NCBI Bookshelf. A service of the National Library of Medicine, National Institutes of Health.
Gliklich RE, Leavy MB, Dreyer NA, editors. Registries for Evaluating Patient Outcomes: A User’s Guide [Internet]. 4th edition. Rockville (MD): Agency for Healthcare Research and Quality (US); 2020 Sep.
This chapter identifies the best practices for obtaining informed consent and permission for registry participation. It builds on some of the general ethical and legal principles discussed in Chapter 7, focusing specifically on the application of the regulations governing human subjects research and the requirements of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
The purpose of this chapter is to provide an ethical framework for obtaining informed consent and permission for registry participation and to distinguish registries from clinical research protocols with respect to these issues. It is not designed to provide specific legal guidance, nor can it substitute for Institutional Review Board (IRB) review. Moreover, legal discussion is limited to U.S. law, and more specifically, to federal as opposed to state statutes and regulations. Some states have guidelines governing the conduct of research involving human subjects or statutes addressing privacy, and an exploration of either area is beyond the scope of this chapter. Likewise, analysis of the relevant international standards and laws is left to others.
Case Examples 16, 17, and 18 provide descriptions of how different registries have approached informed consent.
The purpose of this handbook is to provide guidance for registries used to evaluate patient outcomes. The focus of this chapter is on informed consent and authorization issues that arise in registries used for research. It is important to note that registries are increasingly being used for research purposes even when initially developed for clinical or other purposes, and thus it is suggested that in all cases, consideration should be given to the informed consent issues, as well as HIPAA privacy requirements, discussed in this chapter. The HIPAA Privacy Rule governs the use and disclosure of most individually identifiable health information (called protected health information or “PHI”) held by covered entities (health plans, health care clearinghouses, and most healthcare providers).
The key regulatory framework is found in the federal research regulations referred to as the “Common Rule.” As discussed in Chapter 7, the Common Rule applies to research involving human subjects conducted or supported by the 20 Federal departments and agencies, including the U.S. Department of Health and Human Services (HHS), that intend to follow the revised Common Rule. Significant amendments were made to the Common Rule in 2017. As of January 21, 2019, institutions are expected to be compliant with the revised Common Rule. There are also relevant regulations promulgated by the U.S. Food and Drug Administration (FDA). The FDA has authority over “all clinical investigations” regulated by the FDA—defined as “any experiment that involves a test article and one or more human subjects.” 1 This oversight may overlap with HHS, but will also extend to privately funded research. The discussion below focuses on the revised Common Rule, specifically referring to the HHS regulations and to a lesser extent FDA regulations; prior versions of this handbook address the old regulations.
Investigators whose research is sponsored by another federal agency should consult the guidelines issued by that agency. While the discussion below is likely to be applicable, there may be additional requirements in specific circumstances.
The HHS regulations apply to federally funded “research involving human subjects,” 2 where “research” is defined as a “systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge” and “human subject” is defined as a living person about whom the investigator obtains either data or biospecimens through intervention or interaction, or “obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.” 3 Identifiable information or biospecimens are those “for which the identity of the subject is or may readily be ascertained by the investigator or associated with the [information or] biospecimen.” 4 The regulations require periodic (at least every 4 years) assessments of analytic technologies/techniques to determine what should be considered “identifiable.” A list of the technologies will be published in the Federal Register for notice and comment and then maintained on a publicly available website.
Investigations that involve nonliving individuals, or that do not collect data through intervention/interaction with the individual, or do not collect “identifiable” information are not considered research subject to the regulations. Despite the scope of the HHS regulatory language, institutions may choose to apply the frameworks more broadly (sometimes under an “assurance,” i.e., an agreement with HHS that the institution will apply the regulations to all research at the institution regardless of funding source). In other contexts FDA regulations will apply since the data from the research is going to be used in support of applications for marketing an FDA regulated product. The FDA regulations regarding informed consent in large part mirror the HHS regulations, 5 but the scope of research oversight of the two agencies is different.
the identifiable information/biospecimens are publicly available,the information is recorded in way that identity is not readily ascertained, the investigator does not contact the subjects, and the investigator will not re-identify the subjects
the research is regulated under HIPAA (e.g., is considered “healthcare operations” or “public health activities”)
the research is conducted by or on behalf of a federal agency using government generated /collected information. 8
Broad consent for the storage, maintenance, and secondary research use of the identifiable private information or identifiable biospecimens was obtained in accordance with §46.116(a)(1) through (4), (a)(6), and (d);
Documentation of informed consent or waiver of documentation of consent was obtained in accordance with §46.117;
An IRB conducts a limited IRB review and makes the determination required by §46.111(a)(7) and makes the determination that the research to be conducted is within the scope of the broad consent referenced in paragraph (d)(8)(i) of this section; and (iv) The investigator does not include returning individual research results to subjects as part of the study plan. This provision does not prevent an investigator from abiding by any legal requirements to return individual research results. 10
Broad consent is discussed in more detail below in section 4.2.
Differences in who is considered a participant in registry research and clinical research are worth noting, especially since the differences may impact how we think about informed consent. In particular, the use of a control group in a registry setting is often substantively different from the concept of a control group in a clinical research setting. Registry controls may be pulled from a general population—in some cases a population that may not have interacted with health professionals or a health institution. Unlike clinical controls, who may be exposed to placebos (and thus need to consent) or assigned to a standard treatment (and thus will already be involved in the treatment system), registry controls may be identified from an unaffected population. This raises ethical questions about the initial contact with an individual who may have no link to the registry topic area and who may view the contact as an unwelcome intrusion or perhaps even an incorrect indication of problematic health status. 11 Furthermore, since a clinical research trial may involve double-blind procedures, “controls” may agree to participate because of the potential for direct therapeutic benefits or even the indirect therapeutic benefits that come from better attendant care. In other situations, controls may participate because they hope to help others suffering from the same ailments (altruistic reasoning) or perhaps because they seek monetary compensation. In contrast, controls in a registry trial have no similar potential therapeutic (direct or indirect) or monetary benefits. While altruism may play a role in this context, its effects may be problematic. There is a great concern about the potential for selection bias in the creation of a control group for registry trials—as there is also significant concern about the effect of bias in clinical trials. Those who may agree to participate in a registry may be qualitatively different from those who do not agree, and this disparity can threaten the external validity of research findings. Concerns about selection bias will be heightened for diseases with a low prevalence in the general population, since there will be a greater possibility that the bias will affect the data. Developing consent requirements in such a way as to avoid selection bias will be extremely important in this setting.
Questions about adapting the regulatory requirements to research that does not fit the typical clinical model are not unusual. There are two other areas that have raised questions about how the Federal regulations apply and that are particularly relevant to registry evaluations: public health activities and quality improvement/quality assurance (QI/QA).
The HIPAA Privacy Rule expressly permits the disclosure of Protected Health Information (PHI) to a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including for activities related to disease, injury, or vital event reporting. Thus, a covered entity may disclose PHI, without individual authorization, for a registry maintained by a public health authority (or by an entity acting under a grant of authority from or contract with such public agency) for authorized public health purposes; such as, for example, immunization registries, state cancer registries, birth and death registries, and general disease reporting (although this last type of reporting is often anonymous). The HIPAA Privacy Rule also allows the disclosure of PHI to a person subject to the jurisdiction of FDA for FDA-regulated–product reporting.
In addition to harmonizing the research regulations with the HIPAA-permitted disclosures, the revised Common Rule states explicitly that certain public health surveillance activities are deemed not within the definition of “research involving human subjects” and therefore not subject to the regulations. 12 This is designed “to allow the public health authority to monitor, assess, or investigate public health signals, onsets of disease outbreaks, or conditions of public health importance” without having to comply with the Common Rule. Even when a public health activity falls within the definition of research under the Common Rule, it may be covered by various exemptions.
The biggest challenge in this context is differentiating between public health activities and public health research; there have been a number of efforts in the past to clarify the two categories. 13 In many cases an activity might involve both traditional public health surveillance and research involving human subjects. According to the Belmont Report, the document on which the original Federal research regulations were based, if any aspect of an activity constitutes “research,” then the entire activity should undergo regulatory review. By contrast, the Centers for Disease Control and Prevention (CDC) only consider a public health activity to be research if the primary intent of the activity is to contribute to or generate generalizable knowledge. 14 Local IRB policies in this area have varied; some focus on determining whether the primary intent of a specific activity is to gain generalizable knowledge, other IRBs categorically exclude all traditional public health department activities.
determine that the activity (or a set of activities) under consideration will transition to be conducted in accordance with the revised Common Rule.
document (or have the IRB document) the transition decision (including the date of the decision) in accordance with §46.101(l)(4), and retain such documentation for at least 3 years in accordance with §46.115(b).
apply the carve-outs from the definition of research as described in the revised common rule. The activity must be a public health surveillance activity (45 CFR 46.102(l)(2));The activity must be conducted, supported, requested, ordered, required, or authorized by a public health authority (45 CFR 46.102(k) and 46.102(l)(2)); and
The activity must be limited to that necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products) (45 CFR 46.102(l)(2)). 15
Two key factors in determining whether an activity is part of the public health surveillance carve-out under the revised regulations include evaluating whether the “collection, management, analysis, and interpretation of surveillance information or biospecimens is designed to inform a public health authority, and generally is followed by public health action or by the dissemination of information to public health programs and others to stimulate public health action.” 15 The November guidance provides descriptions of these terms as used in the Common Rule, as well as examples of public health surveillance activities.
