CoC), research participants must be informed of the
conditions that the certificate does not prevent disclosure. The CoC
conditions for disclosure are not all inclusive of the circumstances
mentioned above. (See Part 5 of this module for more information
on Certificates of Confidentiality.

Maintaining the Security of Written Records

When not in use, written records covered by the confidentiality regulations

must be kept in a secure room, a locked file cabinet, a safe, or other
secure place. Each program must adopt written procedures to control
access to and use of these records.

What happens to participant records when a program is discontinued?

If a research site discontinues operation or is acquired by another

program, there are certain medical record responsibilities that must be
followed regarding the clinical records. Each site Principal Investigator
must be aware of the procedures and retention period requirements for
medical and study related records established by the sponsor and
regulatory entities with oversight authority. For example, in the Clinical
Trials Network, when a program is discontinued, the sponsor requires the
program director to notify NIDA immediately to discuss the retention of
any essential source documents created during the clinical study from
which study data were obtained. Additionally, these documents must be
kept at the study site, at the site, or by the sponsor, for a period defined
by the sponsor.

Medical Record Responsibilities

The program must purge participant-identifying information from its

records or destroy the records unless:
  The subject of the records gives written consent to transfer of the
records to the acquiring program or to any other designated
program.
 The law requires that the records be kept for a specified period.
Retained records must be sealed in envelopes or other containers and:

 Sealed in envelopes or other containers.

 In accordance with 42 CFR 2.19(b)(1), labeled as follows:
“Records of [insert name of program] required to be maintained under
[insert citation to statute, regulation, court order, or other legal
authority requiring that records be kept] until a date not later than
[insert appropriate date].”
 Held by a responsible person who must destroy the records as
soon as is practicable at the end of the specified retention period.

Recommended Routine Practices for Maintaining the Confidentiality of

Research Participants

Researchers ordinarily use information that study participants have

disclosed or provided voluntarily (i.e., with their informed consent) for
research purposes. Because the relationship between researcher and
study participant is based on trust, it is most important to ensure that the
confidentiality of this information is maintained.

The following routine practices are recommended to ensure the

confidentiality of research participants:

 Substitute codes for information that identifies the participant (e.g.,

use numbers instead of names to identify participants).
 Remove face sheets that contain identifiers, such as names and
addresses.
 Properly dispose of all paper documents that contain identifiers.
 Limit access to all data that identifies participants.
 Educate research staff on the importance of maintaining
confidentiality.
  Store paper records in locked cabinets.
 Assign security codes to computerized records.

What is a Certificate of Confidentiality?

A Certificate of Confidentiality provides an additional level of protection

for the privacy of participants in biomedical, behavioral, and clinical
research studies.

Certificates of Confidentiality may be granted for studies collecting

information that, if disclosed, could have adverse consequences for study
participants or damage their financial standing, employability, insurability,
or reputation. By protecting researchers and institutions from being
compelled to disclose information that would identify research subjects,
Certificates of Confidentiality help achieve the research objectives and
promote participation in studies by assuring confidentiality and privacy to
participants. For more information review the NIH Certificate of
Confidentiality Kiosk.

Key Points about Certificates of Confidentiality

 A Certificate of Confidentiality is not transferable from one

researcher to another.
 Every Certificate of Confidentiality has an expiration date. If the
research project covered by the certificate will not be completed by
the expiration date, the researcher must submit a written request for
an extension well in advance of the expiration date.
 The Certificate of Confidentiality must be amended if significant
changes occur in the research project (e.g., changes in key
personnel, major changes in the scope or direction of the research
protocol, changes in the drugs administered or the persons
administering them). Amendment of the certificate must be
requested in writing, giving details of the changes, before the
changes are implemented.
 For a multi-site trial, one Certificate of Confidentiality (CoC) may be
required for all sites. However, each study investigator may contact
the CoC coordinator with the agency issuing the certificate.
Applying for a Certificate of Confidentiality

Certificates of Confidentiality are granted by the Department of Health

and Human Services (DHHS). (Click here for more information and
instructions about applying to NIDA for a Certificate of Confidentiality.)

Additional Information Required

The following additional information is required in the application for a

Certificate of Confidentiality for any research project involving the
administration of investigational product:

 Identification of the drugs to be administered; description of the

methods of administration, including dosages.
 Evidence that the persons administering the drugs are authorized to
do so.
 For controlled drugs, a copy of the research project's Drug
Enforcement Administration (DEA) registration form.

What Participants Should Know About a Certificate of Confidentiality

Participants must be told that a research project has been granted a

Certificate of Confidentiality. They must be informed that:

 Except under certain conditions, researchers may not be

compelled to identify research participants in any civil, criminal,
administrative, legislative, or other proceeding.
 The certificate is not transferable.
 The certificate has an expiration date.
 The certificate must be amended if major changes occur in the
research project.

What is the HIPAA Privacy Rule?

he U.S. Congress passed the Health Insurance Portability and
Accountability Act (HIPAA) (Public Law 104-191) in 1996 to improve the
efficiency and effectiveness of the health care system. The law includes
provisions requiring the Department of Health and Human Services
(DHHS) to adopt national standards for electronic health care
transactions. Congress recognized that the introduction of advances in
electronic technology into the health care system could erode the privacy
of health information. Consequently, Congress incorporated into HIPAA
provisions that mandated the adoption of federal privacy protections for
individually identifiable health information under 45 CFR 160 and 164.

DHHS issued the HIPAA Privacy Rule — also known as the Standards for
Privacy of Individually Identifiable Health Information — to put into
operation these privacy protections. It establishes for the first time a set of
national standards for the protection of certain health information. The
Privacy Rule became effective on April 14, 2003. It is enforced by the
DHHS Office of Civil Rights.

This section provides a brief overview of the main provisions of the

HIPAA Privacy Rule. For additional information, go to HIPAA Privacy
Rule and Its Impact on Research, a website created to inform the
research community about the Privacy Rule.

To whom does the HIPAA Privacy Rule apply?

The HIPAA Privacy Rule applies to covered entities. A covered entity is
defined as.

 A health plan.
 A health care clearinghouse.
 A health care provider who transmits any health information
electronically in connection with transactions such as claims,
benefit eligibility inquiries, and referral authorization requests.
Providers who use a billing service or other third party to handle
such transactions are also considered covered entities.

What information is protected by the HIPAA Privacy Rule?

The HIPAA Privacy Rule protects all individually identifiable health

information that is held or transmitted by covered entities and their
business associates. The information may be in any form (e.g., paper,
electronic, verbal). The Privacy Rule calls this information protected
health information (PHI).

 Permitted Disclosures of Protected Health Information

Covered entities may use or disclose the “minimum necessary” amount of
protected health information (PHI) to or among themselves, without the
individual's authorization, for purposes of treatment, payment, and health
care operations.

The only exceptions to the “minimum necessary” requirement are for the
use and disclosure of PHI:

 To or by health care providers for treatment purposes.