As with certain public health activities, the HIPAA Privacy Rule provides an explicit permission to use or disclose PHI for “healthcare operations,” which are defined as certain activities of a covered entity, including “conducting quality assessment and improvement activities…, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities.” 16 Individual authorization for use or disclosure of PHI in this context is not required, but a covered entity can choose to obtain such individual authorization.
The new federal research regulations do not use the terms QI or QA, but specifically exempt from review research conducted under the HIPAA regulations for the purposes of “healthcare operations.” 17 Thus many QI/QA activities will: (a) not meet the regulatory definitions of “research,” (b) not involve “human subjects,” (c) fall under this or another delineated exemption, or (d) not be supported by HHS, involve an FDA regulated product, or otherwise be covered by an assurance of compliance. Some local IRBs appear to consider all QI/QA activities outside the scope of the regulations, as they would public health activities. 18
In considering whether an activity fits into the “healthcare operations” exemption, it is important to note that the application of the research regulations does not rest on whether or not a procedure is considered “standard” or part of the “standard of care.” Nor is lack of intent to publish the results a key factor. Instead, investigators should evaluate whether the activity in question meets the definition of research involving human subjects such that it falls within the regulatory framework, and then consider whether an exemption applies. This latter determination is usually made by an IRB or within the IRB office, not by the investigator.
Registries developed within an institution to implement a practice to improve the quality of patient care or to collect data regarding the implementation of such a practice would be exempt, as would registries designed to collect provider performance data for clinical, practical, or administrative purposes. Registries that involve existing data which is not individually identifiable also is not considered research involving human subjects as defined by the Common Rule. However, a QI/QA project that involves a clinical intervention (whether or not part of the standard of care) for purposes of gathering scientific evidence of efficacy (i.e., a systematic investigation designed to contribute to generalizable knowledge) may well be governed by the regulations, although another specific exemption may apply. 19 Even if the regulations apply, waivers or alterations to the consent process may be approved as noted below.
The development of large-scale data registries raises a variety of regulatory questions, and this is nowhere more evident than in the discussions about electronic health records (EHRs). Not only are large amounts of information being collected, there is also a large increase in available biobanks, which are defined as facilities that store biological material (e.g., serum, genomic material, pathology specimens) from humans. These issues are explored in detail in Chapter 7. While the revised Common Rule directly addresses the questions of regulatory oversight for databank and biobank research (and informed consent in this context), the development of the final rule was subject to considerable debate.
Part of the problem is that there are few, if any, efforts to obtain individual consent for the creation of an EHR (or, for that matter, the creation of any health record) since consent is not required under the Common Rule for these activities; these are clinical documents which do not constitute research. Yet, these databases have enormous research potential. For example, Kaiser Permanente, a leader in the use of health information technology, created and maintains one of largest private-sector EHR systems, collecting health information from more than 11.8 million Kaiser members nationwide. As another example, there are efforts to develop (sometimes via state legislation) multi-payer claims registries to support comparative effectiveness research (CER). One primary concern that led to the recent changes in the Common Rule was that the application of traditional consent models for secondary use of these databanks for research would prove inefficient (perhaps even preventing crucial research from occurring), or result in selection bias, impacting the usefulness of downstream analyses.
As the development of EHRs, claims registries, health information exchanges, and linkages between innumerable health databases moves forward, keeping records private becomes more difficult to manage. Personal health information may be accessed and shared in ways patients never imagined. Although studies consistently indicate that Americans are generally supportive of EHRs and even secondary uses of the data, they want to be informed about how and to what extent their information will be shared and disclosed to others. 20 – 23 At the same time, it is not clear from the empirical evidence that patients want full consent protections in this context. In fact, there are studies showing that patients are willing to forego full consent when it would undermine research. The extent of comfort with research absent full consent may vary. One study, for example, found that patients were more likely to be comfortable with the research uses of their EHR information when they were asked about the use by a specific entity (e.g., universities, hospitals, or disease foundations) rather than when asked in the abstract, and that they fully supported public health uses of their data. 24 Public education about the scope of research uses may alleviate remaining patient concerns about the use of data without full consent. 25 Similarly, addressing underlying fears about unauthorized access to identifiable data or discriminatory uses of the information can also be helpful in increasing support for this type of research.
Perhaps the most challenging part of the shift to large database research and the current regulatory structure is the potential reframing of the underlying ethical issues. The pre-2018 Common Rule was based on the Belmont Report, which focused on the traditional clinical research context. The continued expansion of electronic data repository research and the potential for large-scale observational studies to replace some clinical trial data require consideration of whether the approaches used thus far should be altered. As the preamble to the final version of the revised Common Rule states:
Since the Common Rule was promulgated, the volume and landscape of research involving human subjects have changed considerably. Research with human subjects has grown in scale and become more diverse. Examples of developments include: an expansion in the number and types of clinical trials, as well as observational studies and cohort studies; a diversification of the types of social and behavioral research being used in human subjects research; increased use of sophisticated analytic techniques to study human biospecimens; and the growing use of electronic health data and other digital records to enable very large datasets to be rapidly analyzed and combined in novel ways. Yet these developments have not been accompanied by major change in the human subjects research oversight system, which has remained largely unaltered over the past two decades.
While the revised Common Rule addresses some of these landscape changes, there are additional issues which will need to be considered in the future. Professor Barbara Evans identified three “novel challenges in applying familiar ethical frameworks” to databank research. 26 The first is the possibility that with the shorter time period between research results and clinical application, the historical bifurcation between research and treatment (or even public health practice and research) may be incorrect. Perhaps IRBs will need to consider both the potential direct medical benefits of an observational study, and potential participant health risks such as negative insurance coverage determinations or changes in physician prescribing patterns. Or perhaps it is time to develop a robust concept of group benefit (and group risk) in contrast to the regulatory narrow focus on individuals. Second, the creation of these massive data banks that span numerous states (and sometimes countries) raises issues about whether the “local context review” that forms the basis for the IRB system continues to be relevant. It is worth noting that the revised Common Rule allows a single IRB of record for multi-site studies, rather than requiring multiple reviews, and NIH now requires this. How this approach will change the concept and importance of local review, which formed the basis for the initial federal regulations, remains to be seen. Finally, these new types of research raise questions about the meaning of vulnerability and susceptibility to harm, and who should be identified as a “vulnerable” population in need of additional protections. It may be that the groups traditionally considered vulnerable in the clinical research context are not especially vulnerable in this context. Conversely, there may be groups particularly vulnerable to re-identification, or for whom re-identification poses unique risks of psychosocial or economic harms, but which would not usually be considered vulnerable in clinical research. In fact, the need to understand potential group harms highlights the limitations of the traditional ethical framework that assumes the focus should be on the individual. More work is needed to consider the ethical framework that should guide large-scale database and observational studies, but such exploration is beyond the scope of this chapter.
While a number of issues remain unanswered in this area, there is some clear guidance for registries that fall under the federal research regulations. As noted previously, there are two primary sets of federal regulations governing the conduct of research involving human subjects. HHS regulates research supported by federal money or covered under an institutional “assurance of compliance” (see Chapter 7). The FDA regulates research that will be used to support an FDA-regulated product. FDA has not (yet) updated its consent requirement to match the revised Common Rule so there are some differences. Both sets of regulations largely have the same consent requirements; relevant differences are indicated below. The HIPAA Privacy Rule also contains individual authorization requirements for uses and disclosures of individually identifiable health information for research purposes. Each of these federal regulatory areas will be discussed in turn.
A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject’s participation, a description of the procedures to be followed, and identification of any procedures which are experimental.
A description of any reasonably foreseeable risks or discomforts to the subject.A description of any benefits to the subject or to others which may reasonably be expected from the research.
A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject.
A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.
For research involving more than minimal risk, an explanation as to whether there is any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained.
An explanation of whom to contact for answers to pertinent questions about the research and research subjects’ rights, and whom to contact in the event of a research-related injury to the subject.
A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.
One of the following statements about any research that involves the collection of identifiable private information or identifiable biospecimens: (i) A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens and that, after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative, if this might be a possibility; or (ii) A statement that the subject’s information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies.
In addition, the FDA requires that informed consent forms for applicable clinical trials include a statement that the trial information will be entered into the National Institutes of Health (NIH) clinical trial registry. 33
A statement that the particular treatment or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) which are currently unforeseeable.
Anticipated circumstances under which the subject’s participation may be terminated by the investigator without regard to the subject’s consent.
Any additional costs to the subject that may result from participation in the research.The consequences of a subject’s decision to withdraw from the research and procedures for orderly termination of participation by the subject.
A statement that significant new findings developed during the course of research which may related to the subject’s willingness to continue participation will be provided to the subject.
The approximate number of subjects involved in the study.A statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions; and
For research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen).
HHS regulations also set forth the elements of a broad consent for the storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens. The details of these requirements are discussed below under a separate heading. FDA has not adopted this new language.
HHS regulations allow an IRB to approve a waiver or alteration of the consent requirements for minimal risk research where: the waiver or alteration will not affect the rights of the subjects, the research cannot practicably be carried out without the waiver, for identifiable private information or biospecimens that the research could not be practicably carried out without them remaining identifiable, and, when appropriate, subjects will be provided information after participation. 35 Waivers of informed consent are also allowed when investigators are merely gathering information to screen, recruit or determine eligibility of prospective subjects if the information is gathered either through oral/written communication or by accessing records or stored sample. 36 HHS also allows waivers of the documentation requirement for informed consent (see more below under 4.3), although FDA regulations do not. In all of cases of waiver, the participant may still be provided a written summary of the “key information essential to decision making” even if the documentation requirement is waived.
The FDA regulations explicitly allow for waivers in life-threatening situations and allow Presidential waivers for some military research. 37 Both HHS and FDA regulations allow for waiver of consent requirements for research conducted in specific types of emergency situations. 38 , 39
the information is recorded in way that identity is not readily ascertained, the investigator does not contact the subjects, and the investigator will not re-identify the subjects
the research is regulated under HIPAA (e.g., “healthcare operations” or “public health activities”)the research is conducted by or on behalf of a federal agency using government generated /collected information.
Another category of research on identifiable private information/biospecimens is allowed with “limited” IRB review—“storage or maintenance of identifiable private information or identifiable biospecimens for potential secondary research.” Finally, “broad consent” (rather than traditional specific consent), may be used to provide authorization to store, maintain and conduct any secondary research on identifiable private information or identifiable biospecimens which were collected either as part of another research project, or collected for non-research purposes, without having to get specific subsequent informed consent for each future research endeavor.
A description of any reasonably foreseeable risks or discomforts to the subject;A description of any benefits to the subject or to others that may reasonably be expected from the research;
A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;
A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled;
When appropriate, a statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
When appropriate, for research involving biospecimens, whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen);
A general description of the types of research that may be conducted with the identifiable private information or identifiable biospecimens. This description must include sufficient information such that a reasonable person would expect that the Broad Consent would permit the types of research conducted;
A description of the identifiable private information or identifiable biospecimens that might be used in research, whether sharing of identifiable private information or identifiable biospecimens might occur, and the types of institutions or researchers that might conduct research with the identifiable private information or identifiable biospecimens;
A description of the period of time that the identifiable private information or identifiable biospecimens may be stored and maintained (which period of time could be indefinite), and a description of the period of time that the identifiable private information or identifiable biospecimens may be used for research purposes (which period of time could be indefinite);
Unless the subject or legally authorized representative will be provided details about specific research studies, a statement that they will not be informed of the details of any specific research studies that might be conducted using the subject’s identifiable private information or identifiable biospecimens, including the purposes of the research, and that they might have chosen not to consent to some of those specific research studies;
Unless it is known that clinically relevant research results, including individual research results, will be disclosed to the subject in all circumstances, a statement that such results may not be disclosed to the subject; and
An explanation of whom to contact for answers to questions about the subject’s rights and about storage and use of the subject’s identifiable private information or identifiable biospecimens, and whom to contact in the event of a research-related harm. 41
If a broad consent is used, required elements of the broad consent cannot be waived by the IRB. Moreover, if a broad approach consent was used and the individual refused consent, the IRB may not waive elements of specific consent at a subsequent point. The regulations do not indicate what to do when an individual is asked for a broad consent and fails to respond. SACHRP suggests that only an “unambiguous written” refusal should be viewed as a refusal in this context and that the broad consent form clearly state the implications of a failure to respond to a broad consent request. 41 Part 5 of this chapter addresses some of these opt-in and opt-out issues.
SACHRP notes that in cases where a potential participant is asked to provide a broad consent and refuses, the entity gathering the data should (a) remove the data/sample from the database, or (b) fully de-identify the particular data/sample and continue to include it in the database, or (c) clearly mark the data/sample as not to be used for research and use it only for those activities which do not fall within the regulatory framework (e.g., public health or QI/QA activities). Data or samples which fall into this latter category could also, in theory, be marked and then the individuals approached for specific consent for a particular research study at a later date (unless the individual had stated that s/he does not want to participate in any research, nor be approached later).
Even when a broad consent approach was not used to create the database, in certain circumstances an IRB can waive specific consent requirements for secondary research on identifiable information or specimens as long as the individual did not specifically refuse such a use. These waivers, however, will not be granted unless the IRB finds that it would be impracticable to use de-identified data. Finally, secondary research may be conducted on databases or biobanks without consent if the information or specimens are de-identified, which would take them out of the scope of research subject to the Common Rule. Note, however, that de-identification and aggregate reporting alone may not completely conceal identity. 42 , 43 For example, there is a considerable push to make de-identified, aggregate-level data from Genome Wide Association Studies (GWAS) publicly available in large repositories so that the data can be combined with other studies for more powerful analysis. An individual potentially could be re-identified by assessing the probability that an individual or relative participated in a GWAS through composite statistics across cohorts (such as allele frequency or genotype counts). As noted previously, the revised Common Rule requires periodic assessments of what constitutes identifiability.
While permitting broad consent is a significant boon for registry research, it is important to stress that ensuring compliance with the Common Rule will necessitate electronic tracking mechanisms for individual consent (linked with the identifiable data or biospecimen) to ensure that the information is only used in accord with the individual’s preferences. Without tracking, the impact of broad consent will be considerably lessened. In cases where tracking is not possible, traditional consent may still be used, but with all the prior caveats and concerns about inefficiencies and skewed participation.
The revised Common Rule requires that all consent forms now begin with a concise statement of the key information needed to help the prospective participant (or their legally authorized representative) understand the reasons why s/he should or should not participate. The information has to be “presented in a way that facilitates comprehension.” Broad consents are not required to meet this requirement.
Unlike treatment consents, research consents are usually written and the consent form functions both as documentation of the consent process, and in some cases as an aspect of the consent itself (since in long form the document contains all of the necessary consent disclosures and participants may be given the form to read as part of the consent process). The regulations allow an IRB to waive the written documentation requirement in whole or in part when (1) the only record linking the subject and the research would be the consent document and the principal risk of the study would be potential harm resulting from a breach of confidentiality, (2) the research involves no more than minimal risk of harm and involves no procedures for which written consent is not normally obtained in a clinical context, or (3) when the research involves no more than minimal risk of harm and the subjects or legally authorized representatives are members of a distinct cultural group or community in which signing forms is not the norm, and there is an appropriate alternative mechanism for documentation. 44 Waivers of documentation are allowed for both specific and broad consents. One situation in which a waiver of written documentation (i.e. the participant’s signature) for a broad consent might be used would be when the information in question is gathered through a phone survey. There may also be broad consent documentation waivers requested when involving a distinct cultural group in which signing forms is not the norm. In all of cases of waiver, the participant may still be provided a written summary of the “key information essential to decision making” even if the documentation requirement is waived. Note that the FDA regulations do not allow a waiver of documentation requirements.
Under certain conditions, an IRB may approve the use of a short-form written consent. 45 In these cases, oral presentation of informed consent information is accompanied by a short-form written consent document (stating that the elements of consent have been presented orally) and a written summary of what has been presented orally. A witness to the oral presentation is required, and the participant (or representative) must be given copies of the short form document and the summary. The participant must sign the short form document and the witness must sign both the short form and the summary.