 To the individual who is the subject of the protected health
information.
 To the Secretary of Health and Human Services, who has authority
for the Privacy Rule.
 Use or disclosure that is required by the law.
Additionally, covered entities may disclose PHI for certain “public policy”
purposes without the individual's authorization. However, they are
required to track these disclosures for accounting purposes.

Public Policy Purposes

The HIPAA Privacy Rule permits covered entities to use or disclose

protected health information (PHI) without the individual's authorization for
the following public policy purposes:

 When the disclosure is required by law.

 For public health activities (e.g., prevention or control of disease,
notification of adverse drug events).
 In cases of abuse, neglect, or domestic violence.
 For health care oversight activities authorized by law or regulations.
  For judicial and administrative purposes (e.g., a court order,
subpoena, or warrant).
 To a law enforcement official for law enforcement purposes.
 To a coroner, medical examiner, or funeral director when the
information concerns a deceased person.
 For cadaveric organ, eye, and tissue donation.
 For research purposes.
 To avert a serious threat to health or safety.
 For national security or intelligence activities.
 For workers' compensation purposes.

Permitted Disclosures of Protected Health Information for Research

Purposes

Research is defined as “any systematic investigation designed to develop

or contribute to generalizable knowledge.” Covered entities can disclose
protected health information (PHI) when:

Authorization is Obtained from the Participant

Under the HIPAA Privacy Rule, a research participant may authorize a
covered entity to use and disclose his or her protected health information
(PHI) for research purposes. The authorization form must be approved by
the relevant Institutional Review Board or a Privacy Board.

IRBs and Confidentiality

In accordance with the Belmont Report, IRBs must ensure adequate
provision is made to protect subjects’ privacy and maintain the
confidentiality of data.

Protection of Subjects’ Privacy.

The IRB must consider whether the research involves an invasion of
privacy. Factors to be considered include:

 The private or sensitive nature of the information sought,

  The likelihood that subjects will regard the study as an invasion of
privacy,
 The importance of the research, and
 The availability of alternative ways to conduct the study.
Confidentiality of Data
IRBs must evaluate whether adequate provisions exist to safeguard the
confidentiality of information that is collected.

Authorization for disclosures is obtained routinely from participants during

the informed consent process. The authorization may be combined with
the Informed Consent Form that a research participant signs when
agreeing to participate in a study, or the participant may sign a separate
authorization form. In either case, the authorization must include the
following:

All members of the NIDA Clinical Trials Network (CTN) must ensure that
the process of obtaining informed consent from research subjects not
only conforms to federal, state, and local regulations but also respects
each individual’s right to make a voluntary, informed decision.

 Description of the information to be disclosed.

 Identity of the person who may use or disclose the information.
 Identity of the person to whom the information will be disclosed or
by whom it will be used.
 Purpose of the use or disclosure.
 Length of time the data will be retained with identifiers.
 Expiration date of the authorization.
 A statement of the participant's right to revoke authorization.
 A statement that information disclosed in accordance with an
authorization may no longer be protected by the Privacy Rule.
 Participant's signature and date of signature.
Treatment programs do not need to keep track of disclosures that are
authorized by the participant. In other words, once a program obtains a
participant's permission to disclose his or her PHI, there is no need to
document each occasion that a disclosure is made.

Sharing a Limited Data Set

A covered entity may enter into a data use agreement to use and disclose
protected health information (PHI) that is included in a limited data set
without obtaining either authorization or a waiver of authorization. Limited
data sets may be used or disclosed only for purposes of research, public
health, or health care operations.

The following identifiers are permitted in a limited data set:

 Admission, discharge, and service dates.

 Birth date.
 Date of death.
 Age.
 Geographical subdivisions (e.g., state, county, city, precinct, zip
code).
The data use agreement must:

 Identify who is permitted to use or receive the limited data set.

 Stipulate that the recipient will:
o Not use or disclose the information other than as permitted by
the agreement or required by law.
o Use appropriate safeguards to prevent the use or disclosure
of the information except as permitted in the agreement.
o Hold any agent of the recipient (including subcontractors) to
the standards, restrictions, and conditions stated in the data
use agreement.
o Not identify the information or contact the individuals whose
information is included in the limited data set.

De-Identifying the Health Information

Covered entities may “de-identify” protected health information (PHI) by
removing all individually identifiable health information from the
record or file. Once health information has been de-identified, it is no
longer considered PHI and therefore is not subject to the HIPAA Privacy
Rule.

 Individually Identifiable Health Information

Under the HIPAA Privacy Rule, individually identifiable health information
includes the following:

1. Names.
2. All geographic subdivisions smaller than a state, including street
address, city, county, precinct, ZIP Code, and their equivalent
geographical codes, except for the initial three digits of a ZIP Code
if, according to the current publicly available data from the Bureau
of the Census:
o The geographic unit formed by combining all ZIP Codes with
the same three initial digits contains more than 20,000
people.
o The initial three digits of a ZIP Code for all such geographic
units containing 20,000 or fewer people are changed to 000.
3. All elements of dates (except year) for dates directly related to an
individual, including birth date, admission date, discharge date, date
of death; and all ages over 89 and all elements of dates (including
year) indicative of such age, except that such ages and elements
may be aggregated into a single category of age 90 or older.
4. Telephone numbers.
5. Facsimile (fax) numbers.
6. Electronic mail addresses (e-mail).
7. Social security numbers.
8. Medical record numbers.
9. Health plan beneficiary numbers.
10. Account numbers.
11. Certificate/license numbers.
12. Vehicle identifiers and serial numbers, including license plate
numbers.
 13. Device identifiers and serial numbers.
14. Web universal resource locators (URLs).
15. Internet protocol (IP) address numbers.
16. Biometric identifiers, including fingerprints and voiceprints.
17. Full-face photographic images and any comparable images.
18. Any other unique identifying number, characteristic, or code,
unless otherwise permitted by the Privacy Rule for re-identification.

Obtaining a Waiver of Authorization for Certain Research Activities

An Institutional Review Board or Privacy Board may waive, in whole or in
part, the requirement that the participant authorize the disclosure of
protected health information (PHI) if it is satisfied that:

 The use or disclosure involves no more than minimal risk to the

privacy of individuals because
o An adequate plan exists to protect health information
identifiers from improper use and disclosure and to destroy
identifiers as soon as practicable; and
o Adequate written assurances have been provided that the
PHI will not be reused or shared with any other person or
entity, except as required by law, for authorized oversight of
the research study, or for other research purposes.
 The research could not practicably be conducted without the waiver
or alteration.
 The research could not practicably be conducted without access to
and use of the PHI.

Privacy Board

A Privacy Board is a review body that may be established to act upon

requests for a waiver or an alteration of the authorization requirement
under the Privacy Rule for uses and disclosures of protected health
information (PHI) for a particular research study. A Privacy Board may
waive or alter all or part of the authorization requirements for a specified
research project or protocol. A covered entity may use and disclose PHI
without authorization, or with an altered authorization, if it receives the
proper documentation of approval of such alteration or waiver from a
Privacy Board.