E-consents may be considered written documentation under either set of regulations and are within the scope of the IRBs’ power to authorize as an alternate way of fulfilling written documentation requirements. Both HHS and FDA specifically allow electronic signatures on research consent documents, provided they are legally valid in the specific jurisdiction. 46 , 47
Finally, the new regulations require that for federally funded or conducted research a copy of an IRB-approved consent form must be published on a publicly available federal website after the study is closed to recruitment and no later than 60 days after the last study visit by any subject, as required by the protocol. 48 Even if a form has been modified during the course of the trial (see 4.4 below), or variations allowed for different kinds of participants (e.g., adults and children) or for different sites of a multisite trial, only one version is required to be posted. There is a mechanism to allow redaction of information that the sponsoring agency feels should not be posted on a public website. At this time, the consent form posting requirement can be satisfied by posting the form on ClinicalTrials.gov or in a docket folder on Regulations.gov. 49
Re-consent for a registry should be rare. It may be needed if a broad consent was not used initially and there are significant changes to the protocol, risks, or other aspects of information which should be shared with participants and consent for those changes is necessary. Such protocol revisions must be reviewed and approved by an IRB prior to the revised consent being utilized, except when necessary to eliminate apparent immediate hazards to subjects. Re-consent may also be necessary if the participants were below the age of consent when initially enrolled but reach the age of majority when the registry is still active. 50 The decision to change the informed consent form and subsequently obtain the re-consent of participants needs to be carefully considered due to possible challenges in obtaining the re-consent. Challenges may be particularly evident for registries that have been in place for several years. These difficulties are part of what prompted the interest in broad general initial consents. In situations where the initial consent does not cover the change, registries may seek IRB waiver of re-consent requirements.
For studies in which re-consent is sought, registry developers should consider the potential effects of selection bias and the implications for external validity. Re-consented participants may be systematically different from non-re-consented participants. For example, participants that have not re-consented may have died or been lost to followup for health-related reasons, leaving an overall healthier group of participants. Additionally, even among those who can be contacted, individuals who agree to continue participation may be different from those who refuse to provide consent. As a result, one important requirement for studies that undertake re-consent may be to evaluate characteristics of the original study population, as compared with the subset of patients that do re-consent, and consider the implications for research outcomes. The evaluation of whether re-consents are more common for particular populations should be done for any analyses that have comparative arms.
Minor changes to a consent document do not necessitate re-consent. Re-consent may be appropriate, however, where the terms of the study or the background preconditions have changed. In some long-term studies, re-informing participants, but not re-consent, may be the best option. Even where re-consent is indicated, IRBs may waive requirements. Alternatively, data collection, sharing, and reporting for participants who cannot be re-consented could be maintained in accordance with the terms of the original consent. In those situations in which a re-consent process is implemented, participants should be told the reasons for the recontact and given a summary of consent form changes. Additionally, as with the original consent, documentation of the re-consent should be maintained as required by the registry, the IRB, and any relevant regulations. Going forward, the use of broad consent should address many of these problems.
Even with the revised Common Rule regulations, which explicitly address database and biobank research, some of the regulatory requirements appear better suited to traditional clinical research trials than to registries. For example, of the nine basic elements listed earlier, requirements 4 (alternatives) and 6 (compensation/injury) are crafted to address issues raised in traditional clinical trials, rather than registries. Other elements have aspects that clearly encompass registry research (such as basic elements 1, 2, 7 and specifically 9), but other parts seem less applicable, since registries will not involve “experimental procedures” that must be identified, entail no physical “discomforts to the subject,” and do not pose a risk of (physical) “research-related injury.”
Other requirements may pose unique challenges for registries, such as basic element 8, which requires that subjects be informed about a right to withdraw. While registry participants may refuse to provide additional information about their medical status or care, withdrawing from a registry may undermine the data collection. In situations where the data have been anonymized, withdrawal will likely prove impossible. In many such cases, registry informed consents may contain language notifying subjects that in the event of withdrawal, data that was collected prior to the withdrawal may continue to be used and disclosed according to the consent in order to preserve the scientific integrity of the registry. However, even where data have not been anonymized, some argue that the registry must retain all records to be maintain validity. The FDA explicitly requires the retention of identifiable data even after a subject withdraws from a study. HHS permits the retention of such data, but also permits the investigator to omit or destroy the data if retention is not required by FDA regulations for study integrity. OHRP suggests that IRBs provide guidance on documentation of participant withdrawal. Moreover, the OHRP guidance dated September 21, 2010, on this issue clarifies that once a subject withdraws, the investigator must stop interacting with the subject to obtain data, and stop collecting identifiable private information from other sources unless the subject specifically provides consent to the continued data collection. 51
The best approach is to make sure that the informed consent form addresses what will happen after withdrawal (in additional to notifying participating of their right to withdraw). Withdrawal of consent after a broad consent might only affect future studies, but not current or past ones, or it might mean that the data/specimen will still be used but stripped of identifiers. This is a less than ideal solution for both sides—the patient will not be able to continue to control the use of the data and without identifiers research uses may be more limited. Potential participants will also need to be told that when a broad consent is used it may be difficult to track down all distributions of their data and that will affect the ability to “withdraw” their data from future studies.
The HIPAA Privacy Rule may apply to uses or disclosures of health information into or out of a registry, or the use of such information to create a registry, or both. In addition, because the HIPAA Privacy Rule protects individually identifiable health information held by covered entities, the Privacy Rule requirements may apply even if the human subjects research regulations do not. Moreover, the FDA requires that all of the qualified entities with which it contracts to provide analyses of drug safety data follow the minimal requirements of the Privacy Rule, regardless of whether they are a HIPAA-covered entity. 52 Chapter 7 describes the general Privacy Rule framework in this context and the specifics of coverage. The Privacy Rule requires a covered entity to obtain written authorization for the use or disclosure of an individual’s PHI for research purposes unless the use or disclosure is permitted by another provision of the Rule (e.g., where an IRB waiver of authorization applies). It is worth emphasizing that a subject’s informed consent to participate in research can be combined with a HIPAA authorization in one document, thus eliminating unnecessary pages in what are often extremely long consent documents and potentially reducing the confusion of participants. There are six core elements and three required statements for a valid HIPAA authorization: 53
A description of the PHI to be used or disclosed, identifying the information in a specific and meaningful manner.
The names or other specific identification of the person or persons (or class of persons) authorized to make the requested use or disclosure.
The names or other specific identification of the person or persons (or class of persons) to whom the covered entity may make the requested use or disclosure.
A description of each purpose of the requested use or disclosure.Authorization expiration date or expiration event that relates to the individual or to the purpose of the use or disclosure. “End of the research study” or “none” are permissible for research, including for the creation and maintenance of a research database or repository.
Signature of the individual and date. If the individual’s legally authorized representative signs the Authorization, a description of the representative’s authority to act for the individual must also be provided.
A statement of the individual’s right to revoke the Authorization in writing, and either: (1) a description of how to do so, and the exceptions to the right to revoke authorization, or (2) reference to the corresponding section of the covered entity’s notice of privacy practices.
Whether treatment, payment, enrollment, or eligibility for benefits can be conditioned on the individual’s signing the Authorization, including research-related treatment, and consequences of refusing to sign the Authorization, if applicable.
A statement of the potential for the PHI to be redisclosed by the recipient and no longer protected by the Privacy Rule. This may be a general statement that the Privacy Rule may no longer protect health information disclosed to the recipient.
Authorization is not needed for activities that are “preparatory to research,” which may include scanning a patient database to determine feasibility for creating a registry. Before allowing an investigator access to PHI for such purposes, however, the covered entity must obtain from the researcher representations that: (1) the use or disclosure of PHI is sought solely for purposes preparatory to research, (2) no PHI will be removed from the covered entity during the review, and (3) access to the PHI is necessary for the research purposes. 54 These preparatory activities may aid investigators in the identification of potential research participants. Subsequent contact of potential research participants for purposes of obtaining authorization for the use or disclosure of the individual’s PHI may be permitted under the Privacy Rule in a variety of ways depending on the relationship between the investigator and the covered entity. An investigator who is a workforce member of the covered entity is permitted to contact potential participants directly or through another person at the covered entity, such as a treating provider, to obtain authorization. Alternatively, a covered entity is permitted to hire a business associate—who may be an investigator—to contact patients to obtain authorization on behalf of the covered entity. Finally, a covered entity is permitted to provide contact information of potential research subjects to an investigator who is not part of the covered entity or a business associate, if the covered entity obtains documentation that an IRB or privacy board has waived the authorization requirement for the disclosure.
Additionally, uses or disclosures of a decedent’s PHI to a research registry or from a registry for research purposes do not require an authorization (as long as certain representations are provided to the covered entity that is providing the information). 55 This is consistent with the definition of “human subjects” under the research regulations which include only living individuals. Similarly, authorizations are also not required for uses or disclosures of de-identified datasets, provided the information has been de-identified in accordance with the Privacy Rule. 56 Nor are authorizations required for uses or disclosures of “limited datasets,” as defined by the Rule (so long as a data use agreement is in place with the recipient of the limited dataset). 57 See Chapter 7.
In addition, an IRB or privacy board may waive or alter aspects of the HIPAA authorization requirements. Like the requirements for a waiver or alteration under the human subjects research regulations described above, these are limited to situations in which the research (including access to the PHI) could not practicably be carried out without the waiver or alteration, and the use or disclosure information involves no more than minimal risk to privacy because there is: (a) an adequate plan to protect the identifiers from improper use or disclosure; (b) an adequate plan to destroy identifiers if possible; and (c) adequate written assurances that the PHI will not be reused or disclosed except as required by law, as needed for research oversight, or for other research in a way permitted by the Privacy Rule. 58
Finally, if a subject was enrolled in a research protocol prior to the compliance date of the Privacy Rule (for most covered entities, April 14, 2003) and pursuant to a valid informed consent, an authorization may not be required unless after the compliance date another informed consent is sought from the subject. 59 This provision may be especially relevant to registries that were created prior to the application of the Privacy Rule.
The HIPAA Privacy Rule also speaks to the issue of withdrawal from a registry. The Privacy Rule explicitly gives individuals the right to revoke their authorization for the use and disclosure of protected health information (the revocation must be in writing), except to the extent that a covered entity has already relied on the authorization. HHS guidance on the application of the Privacy Rule to research makes it clear that a covered entity that has disclosed PHI for research in reliance on an authorization is not required to retrieve information it disclosed prior to receiving the revocation, and may also continue to use and disclose PHI already obtained to the extent necessary to preserve the integrity of the study (e.g., as necessary to account for the subject’s withdrawal). As noted above, FDA states that the data gathered as part of research under their regulatory authority is necessary and must be retained; but even for those registries outside the scope of FDA oversight, HIPAA permits the continued use of data as necessary to protect the integrity of the research.
In the past, concerns had been raised that the HIPAA authorization requirements were not sufficiently harmonized with the human subjects research informed consent requirements. 60 , 61 This was due to the fact that, while a HIPAA authorization could be combined with a research informed consent document (and elements already present in the research consent were not required to be repeated in the authorization), there were some situations in which an additional separate authorization may have been necessary for a separate research activity or future research activity. In January 2013, HHS published changes to the HIPAA Rules that addressed these issues. In particular, the Privacy Rule now permits the use of a compound authorization to authorize the use or disclosure of an individual’s PHI for a conditioned research activity (e.g., a clinical trial where treatment is conditioned on the individual’s authorization) as well as an unconditioned research activity (e.g., the use or disclosure of PHI to create or contribute to a separate research database or repository), provided that the compound authorization clearly differentiates between the conditioned and unconditioned research components and provides the opportunity for the individual to opt in to the unconditioned research activities. The revised Common Rule continues to harmonize the research regulations with the Privacy Rule; it specifically modifies HHS’ interpretation of the Privacy Rule’s research authorization requirements to permit broad authorization for future research uses and disclosures, as long as the future research purposes are adequately described such that it would be reasonable for the individual to expect that her or his PHI could be used or disclosed for such future research.
In addition to the general requirements discussed above, there are also additional requirements for certain specific research populations. The revised Common Rule indicates that the focus of the IRB should be on populations that are vulnerable to coercion or undue influence and list four categories--children, prisoners, economically or educationally disadvantaged individuals, and individuals with impaired decision making capacity. FDA has regulations that apply to children (which, for the most part, match the HHS regulations). Both also allow research to be conducted with adults lacking decisional capacity, although consent must be obtained by a “legally authorized representative,” (LAR) who may be a guardian, proxy, or surrogate decision-maker (the terms are defined by state law). The revised Common Rule defines the LAR as:
an individual or judicial or other body authorized under applicable law to consent on behalf of a prospective subject to the subject’s participation in the procedure(s) involved in the research. If there is no applicable law addressing this issue, legally authorized representative means an individual recognized by institutional policy as acceptable for providing consent in the nonresearch context on behalf of the prospective subject to the subject’s participation in the procedure(s) involved in the research. 62
Likewise, HIPAA also allows for authorizations from “personal representatives” (again, generally defined by state law). Broad consents are allowed for research involving incapacitated adults and research involving children, provided the regulatory requirements for broad consent are met.
Of particular interest to registries are the research regulations pertaining to children. Research involving children must fit into one of four categories: minimal risk, 63 greater than minimal risk/prospect of direct therapeutic benefit, 64 minor increase over minimal risk/likely to yield generalizable knowledge about subject’s disorder or condition, 65 and research not otherwise approvable but authorized by the Secretary of HHS or Commissioner of FDA in consultation with an expert panel. 66 Most registry research is likely to fall into the minimal risk category. For these studies, permission must be obtained from at least one parent/guardian and assent obtained from the child, if the child is capable of assenting.
Waivers of both permission and assent are possible. Under HHS regulations, a waiver of parental permission is allowed under the same conditions that allow for a waiver of informed consent in adult populations; 67 or when parental permission is not a reasonable requirement to protect the subjects. 68 FDA regulations do not allow for waivers of parental permission. Both HHS and FDA regulations allow a waiver of assent when the research involves an intervention holding the potential for direct therapeutic benefit and is not available except through participation; 69 or when parental permission is waived in accord with section 46.116 of Subpart A. Moreover, when some or all of the children involved are not capable of providing assent, an IRB can determine that assent in not necessary (for the child or children in question, or for all children if appropriate). Both sets of regulations allow an IRB to determine that permission is only required from one parent, even when required from both under §§46.406 or 407 or §§50.53 or 54, in limited circumstances. 70 Where authorization must be obtained for the use or disclosure of PHI, the HIPAA Privacy Rule requires authorization from only one personal representative of the individual, such as one parent of a minor child, and does not require assent of the child.
OHRP has indicated that when the research in question involves a treatment for which the child would have legal authority to consent, the child’s consent may suffice and parental permission may be unnecessary. The HIPAA Privacy Rule also generally provides that when a minor has legal authority to consent to a particular healthcare service without the involvement of a parent, the minor and not the parent has authority to act as the individual with respect to the PHI pertaining to that healthcare service. State statutes granting decision-making authority to minors vary. Many address issues such as treatment for sexually transmitted infections (STIs), access to contraception, and some even allow consent for mental health or substance abuse treatments. Registries involving these areas may be able to rely on the minor’s consent, rather than the parental permission/assent framework. However, more specific legal guidance on the particulars of state statutory interpretation may be warranted in these situations.
Another important consideration is what to do when a minor who is involved in a registry reaches the age of majority. OHRP interprets the continuing consent standard to require that legal consent be sought from the participant upon reaching the age of majority. An authorization under the Privacy Rule, including one signed by a parent as the personal representative of a minor, remains valid until it expires or is revoked, even if such time extends beyond the child’s age of majority. If the authorization expires on the date the minor reaches the age of majority, a covered entity would be required to obtain a new authorization signed by the individual in order to further use or disclose PHI covered by the expired authorization (or ensure that the use or disclosure falls within another regulatory permission in the Rule). Registries that involve children that will retain identifiable information past the child’s age of majority will need to take steps to gain the appropriate consent and, if necessary, authorization for continued use. Less clear is whether investigators should seek a child’s assent to continued participation when the initial consent was provided by parents at a time when the child lacked the capacity to play any role in decision making. If we follow the logic of reconsent in this context, continued assent is as important as the later consent to participation.
There are three current approaches to consent: opt-in, opt-out, and non-consent. An opt-in approach assumes that an individual will not be part of the registry until they have specifically consented to participation. An opt-out approach assumes that all individuals will be part of a registry, unless there is a specific refusal to participate. Note that in order for an IRB to approve an opt-out approach for nonexempt, HHS-supported human subjects research, the researchers must document that the waiver of informed consent is appropriate for the research. Finally, a non-consent model does not seek or require individual consent or refusal, but includes all relevant individuals in a registry. This latter option will be problematic if the research falls within the federal regulations. The labeling of the approaches may vary in the literature, but the general concepts remain consistent. Additionally, some registries involve a mix of one or more approaches or a combined consent mechanism, where an opt-in approach is used for one aspect (access to a particular treatment) and non-consent for the other (listing in the treatment registry). This may also be referred to as “conditional access.”
An opt-in procedure may involve a consent process similar to that used for clinical research protocols. It may be used separately for a registry, or it may be appended to a consent document used for a particular treatment (for example, individuals who consent to the use of a particular device may also be asked to participate in a registry for that device). While an opt-in approach has the benefit of assuring compliance with the Federal regulations, a number of the regulatory requirements are difficult to apply to registries (as discussed above). This led many to suggest a modified opt-in approach—using elements of the clinical research framework but adjusting to fit the registry model. But, even with a modified model, there are concerns that the strict informed consent requirements of the clinical research consent will have negative effects on subject selection, resulting in biases that will undermine the validity and thus affect the usefulness of the registry. An analysis of the Canadian Stroke Network estimated that dealing with consent issues cost $500,000 over the first 2–3 years of the registry, and the requirement to obtain written informed consent introduced significant selection biases undermining the usefulness of the registry. 71 The newly approved broad consent category should address many of these concerns and should be considered (along with an electronic consent tracking mechanism) for these types of registry studies.