For more information about Privacy Boards and the HIPAA Privacy Rule,
go to Privacy Boards and the HIPAA Privacy Rule.

Preparing a Research Protocol

Covered entities may use and disclose protected health information (PHI)
without authorization if the researcher states in writing that:

 The use or disclosure is solely for the purpose of preparing a

research protocol;
 No PHI will be removed from the covered entity's location; and
 The PHI sought is necessary for the research.

The Participant is Deceased

Covered entities may use and disclose protected health information (PHI)
without authorization if:

 The researcher states in writing that:

o The use or disclosure sought is solely for research on the PHI
of deceased persons;
o The PHI sought is necessary for the research; and
o The covered entity obtains documentation of the death of the
persons whose PHI is sought.

 HIPAA Rights, Privacy, and Enforcement 

Rights of Research Participants Under the HIPAA Privacy Rule

The Privacy Rule defines two new rights for research participants.
Right to an Accounting

Participants have a right to ask researchers for an accounting of their

protected health information (PHI) that has been obtained under a waiver
of or exception to the HIPAA Privacy Rule. An accounting of such
disclosures may be requested for the previous six years.

A researcher is not required to account for disclosures that were:

 Authorized by the participant;

 Contained in a limited data set; or
 Released as de-identified data.
Other instances where accounting is not required include for national
security or intelligence purposes, and disclosure to correctional
institutions or law enforcement officials.

Right to Revoke Authorization

Participants have the right to revoke their authorization of the use or

disclosure of their protected health information (PHI). However, the
revocation has no effect if the researcher has already made a disclosure
in accordance with the participant's original authorization.

Enforcement and Oversight of the HIPAA Privacy Rule

The DHHS Office of Civil Rights is responsible for enforcing compliance

with the HIPAA Privacy Rule and for investigating complaints about lack
of compliance. Failure to comply with the Privacy Rule may result in the
levying of civil or criminal penalties. For more information about
enforcement of the Privacy Rule, go to http://www.hhs.gov/ocr/hipaa/.

Summary of Key Points

 Federal law and regulations protect the confidentiality of participant
records. In addition, Federal law protects the confidentiality of
identifiable health information for all research participants.
 In general, all records of the identity, diagnosis, prognosis, or
treatment of any person that are maintained in connection with
 alcohol or drug abuse prevention, education, training, treatment,
rehabilitation, or research must be kept confidential.
 The regulations identify certain exceptions to the confidentiality
requirements. Information in a participant's medical record can be
disclosed:
o To people performing duties related to the participant's
diagnosis, treatment, or referral for treatment of alcohol or
drug abuse.
o To law enforcement officers when the participant has
committed, or threatened to commit, a crime on program
premises or against program staff.
o When reporting suspected child abuse or neglect to state or
local authorities.
o To medical personnel in a medical emergency.
o For research purposes, with certain conditions.
o For management audits, financial audits, or program
evaluation.
o If a participant is found to be at risk for suicide or if he or she
makes a credible threat to harm another person.
o When the participant has a communicable disease that poses
a risk to public health.
o When authorized by a court order.
o When required by state law.
 If a program discontinues operation or is acquired by another
program, there are certain medical record responsibilities that must
be followed regarding the clinical records. Each site Principal
Investigator must be aware of the procedures and retention period
requirements for medical and study related records established by
the sponsor and regulatory entities with oversight authority.
 A Certificate of Confidentiality provides an additional level of
protection for the privacy of participants involved in research
studies.
 Except under certain conditions, a researcher who has obtained a
Certificate of Confidentiality cannot be compelled to identify
 research participants in any federal, state, or local civil, criminal,
administrative, legislative, or other proceeding.
 Participants must be told that a research project has been granted
a Certificate of Confidentiality.
 The HIPAA Privacy Rule protects all individually identifiable health
information that is held or transmitted by covered entities and their
business associates. The information may be in any form (e.g.,
paper, electronic, oral). The Privacy Rule calls this information
protected health information (PHI). A covered entity may not use or
disclose PHI except as permitted or required by the Privacy Rule.
 Covered entities may use or disclose the “minimum necessary”
amount of PHI to or among themselves, without the individual's
authorization, for purposes of treatment, payment, and health care
operations.
 PHI may be disclosed for research purposes when the disclosure is
authorized by the research participant. Authorization for disclosures
is obtained routinely from participants during the informed consent
process. Treatment programs do not need to keep track of
disclosures that are authorized by the participant.
 Health information that has been de-identified by the removal of all
elements that could identify an individual is no longer considered
PHI and is not subject to the Privacy Rule.

Inherent Complexities of Client Safety and Adverse Events

Participant safety is a broad topic that cuts across all aspects of Good
Clinical Practice (GCP) as is discussed in the document the ICH
Guideline for Industry: Clinical Safety Data Management. Among
other issues, ensuring participant safety encompasses protocol design,
quality-assurance monitoring, government regulations, and ethical issues.
It may also involve the use of clinical judgment, and entail
situations/decisions on which no two clinicians may be in complete
agreement. As a result, new researchers may feel frustrated when
questions arise about participant safety.
This module focuses on ways of protecting participants’ safety and well-
being as well as how adverse events should be recorded and reported for
clinical studies.

Because of the complexity of the topic, this module cannot cover every
participant safety issue that might arise in a clinical trial. Researchers are
advised to seek further guidance as needed from the study investigator or
other knowledgeable team members. The role of investigators in
protecting the safety and well-being of research participants is discussed
further in this module.

Key Points About the Protection of Participant Safety

 The obligation to protect the well-being of study participants does

not end when a study receives Institutional Review Board (IRB) or
Data and Safety Monitoring Board (DSMB) approval, or when a
participant signs the informed consent form. The interests of study
participants must be safeguarded at all times—and by many entities
—throughout a clinical research study.
 Ultimately, no single individual or institution can provide complete
protection for trial participants. A systematic plan must be followed
for each trial to ensure that everyone involved understands and
fulfils his or her responsibilities.
 Research team members with adequate knowledge of clinical trials,
statistics, and the clinical disorder and the Investigational Product
being studied must review the study data regularly to ensure that
events are properly interpreted and reported.
 Ongoing communication among all study staff is an essential part of
ensuring participant safety.

Who is responsible for assuring the safety of study participants?

Investigator

In accordance with ICH GCP, the investigator or a sub-investigator that is

a qualified physician (or dentist, when appropriate) is responsible for all
trial-related medical decisions. The investigator must ensure that
adequate medical care is provided to a subject for any adverse events
and inform the subject when care is needed for an intercurrent illness that
the investigator becomes aware of. (ICH GCP E6(R2), 4.3)

Who is responsible for assuring the safety of participants in studies of

investigational new drugs?
In studies conducted under the Investigational New Drug (IND)
regulations, responsibility for ensuring compliance with FDA regulations
on participant safety rests with the sponsor of the IND under which the
study is conducted.