An opt-out procedure shifts the presumption from one in which each individual must consent to participate, to one in which each individual must refuse to participate. There is a great deal of discussion about the usefulness of an opt-out model, particularly for registries (e.g., organ donation registries). To be a valid opt-out model, individuals must be fully informed about the existence of the registry and their rights to opt-out of participation. In many cases, the information requirements are the same as the information requirements for an opt-in procedure—the only difference is that instead of explicitly agreeing to participate, the person must take steps explicitly to refuse to participate. While the information requirements may not change, the psychological shift may be significant. If the expectation is that everyone will participate, people may be more inclined to acquiesce. There is evidence in other areas of decision making that setting the default to participation results in greater inclusion than setting the default to non-participation, even when individuals are given an easy way to opt-in or opt-out. 72 While the Federal research regulations appear to assume an opt-in approach, in some circumstances an IRB could approve a modification that allowed a shift to an opt-out. In order for an IRB to approve an opt-out approach for non-exempt, HHS-supported human subjects research, the researchers must document that the waiver of informed consent is appropriate for the research. An opt-out approach may be especially useful for some registries. Nonetheless, Privacy Rule requirements will preclude this approach unless the situation fits within one of the delineated permissible uses without an individual authorization (e.g., with a waiver of authorization for research or for public health activities).
The research involves no more than minimal risk to the subjects; The research could not practicably be carried out without the requested waiver or alteration;If the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format;
The waiver or alteration will not adversely affect the rights and welfare of the subjects; andWhenever appropriate, the subjects or legally authorized representatives will be provided with additional pertinent information after participation. 73
For example, the Vermont Diabetes Information System (VDIS) was a quality-improvement, registry-based decision support and reminder system targeted to primary care physicians and their patients with diabetes. With IRB approval, VDIS incorporated an opt-out consent process. 74 Patients are notified by mail of their eligibility and inclusion in the registry and given a mechanism to opt-out by calling a toll-free number.
Non-consent is not really a consent mechanism and thus will not be addressed here in detail. Nonetheless, this approach may, and probably should, entail providing participants with information about the registry. That is to say, even when consent is waived, there are ethical reasons to provide some notification and information. The format and process of disclosure may vary. In some cases, general public notifications (perhaps listing on a website, or posting prominently in a place likely to be seen) will be sufficient. In other cases, individual notification may be appropriate. A non-consent approach is used currently for registries that fall outside the federal research regulations (and thus not subject to the Common Rule or FDA regulations) such as state-mandated public health reporting or quality improvement activities. One primary methodological advantage of the non-consent approach in no-risk and minimal risk studies is that it can function to reduce concerns about biases introduced by the consent process, such as those that occur when individuals who consent to participate in the registry systematically differ from those who do not or cannot consent. Besides debates about when the use of a non-consent approach is acceptable (based on the level of permissible risk), most of the focus in this area should be on the type and extent of required notifications.
Consents may be broad or narrow. One term that is sometimes used is a so-called “blanket consent” approach, which asks for consent for all uses, unless one is specifically excluded. Blanket consent should be distinguished from “broad consent,” described earlier. A broad consent refers to use in a wide array of biomedical research studies, it is not consent for all uses or even uses outside the biomedical research consent (such as for forensic use or for use by immigration authorities). A blanket consent model is sometimes seen in non-research contexts. For example, patients entering a health institution are sometimes asked to sign what might be described as a blanket consent (the validity of which may be questionable). But even in that context the consent is for all needed clinical care, and would not cover research. Another example may be a consent form for a specific clinical procedure which has a notation at the bottom of the form allowing the use of leftover tissue in any way deemed appropriate by the institution. Blanket consents are not generally viewed as valid exercises of autonomy and thus may not truly be considered to be “informed consent.” At best, blanket consent may be viewed as a type of notification procedure, alerting individuals to the possible uses of their tissue or information. Neither the revised Common Rule nor the Privacy Rule permit blanket consents. Some registries may have been created using a type of blanket consent before the compliance date of the Privacy Rule, and may currently fall under an exemption to the human subjects research regulations; in these circumstances the previously obtained blanket consent may be deemed sufficient.
The real question related to the scope of consent is to what extent consent can and should authorize future unspecified uses. In other words, how broad a consent is permissible? The exercise of autonomy should include the ability to consent both to specific and to nonspecific research participation. An individual who would like to give expansive permission for the use of their data in any future registry (or for use in a particular registry, but include permission that the information may be shared with investigators for any future research query) is exercising a form of autonomy. In addition, part of the issue is in determining whether an expansive consent was truly informed. In the absence of specific details about the future uses, decision making is necessarily less informed than if every future use is spelled out clearly. However, the ethical doctrine of informed consent does not require this level of detail. Moreover, requiring multiple consent dialogues may respect autonomy less than permitting expansive consent if the individual does, in fact, wish to give permission and does not want continued recontact. The revised Common Rule now allows broad consent for biobank and databank research. By contrast, in other areas such as consent to participate in a clinical trial, expansive consents (e.g., “I give consent to participate in any clinical trial”) are insufficient on both ethical and regulatory grounds.
Consent is only one aspect of the protections in place for human research participants. The second major part involves IRB review and oversight. Other chapters discuss the oversight roles for IRBs and registry governance boards.
Community consultation, a third concept that usually appears in the context of discussions on human subjects research consent, is not actually part of this system of protections. In fact, there is no simple community analog to individual consent. Consent requirements for research arise from the principle of autonomy, and there is no corresponding principle at the community level. Thus, concepts such as “community consent” or “community authorization” can be incoherent, in part because there is no unitary concept of a community. Communities may be defined on social, biological, religious, racial, cultural, or geographic grounds. Most people belong to multiple, sometimes overlapping, communities. Some of these communities may have a designated spokesperson, but this individual may not represent the interests of all members of the community. (Consider, for example, the complex relationship between the Pope and Catholics in the United States.) Other communities have no clearly identified spokesperson. It is inappropriate to consider community consultation as a replacement for individual consent. Rather than view community involvement as an aspect of consent, it should be considered as part of oversight (and an analog of IRB review). 75 Nevertheless, community involvement in the design and oversight of a registry may be particularly important when the registry involves socially identifiable groups that have been subject to historic discrimination or when it involves sensitive genetic information. In addition, in some cases, community involvement can enhance participant understanding of consent and thereby increase individual participation.
Given the nature of registry research, some elements of informed consent should be given special consideration, including: the scope of the use of registry data, potential for recontact, withdrawal, and information regarding the electronic data security and management to be employed.
Registries constitute a valuable resource, since investigators often draw upon them to address questions extending far beyond those envisioned when the registries were first created. Therefore, informed consent for registry research that allows broad data sharing is optimal for promoting science. There may be instances, however, such as with respect to research on specific diseases (e.g., HIV/AIDS research), where more specific consent may be appropriate. In the meantime, registry developers should not only provide clear parameters regarding the scope of use of registry data when first creating the registry, but should also develop a mechanism to consider how future, possibly unanticipated, requests for data access will be evaluated. The registry governance board can play an important role in this situation.
Individuals should be informed how their data/samples will be used at the point of entry into the registry. Whether and how participants will be recontacted should be established at the outset and included in the consent form. Exceptions should be considered specifically where data/samples were made irretrievably anonymous, since recontact would then be impossible. It is important to inform registry participants that the anonymization of their data will make withdrawal from the registry impossible.
Many issues governing withdrawal from a registry have been discussed in this chapter. Consensus needs to be developed regarding whether withdrawal should be presented as an option to participants in the initial consent, and, if it is an option, how withdrawal will be managed. While withdrawal from a traditional research study is a basic subject right, withdrawal of collected data, even from clinical trials, may be restricted. It is extremely important that registry creators develop initial rules and procedures for withdrawal and fully inform participants of them.
Given the public concerns about electronic data security, participants in the registry should be clearly informed as to the physical security of their data and/or biospecimens, including methods of coding and removal of identifiers, encryption techniques, potential for cloud computing, and quality assurance policies. As well, participants should be informed about the process of releasing and transferring data to future investigators as it relates to maintaining confidentiality. In some cases, this information will reassure participants, potentially increasing consent rates.
The following is an outline of potential elements to consider when developing consent forms and engaging in consent dialogs for registry research. These elements were generated from the applicable HHS, FDA, and Privacy Rule requirements and include consent aspects particularly relevant to registry research. These are all issues that should be considered; there may be additional legal requirements (e.g., for a HIPAA authorization). The outline below should not be viewed as comprehensive or even applicable to all registries. Some registries will modify this outline to meet specific needs, while others will follow a consent procedure similar to one used for traditional clinical trials. However, this outline provides a starting place for understanding the scope of informed consent for registry participation. It is important to note that the responsibility for obtaining and assuring appropriate informed consent rests on multiple parties, including sponsors, investigators, Protocol Review Committees (PRCs), and IRBs. Moreover, despite the multitude of elements listed below, every effort should be made to keep consent forms as short as possible and at approximately a fifth- to eighth-grade reading level.
The name of the specific registry for which consent is being obtained. An explanation of the purposes of the registry (why it was created, who will be included). The expected duration of participation. A description of the procedures entailed. The approximate size of the registry (if applicable and can be determined).When human genetic research is anticipated, information should include possible consequences of genetic testing (e.g., insurance risks, paternity determinations, potential risks to family and community) and other related confidentiality risks, if such risks are determined to be real and relevant.
A statement about whether and how findings will be communicated to participants. If applicable, a statement about whether registry results will be published.A statement about the impact of participation on the subject’s access to his/her medical records (e.g., that access may be limited until all work on the registry is completed).
If applicable, a description that the data/specimens will be broadly shared and may be used for future research that is not yet identified.
The fact that the data/specimens may be transferred to other institutions and explanation of a data transfer security plan.
A description of when recontact might be necessary, and how recontact will be handled. A statement of whether there are any costs to participation and/or any payment for participation.The consequences of a subject’s decision to withdraw from the research, including the possibility that the previously collected data will continue to be used, and procedures for orderly termination of participation by the subject.
Details on who to contact for answers to pertinent questions about the research and research subjects’ rights.
As appropriate, any state-specific addenda.The 21st Century Cures Act requires harmonization (“to the extent practicable”) between HHS and FDA research regulations by the end of 2019. 42 USCA Sec. 289.
45 CFR 46.104. 45 CFR 46.104(b)(2). 45 CFR 46.104 (d)(4). 45 CFR 46.104 (d)(7). 45 CFR 46.104 (d)(8).Casarett D, Karlawish J, Andrews E, et al. Bioethical Issues in Pharmacoepidemiologic Research. In: Strom BL, editor. Pharmacoepidemiology. 4th ed. Sussex, England: John Wiley & Sons; 2005. p. 593.
45 CFR 46.102 (l)(2).See, e.g., Office of the Assoc. Dir. for Sci., Ctrs. for Disease Control and Prevention, CDC-SA-2010–02, Distinguishing Public Health Research and Public Health Nonresearch. Document dated July 29, 2010. [August 10, 2018.] https://www .cdc.gov/od /science/integrity /docs/cdc-policy-distinguishing-public-health-research-nonresearch.pdf.
Centers for Disease Control and Prevention. Guidelines for Defining Public Health Research and Public Health Non-Research. Oct 4, 1999. [July 16, 2018]. http://www .cdc.gov/od /science/integrity/docs /defining-public-health-research-non-research-1999.pdf.
U.S. Department of Health and Human Services; Office for Human Research Protections. Activities Deemed Not to Be Research: Public Health Surveillance 2018 Requirements [November 7, 2018]. https://www .hhs.gov/ohrp /regulations-and-policy /requests-for-comments /draft-guidance-activities-deemed-not-be-research-public-health-surveillance/index.html.
45 CFR 164.501. 45 CFR 46.104(d)(4)(iii)Johnson N, Vermeulen L, Smith KM. A survey of academic medical centers to distinguish between quality improvement and research activities. Qual Manag Health Care. 2006 Oct-Dec;15(4):215–20. [PubMed : 17047495 ]
U.S. Department of Health and Human Services; Office for Human Research Protections. Quality Improvement Activities – FAQs. [July 16, 2018]. https://www .hhs.gov/ohrp /regulations-and-policy /guidance/faq /quality-improvement-activities/index .html.
National Committee on Vital and Health Statistics. Recommendations on Privacy and Confidentiality, 2006–2008. Section I: Privacy and Confidentiality in the Nationwide Health Information Network. May, 2009. [July 16, 2018]. https://ncvhs .hhs.gov /wp-content/uploads /2014/05/privacyreport0608.pdf.
Privacy, Sec., and Confidentiality Subcomm., Nat’l Comm. on Vital and Health Statistics, Health Information Privacy Beyond HIPAA: A 2018 Environmental Scan of Major Trends and Challenges. Documented dated December 13, 2017. [August 10, 2018.] https://ncvhs .hhs.gov /wp-content/uploads /2018/05/NCVHS-Beyond-HIPAA _Report-Final-02-08-18.pdf.
Schneider S, Kerwin J, Robins C, et al. Consumer engagement in developing electronic health information systems: Final report. Rockville, MD: Agency for Healthcare Research and Quality; Jul, 2009. [July 16, 2018]. (Prepared by Westat, Rockville, Maryland, under Contract No. 233-02-0087). AHRQ Publication Number 09-0081-EF. http://healthit .ahrq .gov/sites/default/files /docs/citation/09-0081-EF.pdf.
Secretary’s Advisory Comm. on Human Research Protections, Attachment D - Recommendations for a Broad Consent Template. [August 10, 2018.] https://www .hhs.gov/ohrp /sachrp-committee /recommendations/attachment-d-august-2-2017/.
Miller FG. Research on medical records without informed consent. J Law Med Ethics. 2008 Fall;36(3):560–6. [PubMed : 18840249 ]
Barbara J. Evans. Appropriate Human-Subject Protections for Research use of Sentinel System Data. FDA Sentinel System Meeting Series Issue Brief: Legal Issues in Active Medical Product Surveillance. Mar, 2010. [July 16, 2018]. https://www .brookings .edu/wp-content/uploads /2012/04/Panel-3-Issue-Brief.pdf.
45 CFR 46.116(a)(1). 45 CFR 46.116(a)(3). 45 CFR 46.116(a)(2). 45 CFR 46.116(a)(5)(i). 45 CFR 46.116(a)(6). 45 CFR 46.116(b); 21 CFR 50.25(b).Informed Consent Elements; Final rule. 76 Federal Register 2 (4 January 2011), pp. 256–270. [July 16, 2018]. https://www .gpo.gov/fdsys /pkg/FR-2011-01-04/pdf/2010-33193 .pdf.; 21CFR 50.25(c).
45 CFR 46.116(c); 21 CFR 50.25(b). 45 CFR 46.116(f). 45 CFR 46.116(g) 21 CFR 50.23.U.S. Department of Health & Human Services. Informed Consent Requirements in Emergency Research. [July 16, 2018]. http://www .hhs.gov/ohrp /policy/hsdc97-01.html.
21 CFR 50.24. 45 CFR 46.116 (d)Secretary’s Advisory Comm. on Human Research Protections, Attachment C - Recommendations for Broad Consent Guidance. [August 10, 2018.] https://www .hhs.gov/ohrp /sachrp-committee /recommendations/attachment-c-august-2-2017/index.html.
Homer N, Szelinger S, Redman M, et al. Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays. PLoS Genet. 2008 Aug;4(8):e1000167. [PMC free article : PMC2516199 ] [PubMed : 18769715 ]
Jacobs KB, Yeager M, Wacholder S, et al. A new statistic and its power to infer membership in a genome-wide association study using genotype frequencies. Nat Genet. 2009 Nov;41(11):1253–7. [PMC free article : PMC2803072 ] [PubMed : 19801980 ]
45 CFR 46.117(c). 45 CFR 46.117(b)(2); 21 CFR 50.27(b)(2).U.S. Department of Health and Human Services; Office for Human Research Protections. FAQs, Can an electronic signature be used to document consent or parental permission? [July 16, 2018]. https://www .hhs.gov/ohrp /regulations-and-policy /guidance/faq /informed-consent/index.html.
Office for Human Research Protections, US Department of Health and Human Services, et al. The Use of Electronic Informed Consent. Documented dated December 2016. [August 10, 2018.] https://www .fda.gov/downloads /drugs/guidancecomplianceregulatoryinformation /guidances/ucm436811.pdf.
45 CFR 46.116(h)Office for Human Research Protections. Department of Health and Human Services. Clinical Trial Informed Consent Form Posting (45 CFR 46.116(h)). [February 28, 2019.] https://www .hhs.gov/ohrp /regulations-and-policy /informed-consent-posting/index .html.
Office for Human Research Protections, Department of Health and Human Services, Research with Children FAQs. [August 10, 2018.] https://www .hhs.gov/ohrp /regulations-and-policy /guidance/faq /children-research/index.html.
U.S. Department of Health & Human Services. Guidance on Withdrawal of Subjects from: Data Retention and Other Related Issues. [July 16, 2018]. https://www .hhs.gov/ohrp /regulations-and-policy /guidance/guidance-on-withdrawal-of-subject/index .html.
Pub. L. No. 110-85, 121 Stat. 823 (2007) (Codified in 21 U.S.C.).45 CFR 164.508. [August 10, 2018]. For additional information on authorizations for research, see http: //privacyruleandresearch .nih.gov/authorization.asp.