The investigator is responsible for:

"protecting the rights, safety, and welfare of study participants under the
investigator’s care."

The U.S. Food and Drug Administration (FDA) requires the investigator
to:

"promptly report to the IRB (Institutional Review Board) all

unanticipated problems involving risk to human subjects or others"

and to report to both the sponsor and the IRB:

"any serious adverse event, whether or not considered drug related and
must include an assessment of whether there is a reasonable possibility
that the drug caused the event" .

Responsibilities of Role Players in CTN

Role of the Lead Investigator

For each CTN protocol, the Lead Investigator (LI) is responsible for the

accurate documentation, investigation, and follow-up of all safety reports.
In addition, the LI must ensure that each Institutional Review Board (IRB)
involved in the study is fully informed of safety issues that may arise from
the protocol.
Role of the Site Principal Investigator
In CTN studies, the Node Principal Investigator (PI) is responsible for
assuring the safety of study participants at research sites within his or her
Node. This includes responsibility for assuring the proper monitoring of
study progress and the evaluation and reporting of adverse events at the
Node.

For any given protocol, the Node PI may delegate any of these tasks to
other appropriately qualified persons, such as the Protocol Principal
Investigator (below), affiliated with his or her Node. Such delegation of
authority should be formally designated in a delegation of responsibilities
log.

Role of the Protocol Site Principal Investigator

In CTN studies, the Protocol Principal Investigator (PI) is charged with
assuring the safety of study participants at the research sites within the
Node for which he or she is responsible.

The Site PI is also expected to be knowledgeable about the policies of all

local IRBs concerning the reporting of adverse events and to adhere to
these policies.

Role of the Study Medical Monitor

In CTN studies, the Study Medical Monitor is appointed by the Lead
Investigator and is responsible for reviewing reports of adverse events
(AEs) and serious adverse events (SAEs) that are submitted by study
sites. He or she must ensure that participants receive good clinical care
and that safety concerns are identified quickly and addressed
appropriately. The Study Medical Monitor must:

 Review each AE/SAE and consider whether it may be related to

study participation.
 Determine if the safety event meets reportability criteria as per
federal regulations.
 Propose changes in the protocol or consent form, if warranted by
the severity or frequency of adverse events.
Role of the NIDA Study Medical Officer
In CTN studies, the NIDA Study Medical Officer has overall
responsibility for evaluating, monitoring, and reporting on the safety of
participants.

Ongoing Informed Consent

As discussed in the Informed Consent module, informed consent is a
process as well as a legally required document. Throughout any study,
researchers must continue to keep study participants informed about any
new information with regard to the safety of the product and, in particular,
about any new developments or findings that may affect participants’
willingness to remain in the study.

Researchers must:

 Inform participants, in a language that they understand, about

emerging developments in the study, related studies utilizing the
same Investigational Product(s), or pertinent pre-clinical studies
that are significant to participant safety.
 Offer participants the opportunity to ask questions about the
information they have been given.
 Ensure that participants understand they may withdraw from the
study at any time and cannot be penalized for doing so.
 Be satisfied that each participant understands what he or she has
been told and is making a voluntary, informed decision to remain in
the study.

What is an adverse event?

The Good Clinical Practice (GCP) guidelines of the International Council
for Harmonization (ICH) define an adverse event (AE) as: “any untoward
medical occurrence in a patient or clinical investigation subject
administered a pharmaceutical product and that does not necessarily
have a causal relationship with this treatment” (ICH GCP, E6(R2) 1.2).

The term adverse event is defined in the U.S. Code of Federal

Regulations (CFR) Title 21 Section 312.32(a) as follows: "any untoward
medical occurrence associated with the use of a drug in humans, whether
or not considered drug related."
ICH guidelines for Clinical Safety Data Management: Definitions and
Standards for Expedited Reporting uses the ICH GCP definition.

An AE may be “any unfavorable or unintended" sign, symptom, or

disease that occurs in a person who has taken a medication. The
occurrence does not need to be related to the drug treatment.

An adverse event (AE) may be:

 A physical event (e.g., a rash).

 A psychological event (e.g., depressed mood).
 A laboratory event (e.g., elevated blood sugar).
 An increase in the severity or frequency of a pre-existing symptom
or condition (e.g., increased pain in a painful tooth)
An adverse event may also be referred to as an “adverse experience.”

Click here for examples of events that should or should not be reported

as AEs.

Situations involving the use of a drug in humans in which an

adverse event may occur

An adverse event (AE) may occur as a result of:

 A drug overdose, whether accidental (e.g., the patient is of a small size or has poor
metabolism of the drug) or intentional (e.g., suicide attempt).
 An interaction with food or with another medication.
 Drug abuse (e.g., the patient faints when taking a nonprescribed drug to “get
high”).
 Drug withdrawal (e.g., the patient stops taking a prescribed medication and has a
seizure).
 Any failure of expected pharmacological action (e.g., a drug given to slow a
patient’s heart rate instead increases the heart rate).
 The use of a drug in professional practice (e.g., when an approved [marketed] drug
is given to a patient and he or she develops a rash). The patient does not need to
be enrolled in a clinical trial.
Examples of events that should or should not be reported as
adverse events

An adverse event (AE) may occur as a result of:

 Worsening of a withdrawal symptom—even if it is a symptom noted in the patient’s

medical history form—should be recorded as an AE if it occurs during the course of
a study. Withdrawal symptoms can be coded as such to differentiate them from
similar AEs that are not withdrawal related.
 Stable chronic conditions (e.g., arthritis that is present before the participant enters
a clinical trial and does not worsen) are not considered AEs. These conditions
should be accounted for in the participant’s medical history.
 Reports of unintentional overdose of any medication (including the study
medication) that result in no associated adverse reaction should not be reported as
AEs. They should be routinely followed up to ensure that information is as
complete as possible with regard to symptoms, treatment, and outcome.
 Drug abuse during a study should not be recorded as an AE unless it worsens
during treatment (e.g., the participant is hospitalized for detoxification).

What is an adverse event in a behavioral study?

As defined in the previous section, an AE is commonly understood to be
an event that occurs during treatment with a drug or device. However, the
definition can also be applied to any “untoward occurrence” that occurs in
any clinical trial, including behavioral studies.

For trials that are not regulated by the FDA, the Investigators and

protocol teams may define the term adverse event to reflect what is
clinically and scientifically relevant to their study.

Thus, for a behavioral trial that does not involve treatment with a drug, an
AE may be defined as:

“Any unfavorable, unintended diagnosis, symptom, sign (including an

abnormal laboratory finding), syndrome, or disease that occurs during the
study, having been absent at baseline, or—if present at baseline—
appears to worsen.” (Interim Guidelines for NIH Intramural Principal
Investigators and for NIH Institutional Review Boards on Reporting
Adverse Events)

In certain studies, including some behavioral studies, it may be important

to capture the occurrence of nonmedical events such as arrest,
imprisonment, and violence to others, which may be contributing factors
to an AE or may indicate that an AE has occurred. As an example of the
latter, a participant’s increased drug abuse—an AE—could result in an
arrest.

Investigators may elect to capture nonmedical events that may be

behavioral (e.g., violence) or social (e.g., arrest, imprisonment) on the AE
Case Report Form (CRF), or such events may be captured elsewhere.

What is an adverse drug reaction?

The terms adverse event and adverse drug reaction are easily confused,
but they have distinctly different meanings. As discussed in earlier
sections, an adverse event (AE) is any “untoward occurrence” in a patient
or clinical study participant that need not be related to treatment.

By contrast, an adverse drug reaction (ADR) implies an adverse event

that results from a medicine or treatment (i.e., there is a degree of
relatedness between the adverse reaction and the treatment).

FDA regulations define an ADR as

“an undesirable effect, reasonably associated with the use of a drug, that
may occur as part of the pharmacological action of the drug or may be
unpredictable in its occurrence” (21 CFR 201.57(c)).

Remember: Although every ADR is also an AE, only some AEs will also
be ADRs. Therefore, it is very important to collect clear and complete
information about every AE.

What is a serious adverse event?

An AE is considered serious if it poses a threat to the patient’s life or
functioning. The FDA defines a serious adverse event (SAE) as any
untoward medical occurrence that:

 Results in death, or
 Is life-threatening (places the patient at risk of death), or
  Requires hospitalization or prolongs an existing hospitalization, or
 Causes persistent or significant disability or incapacity, or
 Is a birth defect, or
 Requires medical intervention to prevent one of the above
outcomes (e.g., an asthma attack that requires intensive treatment
in an emergency room, a seizure that does not result in
hospitalization but requires medical treatment).
An AE needs to meet only one of the above criteria to be considered
serious. A change in vital signs, diagnostic tests (e.g., an
electrocardiogram), or laboratory test results may be an SAE if the
change is of sufficient magnitude to meet one of the above criteria.

An adverse event is judged “serious” on the basis of the threat it poses to

a patient’s life or functioning. For example, a patient could be diagnosed
with pneumonia in his or her doctor’s office and given antibiotics to take at
home. The pneumonia is an AE, but not an SAE

However, if the patient is hospitalized for the pneumonia, that is

considered an SAE. (The SAE is pneumonia resulting in hospitalization.)

It is also imperative to clarify between severe and serious. While the

intensity of an event may be severe, it may not meet the criteria for
serious (e.g. Severe Migraine). Severity is discussed in this module.

Elective surgery (i.e. surgery that is planned prior to entry into the study)
is not a Serious Adverse Event. For example, removal of bunions on feet,
nose reconstruction, planned hysterectomy, etc.

What is a serious adverse event in a behavioral study?

The definition of an SAE in the previous section is commonly understood
to relate to clinical studies of drug treatments. However, the definition can
be applied to any kind of clinical study, including behavioral studies.

The Investigator of a study may, for the purposes of the study, limit or

expand the FDA criteria for an SAE to reflect the specific risks of the
study intervention and the characteristics of the study population.
The Investigator may describe in the research protocol other AEs that in
that particular study are to be considered serious, although the AE may
not meet the FDA criteria. For example, all suicide attempts may be
considered SAEs in a specific research protocol, whether or not they
require hospitalization or place the patient at immediate risk of death. On
the other hand, certain occurrences that would be considered SAEs
under the standard definition, such as hospitalizations for normal
childbirth or voluntary admissions for detoxification, may be explicitly
defined not to be reportable as AEs and/or SAEs, if the Investigator so
chooses. Any such modifications to the definition of an SAE must be
approved during the protocol review process and by the appropriate IRBs.

What is an unexpected adverse event?

For clinical studies that involve the use of marketed drugs (as opposed to
investigational new drugs), FDA defines an unexpected AE as:

 An AE that is not listed in the drug’s current labeling, or

 An AE that is more severe or more specific than indicated in the
labeling.
For clinical studies in which investigational new drugs are used, the
FDA defines an unexpected AE as:

 An AE that is not consistent with the information about the drug’s

risks that appears in the relevant source document(s)
(e.g., protocol, Investigator's Brochure, and consent
documents), or
 An AE that is not consistent with the risk information, or
 An AE that has occurred within the class of drugs, but not
specifically with the Investigational Product.

What is an unexpected adverse event in a behavioral study?

In studies conducted under the Investigational New Drug regulations,
the known risks and expected benefits of an investigational new drug are
described in the Investigator's Brochure.

However, an Investigator’s Brochure is often not prepared for behavioral

studies. For this reason, researchers who conduct behavioral studies are
expected to describe in the research protocol any adverse events that
might be expected to occur in the study population as a result of the
experimental behavioral intervention. They must also briefly describe
these events in the consent documents.

In a behavioral study, therefore, an unexpected adverse event would be

an AE that is not mentioned in the protocol or consent documents or an
AE that has not been seen before. Aditionally, unexpected AEs in a
behavioral study can be considered as unanticipated problems
(discussed further below) and are thereby regulated under 45 CFR46.

What is an unanticipated problem?

The Office of Human Research Protections (OHRP)
defines unanticipated problems involving risks to study participants and
others as an event that meets all of the following criteria:

1. unexpected (in terms of nature, severity, or frequency) given (a) the

research procedures that are described in the protocol-related
documents, such as the IRB-approved research protocol and
informed consent document; and (b) the characteristics of the
subject population being studied;
2. related or possibly related to participation in the research (in this
guidance document, possibly related means there is a reasonable
possibility that the incident, experience, or outcome may have been
caused by the procedures involved in the research); and

Suspected unanticipated problems must be promptly reported to the

IRB, who will make the subsequent determination to report it to the
proper regulatory authority.
Although unanticipated problems are found but not defined in 45 CFR 46,
all NIH funded studies are required to comply with 45 CFR 46. For
OHRP’s current guidance on unanticipated problems, follow the link here.

 Assessing an Adverse Event 

Every protocol should list specific AEs that are to be addressed at every
visit. Generally, this will be a very short list of lab values and clinical signs
and symptoms. The protocol should also specify the duration that
information on AEs will be collected.
All AEs that occur in any clinical study participant should be assessed for:

Severity

The severity of an AE is not the same as its seriousness. Severity refers

to the intensity of a specific event (e.g., mild, moderate, or severe pain).
However, the event itself may be of minor medical significance (e.g., a
severe toothache). (Click here to see sample definitions of the grades of
severity of an AE.)

By contrast, the seriousness of an AE is assessed by the extent to which

it poses a threat to the patient’s life or functioning. Thus, an AE may be
severe (e.g., severe pain from a toothache) without being serious
(threatening the patient’s life or functioning).

Determining the severity of an AE is largely a matter of individual clinical

judgment. No universally accepted scale exists for describing or
measuring the severity of AEs. The severity of an AE should be
determined with input from a qualified physician or licensed medical staff.

Grades of severity of an adverse event

 Mild (or Grade 1): Transient or mild symptoms; no limitation in activity; no intervention
required.
 Moderate (or Grade 2): Symptom results in mild to moderate limitation in activity;
no or minimal intervention required.
 Severe (or Grade 3): Symptom results in significant limitation in activity; medical
intervention may be required.
 Life-threatening (or Grade 4): Extreme limitation in activity, significant assistance
required; significant medical intervention or therapy required; hospitalization.
 Death (or Grade 5).

Relatedness

An AE may or may not be causally related to the study intervention. A

causal relationship means that the intervention caused (or is reasonably
likely to have caused) the AE. This usually implies a relationship in time
between the intervention and the AE (e.g., the AE occurred shortly after
the participant received the intervention).
For all AEs, it is the responsibility of the clinician who examines and
evaluates the patient to determine the relatedness of the event to the
study intervention. Data managers who have no role in patient clinical
assessment must not perform this important task.

Acceptance that an AE is related to the intervention usually requires a

plausible mechanism of action—that is, a believable sequence of events
by which the intervention brought about the AE. It may be helpful to seek
the opinion of the Study Medical Monitor on this point. It can also be
helpful to ask the participant whether he or she thinks the intervention
could have brought about the AE. (Click here to see terminology utilized
in protocols to assist clinicians in their assessment of the relatedness of
an event.)

If an AE is thought to have a causal relationship with the intervention, and

the AE raises concern about the safety of the participant, serious
consideration must be given to temporarily halting or permanently
discontinuing the intervention. Additionally, rechallenging the participant
(that is, giving the intervention again to test the causal relationship to see
if the AE occurs again) is not often done because of safety concerns. For
this reason, it is often impossible to say with certainty that an
experimental intervention caused an AE.

The causal relationship between an intervention and an AE may be tested

by discontinuing the intervention and then rechallenging the participant
(giving the intervention again) to see if the AE occurs again. However,
this is rarely done because of safety concerns. For this reason, it is often
impossible to say with certainty that an experimental intervention caused
an AE.

When an AE is labeled “associated with the use of the intervention,”

therefore, this means there is a reasonable possibility that the AE may
have been caused by the intervention and is meant to convey in general
that there are facts (evidence) or arguments to suggest a causal
relationship.

Early in the development of a drug or other intervention, when little is

known of its safety profile, it is especially important to maintain a high
level of suspicion for AEs and to report all AEs that may in any way be
causally related to an experimental drug or intervention.
Any AE reported by a participant should be followed up at each
subsequent study visit until the AE has resolved. It is important to
document both the duration (e.g., minutes, hours, days) and severity of
an AE. An AE that persists from one study visit to the next should be
documented as one event. For AEs that are sustained past the study
duration, follow-up may occur until resolution or for a reasonable period of
time defined by the protocol.

The initial report of an AE is usually made by the participant; however, an

AE may also be reported by a family member, friend, nurse or other
caregiver, or someone else. For example, a family member or friend may
call to report that a participant has been hospitalized. Or another
participant may report hearing from a third party that a participant is
seriously ill.

Regardless of who reports an AE, the event should always be

documented in the participant’s source documents including progress
notes. When an AE is reported by a third party, the Research Assistant
should make every effort to contact the participant directly to verify the
report. In some cases, a report of an AE may turn out to be false. As
more information about the event is gathered and assessed, the
Research Assistant must ensure that source documents and reports are
updated with accurate information about the AE.

Adverse Event Reporting 

AE reporting is an essential part of participant safety protection during a
clinical study. Determining whether an incident is a reportable AE—and if
so, what should be reported about it, to whom, and when—depends on
many factors, including:

 Previous experience and knowledge of the drug or intervention,

 The disease being treated, and
 Regulatory requirements.
In addition to the factors listed above, investigators must consider incident
reporting requirements for NIH-funded studies, including reportable AEs
and unanticipated problems (UPs). All NIH-funded studies are required to
comply with 45 CFR 46 for safety event reporting. For OHRP’s current
guidance on UPs involving participant safety risks, follow the link here.
Not all AEs require reporting, as they might not directly impact participant
risk or present significant new findings. Inundating the study IRB with
individual, unanalyzed UPs is an uninformative process, and UPs that
don’t impact participant risk can be covered during the IRB’s continuing
review. Requirements for the reporting of AEs are defined in each
protocol.

The investigator and research team must consider these factors when
writing the sections of the protocol and the operations manual that
discuss adverse event reporting. The investigators and the study sponsor
jointly determine the extent and type of AE data that will be collected for a
specific trial.

They may decide that minor complaints of daily living will not be
considered AEs. An event such as the worsening of symptoms of a
current illness could be captured in the patient’s progress notes or on
a case report form.

ICH GCP requirements for AE reporting

The investigator must report all Serious Adverse Events to the sponsor
immediately. The immediate reports should be followed promptly by
detailed, written reports.

In the event of a death, the investigator should supply the sponsor and
the IRB with any additional requested information.

In addition, the investigator must comply with the applicable regulatory

requirements as well as protocol specific requirements related to the
reporting of safety issues. In some instances, the local laws or network
requirements may request more stringent reporting of emergent or safety
events.

FDA Requirements

For IND studies FDA guidelines (21 CFR 312.32) require expedited
reporting by the sponsor of all AEs that are associated with the use of the
drug, serious, unexpected and reasonably related to the investigational
product.
  Related and unexpected fatal or life–threatening AEs (severity
grade 4 or 5) that are associated with the use of the drug must be
reported to FDA by telephone or fax no later than 7 calendar days
after the sponsor first learns of the event. This initial report must be
followed within 8 additional calendar days by a written safety report
that is as complete as possible.
 FDA must be notified of serious, related and unexpected AEs
associated with the use of the drug that are not fatal or life-
threatening in a written safety report no later than 15 calendar days
after the sponsor first learns of the event.
 The sponsor should report pertinent follow-up information for
previously submitted reports to the FDA as soon as it is available,
including for AEs that were not initially deemed reportable if the
follow-up information causes a change in assessment.
Aggregate analyses of adverse events observed from a clinical trial, or
from other studies outside the sponsor’s scope, that detail new
information regarding the investigational product (i.e. new side effects, or
increasing frequency of side effects) should be reported to the FDA.
Significant non-clinical findings are also reportable if they’re suggestive of
increased risk for human studies. The FDA also accepts voluntary
reporting for marketed drugs in studies exempt from FDA reporting
requirements with their MedWatch system.

Under these guidelines, expedited reporting to the FDA is generally not

necessary for AEs that are:

 Serious but expected.

 Serious but not related to the study drug, whether expected or not
(e.g., a patient who dies of a cancer that was present prior to entry
into a study of an antidepressant).
 Non-serious, whether expected or not.
For studies of investigational new drugs, FDA requires the sponsor to
notify all participating investigators in a written safety report of any serious
and unexpected AE that is associated with the use of the study drug. The
sponsor may add additional requirements to this notification. Consider
how NIDA fufills this obligation. NIDA has directed Lead Investigators to
distribute such reports within 24 hours of learning of an AE that:
  Is considered serious, related and unexpected, or
 Requires revision of the protocol or the informed consent form, or
 Requires termination of the study or suspension of enrolment.
If a serious related and unexpected AE represents an increased risk to
study participants, investigators must inform participants of this increased
risk as soon as possible.

CTN Requirements clinical trials network

National Institute on Drug Abuse. NIDA

ICH GCP guidelines (E6) state that all serious adverse events (SAEs)
should be reported immediately to the sponsor. An exception is made for
SAEs that are identified in the protocol or other document (e.g.,
Investigator's Brochure as not requiring immediate reporting).

For CTN studies (whether conducted under an Investigational New Drug

application or not), any AE that meets FDA’s criteria for a serious adverse
event (SAE) must be reported within 24 hours to the NIDA Study Medical
Officer and all parties specified in the protocol. The FDA’s definition of an
SAE is to be used unless the protocol specifically limits or expands the
FDA definition.

Following the initial report of the SAE by phone, fax, or e-mail all efforts
will be made to gather additional information available on the SAE. Once
received, this information will be sent to NIDA within the time frame
specified in the research study protocol.

For studies conducted under an IND, it is then NIDA’s responsibility (as

sponsor of most investigational new drug studies conducted within the
CTN) to send an IND (Investigational New Drug) Safety Report to the
FDA within the required timeframe.

SAEs that are exempt from expedited reporting must be documented and
reported in a timely fashion (e.g., monthly, quarterly) in accordance with
local IRB requirements. For all CTN studies, any serious adverse event
(SAE) must be reported to NIDA within 24 hours after CTN protocol staff
learn of the event. This deadline applies:
  Whether or not the investigator considers the SAE to be related to
the study intervention.
 Regardless of the severity or outcome of the SAE.
 For SAEs that occur in both drug studies and behavioral studies.
 For studies conducted under the Investigational New Drug
regulations and those that are not.
 For all SAEs that occur during a study, including those that occur
during a post–treatment observation period as defined by the study
protocol.
The National Institutes of Health (NIH) has issued guidance to NIH-
supported investigators on reporting to IRBs about AEs that occur in
multi-center clinical trials. Investigators must know the policies of the local
IRB, adhere to them, and keep a copy of them in the study file.
Investigators are also responsible for accurately documenting,
investigating, and following up all possible study-related adverse events.

Site PIs should follow the policies of their Institutional Review Board on
timeframes for reporting AEs. Additionally, investigators must ensure that
NIDA is informed of any actions taken by the IRB as a result of its
continuing review of participant safety.

Adverse Event Reporting in CTN Studies

Multiple parties need to be notified of AEs that occur in CTN studies. This
can lead to confusion.

Study investigators must report AEs to:

 The study sponsor (NIDA for most CTN trials).

 Relevant IRBs.
If NIDA is the study sponsor, and the study is conducted under an IND,
NIDA must inform FDA and any other relevant regulatory agencies of
findings that could adversely affect participant safety, affect the conduct
of the trial, or alter IRB approval to continue the trial.

The research protocol may, if appropriate, establish additional reporting

requirements based on the severity of an AE. For example, the protocol
and consent forms could state that trial-related hospitalizations will be
reported to the participant’s treating physician.

In CTN trials, any AE that occurs between the times a participant signs
the informed consent form and the time he or she leaves the study after
the final follow-up visit must be captured and recorded, unless the
protocol states differently. The investigators and NIDA (as the study
sponsor) may jointly determine an alternative period (e.g., beginning with
the first trial-related procedure or the first time a participant takes the
study drug) during which AEs must be reported.

How quickly an AE must be reported and to whom depends, in part, on

the nature of the event. Reporting requirements encompass both routine
reporting and expedited (rapid) reporting.

For studies conducted under an IND, FDA regulations require

investigators to “promptly” report to the study sponsor any AE that is
reasonably likely to have been caused by the study drug. If the AE is
“alarming”, the investigator must report it immediately. The sponsor, in
turn, is responsible for expedited (rapid) reporting to the FDA of certain
serious adverse events (SAEs) that are both reasonably related and
unexpected. All other AEs must be reported to the FDA in protocol
amendments or in annual reports (21 CFR 312.32).

Adverse Event Reporting in CTN Behavioral Studies

For NIH-funded studies that do not involve the use of investigational new
drugs, requirements for AE reporting vary depending on the nature of the
study. Federal regulations (45 CFR Part 46, Subpart A) require written
procedures and policies for ensuring that “unanticipated problems”
involving risks to participants are reported to the IRB, appropriate
institutional officials, and the relevant department or agency head.

Most AEs that occur in CTN behavioral studies are found to be unrelated
to the study treatments received. For this reason, unlike FDA
requirements for drug trials, non-serious AEs are sometimes not tracked
in CTN studies. The Lead Investigator should specify in the protocol of
a behavioral study which untoward occurrences should be captured and
reported as adverse events, and which should not. Furthermore, the
protocol should specify the types of events that will or will not qualify as
SAEs and be reported as such.
For NIH-funded studies in which investigational drugs or devices are
used, i.e. studies conducted under IND or IDE, investigators must comply
with both NIH and FDA requirements for the reporting of AEs.

Additionally, OHRP provides the definition of unanticipated problems that

affect the safety risks to study participants and others. As NIH-funded
studies are regulated by 45 CFR 46, OHRP provides the criteria for
determining unanticipated problems and the review and reporting of these
incidents and AEs (follow this link for guidance).

Expedited Reporting of Adverse Events

Participants in clinical studies may experience AEs which, if they are

thought to be probably or possibly caused by an experimental
intervention, might be significant enough to lead to important changes in
the way a drug or other intervention is developed or used (e.g., changes
in dose, treatment population, required monitoring, consent forms). This is
particularly true for AEs that, in their most severe forms, threaten life or
function.

Such AEs must be reported promptly to investigators, sponsors,

regulators, and IRBs. This is referred to as expedited or rapid reporting.
The purpose of expedited reporting is to ensure that the appropriate
parties are quickly made aware of important new information about the
potential adverse effects of a drug or other experimental intervention.

 Adverse Event Follow-Up

Medical Follow-Up of Participants with an Adverse Event

Unless otherwise specified in the protocol, in some networks it is common

practice that all AEs and non-study–related SAEs should be followed-up
until they have resolved or stabilized or until 30 days after the
participant’s involvement in the study has ended, whichever occurs
sooner.

All SAEs should be followed until resolution, or until the condition has
stabilized with no further change expected. According to FDA guidance,
participants should receive appropriate medical evaluation and treatment
until resolution of any emergent condition related to the study intervention
that develops during or after the course of their participation in a study,
even if the follow-up period extends beyond the end of the study.

When a participant discontinues participation in a study because of an

SAE, investigators should:

 Continue to follow up the SAE as noted above.

 Document the SAE and its follow-up in the participant’s record.
 Attempt to complete any final evaluations required by the
study protocol.
 Attempt to perform other medical evaluations to try to determine the
cause of the SAE and its possible relationship to the study
intervention. These evaluations would include obtaining an autopsy
report, if available, in the event of a participant’s death.
For a woman who is discontinued from a study because of pregnancy,
attempt to follow up the outcome of the pregnancy to term. If the woman
was enrolled in a trial of an investigational drug that is known to present a
risk of birth defects, any information regarding birth or congenital
abnormality should be obtained.

Loss to follow-up of participants with ongoing SAEs is a serious problem

that can affect the validity of a study’s results. For this reason, every effort
should be made to contact participants who leave a study after
experiencing an SAE. Documentation of that effort should be maintained
by the PI.

Data and Safety Monitoring

Data and Safety Monitoring

Data and safety monitoring plays an essential role in protecting

participant safety and ensuring the integrity of a research study. The
objectives of data and safety monitoring are to:

 Ensure that risks of participation in a clinical study are minimized as

far as is reasonably possible.
 Avoid exposing participants to excessive risk.
 Ensure the integrity of the data collected in a clinical study.
  Stop a study
o If safety concerns arise, or
o As soon as the study objectives have been overwhelmingly
met, criteria usually spelled out before the study begins.
The following are key points to remember about data and safety
monitoring:

 Data and safety monitoring must occur periodically throughout

every study. The frequency of monitoring is commensurate with the
risks involved in the study, as well as the size and complexity of the
study (i.e. a small, single-site Phase I trial versus a large, blinded,
multi-site Phase III trial).
 Periodic data summary reports are prepared to determine if the
study should change in any way or stop. Any significant changes in
the study are implemented with the approval of the local IRB and
reported to appropriate institutional officials, the study sponsor, and
the FDA (if the study involves an investigational new drug or
device).
 The risks and benefits of the study must be reassessed whenever
any new study data become available.

 Summary of Key Points

 The safety and well-being of study participants must be
safeguarded at all times during the conduct of a clinical research
study.
 An adverse event (AE) is defined in the Good Clinical Practice
guidelines as any “untoward medical occurrence” in a person who
receives a drug while participating in a clinical study. The
occurrence need not be causally related to the drug treatment.
 For behavioral studies, an AE may be defined as “any unfavorable,
unintended diagnosis, symptom, sign (including an abnormal
laboratory finding), syndrome, or disease that occurs during the
study, having been absent at baseline, or—if present at baseline—
appears to worsen.”
 An AE is considered serious if it poses a threat to the patient’s life
or functioning. The U.S. Food and Drug Administration (FDA)
 defines a serious adverse event (SAE) as any untoward medical
occurrence that:
o Results in death, or
o Life threatening (places the patient at risk of death), or
o Requires hospitalization or prolongs an existing
hospitalization, or
o Causes persistent or significant disability or incapacity, or
o Is a congenital anomaly/birth defect, or
o Requires medical intervention to prevent one of the above
outcomes.
 The Investigator in a behavioral trial may modify or expand the FDA
criteria for an SAE to reflect the specific risks of the intervention and
the characteristics of the study population.
 The severity of an AE is not the same as its seriousness. An
adverse event may be severe (e.g., severe pain from a toothache)
without being serious (threatening the patient’s life or functioning).
 SAEs must be reported by phone or fax immediately to all parties
notified as specified in the protocol.
 The purpose of expedited reporting to the FDA or other regulatory
authority is to ensure that the appropriate parties—including
investigators, sponsors, regulators, and IRBs—are quickly made
aware of new, important information about the potential adverse
effects of a drug or other experimental intervention.
 In addition to reporting AEs and SAEs, NIH-funded studies are
required to report unanticipated problems that affect the safety of
study participants and others. While unanticipated problems are
found in and regulated by 45 CFR 46, OHRP provides the criteria
for determining unanticipated problems and the reporting and
review of these incidents (see OHRP, 2007).
 Generally, all AEs and SAEs should be followed up until they have
resolved or stabilized.
 Data and safety monitoring must occur periodically throughout
every study to protect participant safety and ensure the integrity of
 study data, for example, by the Data and Safety Monitoring Board
for a clinical trial.

What is quality assurance?

Quality Assurance (QA) in clinical trials consists of planned, systematic

activities that are conducted to ensure that a trial is performed―and that
trial data are generated, documented, and reported―in compliance with
the protocol, Good Clinical Practice (GCP) guidelines, and all other
applicable regulatory requirement(s).

Why is QA important?

Research that is not conducted according to high standards of quality

yields invalid data. It is also unethical because it may put research
participants at risk. (Protection of the safety, rights, and well-being of
research participants is discussed in the Introduction, Institutional
Review Boards, Informed Consent, and Participant Safety and
Adverse Events modules.)

Audits conducted by the U.S. Food and Drug Administration (FDA) find
that several problems commonly occur in research studies.

Quality data are critical to ensure that the results of studies are
interpreted correctly. Sloppy or incorrect data can lead to misleading
conclusions. Careful attention to standards of quality also ensures that
studies are completed in a timely fashion. Timely completion of high
quality studies bridges the gap between research and practice by bringing
effective new treatments to clients more quickly.

Why is QA important?

Research that is not conducted according to high standards of quality

yields invalid data. It is also unethical because it may put research
participants at risk. (Protection of the safety, rights, and well-being of
research participants is discussed in the Introduction, Institutional
Review Boards, Informed Consent, and Participant Safety and
Adverse Events modules.)

Audits conducted by the U.S. Food and Drug Administration (FDA) find
that several problems commonly occur in research studies.

Quality data are critical to ensure that the results of studies are
interpreted correctly. Sloppy or incorrect data can lead to misleading
conclusions. Careful attention to standards of quality also ensures that
studies are completed in a timely fashion. Timely completion of high
quality studies bridges the gap between research and practice by bringing
effective new treatments to clients more quickly.

Who is responsible for QA?

All members of the protocol team are responsible for QA.

While it is common for QA and monitoring-related duties and functions to

be transferred to a CRO, the sponsor has ultimate responsibility for
implementing and maintaining QA systems. (ICH GCP 5.1.1) This
responsibility includes oversight of all QA systems as well as any trial-
related functions performed or managed by other parties (i.e. the CRO, or
a subcontractor to the CRO) on behalf of the Sponsor (ICH GCP 5.2.2)

Investigators and every member of the protocol team are expected to

perform his or her duties diligently and thoroughly, thus ensuring that the
trial is conducted according to the highest possible standards of quality.

QA Roles and Responsibilities in the NIDA Clinical

Trials Network
The CTN Policies and Procedures on QA