45 CFR 164.512(i)(1)(ii). 45 CFR 164.512(i)(1)(iii). 45 CFR 164.514 (a)-(c). 45 CFR 164.514(e). 45 CFR 164.512(i)(2). 45 CFR 164.532.Nass SJ, Levit LA, Gostin LO, Committee on Health Research and the Privacy of Health Information, editors. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. National Academies Press; The HIPAA Privacy Rule; Institute of Medicine; [June 24, 2020]. http://www .nap.edu/catalog/12458.html [PubMed : 20662116 ]
45 CFR 46.102(i). 45 CFR 46.404; 21 CFR 50.51. 45 CFR 46.405; 21 CFR 50.52. 45 CFR 46.406; 21 CFR 50.53. 45 CFR 46.407; 21 CFR 50.54. 45 CFR 46.408(a), (b); 45 CFR 46.116. 45 CFR 46.408(c). 45 CFR 46.408(a); 21 CFR 50.55. 45 CFR 46.408(b); 21 CFR 50.55(e).Tu JV, Willison DJ, Silver FL, et al. Impracticability of informed consent in the Registry of the Canadian Stroke Network. N Engl J Med. 2004 Apr 1;350(14):1414–21. [PubMed : 15070791 ]
Thaler RH, Sunstein CR. Nudge: Improving Decisions About Health, Wealth, and Happiness. Yale: Yale University Press; 2008.
45 CFR 46.116(f)(3).Littenberg B, MacLean CD. Passive consent for clinical research in the age of HIPAA. J Gen Intern Med. 2006 Mar;21(3):207–11. [PMC free article : PMC1828090 ] [PubMed : 16637821 ]
Marshall PA, Berg JW. Protecting communities in biomedical research. Am J Bioeth. 2006 May-Jun;6(3):28–30. discussion W46-8. [PubMed : 16754445 ]
| Description | The Ontario Stroke Registry is a registry of stroke patients in Canada. The registry is a non–consent-based registry that collects detailed clinical data on the acute stroke event from the onset of symptoms, including emergency medical service transport, emergency department care, and hospital discharge status. The purposes of the registry are to monitor and report on the quality of stroke care in Ontario and to provide a rich clinical database for research. |
|---|---|
| Sponsor | CorHealth Ontario, with original funding from the Canadian Stroke Network, Networks of Centres of Excellence, and Ontario Ministry of Health and Long Term Care |
| Year Started | 2001 |
| Year Ended | 2014 |
| No. of Sites | 154 |
| No. of Patients | 100,000 |
The registry began in 2001 with Phase 1, in which data were gathered from 21 hospitals in Canada. All patients admitted to the hospital or seen in the emergency department with symptoms of acute stroke within 14 days of onset or transient ischemic attack (TIA), as well as those with acute in-hospital stroke, were included in this phase. Research nurse coordinators identified eligible patients through daily reviews of emergency and admission patient lists and approached these patients for consent. Informed patient consent was required for full data collection, linkages to administrative data, and 6-month followup interviews.
Informed consent was required for full data collection. Unfortunately, consent was obtained for only 39 percent of eligible patients. Subsequent analyses showed that patients who consented to participate were not representative of the overall stroke population, as they were less likely to have severe or fatal stroke, and also less likely to have minor stroke or TIA.
Phase 2 of the registry began in 2002, with 21 hospitals and 4 Ontario Telestroke sites. In this phase, all patients admitted to the hospital or seen in the emergency department with symptoms of acute stroke within 14 days of onset or TIA were included. Patients with in-hospital stroke were no longer recruited. In order to standardize workload across the country, a random sample of eligible patients was selected to be approached for consent for full data collection. Consent was obtained from 50 percent of eligible patients.
After obtaining consent of only 39 percent and 50 percent of patients in Phases 1 and 2, the team realized that obtaining written patient consent for participation in the registry on a representative sample of stroke patients was impractical and costly. Patient enrollment threatened the viability and generalizability of the stroke registry. The registry team published these findings in the New England Journal of Medicine in April 2004.
The registry team approached the Ontario Information and Privacy Commissioner to discuss a non-consent-based registry for Phase 3. As a result of these discussions, the registry was “prescribed” by the Privacy Commissioner under the Personal Health Information Protection Act, 2004. This decision allowed the registry to collect data legally on stroke patients without written consent.
Phase 3 of the registry included all patients presenting to emergency departments of the 11 “Stroke Centres” in Ontario and 1 center in Nova Scotia with a diagnosis of acute stroke or TIA within 14 days of onset. Nurse coordinators identified eligible patients through daily reviews of emergency and admission patient lists. Patients were identified prospectively, with retrospective chart review, without consent. No followup interviews were done. Because informed consent was not required, the data collected provided a representative sample of stroke patients seen at tertiary care centers in Canada, making the data more viable for use in research and in developing initiatives to improve quality of care. Phase 4 of the registry expanded to include a population-based, province-wide audit of stroke care delivery on a random sample of patients from every acute care institution in Ontario. Using unique encoded identifiers, data from Phases 3 and 4 of the registry are linked to population-based administrative databases housed at the Institute for Clinical Evaluative Sciences to provide information on mortality, readmissions, physicians’ services, and medication prescriptions.
The impact of obtaining informed consent should be considered in developing a registry. Requiring that registries obtain the consent of patients with acute medical conditions such as stroke may result in limited selective participation, as it is not possible to obtain consent from all patients. For example, patients who die in the emergency department and patients who have brief hospital visits may be missed. Mechanisms such as obtaining a waiver of informed consent or using the approach outlined in this case may be alternatives.
Tu JV, Willison DJ, Silver FL, et al. The impracticability of obtaining informed consent in the Registry of the Canadian Stroke Network. N Engl J Med. 2004;350:1414–21. PMID: 15070791. DOI: 10.1056/NEJMsa031697. [PubMed : 15070791 ] [CrossRef]
| Description | TARGetKids! (The Applied Research Group for Kids) is a prospective registry enrolling healthy children aged 0–5 years. The aim of the registry is to link early nutritional exposures to later health outcomes including obesity, micronutrient deficiency, and developmental outcomes. |
|---|---|
| Sponsor | University of Toronto |
| Year Started | 2008 |
| Year Ended | Ongoing |
| No. of Sites | 15 primary care practices in Toronto, Canada |
| No. of Patients | >10,000 |
Research involving children faces unique challenges, including special requirements related to the informed consent process. In this pediatric patient registry, patients are recruited at their annual well-child visits and followed up for ten years during subsequent annual well-child visits. Participation involves completion of age-specific questionnaires related to the child (asking for nutritional, behavioral, and developmental information), collection of anthropometric measurements, and collection of the child’s blood sample (4–7 mL) by a trained pediatric phlebotomist.
Consent for the registry is provided by one or both parents. By signing consent, parents also authorize the collection of their child’s health card number to allow researchers to access the child’s health records. Registry staff anticipated challenges in obtaining informed consent for these activities, particularly given the infrequency of contact with patients and the fact that blood sample collection is not part of normal clinical care during these annual visits. After reviewing the registry protocol, a research ethics board recommended that steps be taken to minimize coercion when recruiting and obtaining consent from patients.
Two weeks before a scheduled well-child visit for an eligible patient, the physician’s office mails a short informational letter to the child’s home. The purpose of the letter is to provide information about the registry and prepare parents for their contact with registry staff during the visit. By providing this information in advance, the letter minimizes the possibility that parents will feel coerced to consent to registry participation.
On the day of the visit, the child’s parents are approached by a registry research assistant to provide consent for participation of their child in the registry. The research assistant explains what participation entails (i.e., completing questionnaires, collection of anthropometric measurements, and collection of a blood sample). If the parent spontaneously expresses that they wish to participate in the registry but don’t wish to participate in one of these activities, they are given the option to opt out of one portion of the registry (e.g., blood collection) while still consenting for others (e.g., questionnaires and anthropometric measurements).
The registry is now following over 10,000 children aged 0 to 5 years from 15 primary care practices in Toronto and Montreal, Canada. The participation rate for the registry is 49 percent of all eligible children in the targeted practices (defined as children aged 0–5 years with a well-child appointment scheduled). The primary reasons parents decline to participate in the registry include lack of time to answer the questionnaire, no legal guardian accompanying the child, the need to discuss participation with spouse, and their child not feeling well that day.
Of consenting parents, about 50 percent consent to the registry blood sample. One possible reason parents choose to consent to the blood sample is that they see value in the test results (i.e., for iron or vitamin D deficiency) which are not standard of care for children in Canada. Parents may perceive this as an added benefit, although, in an attempt to minimize coercion, the informed consent form and registry staff do not emphasize this fact.
Providing patients (and parents of pediatric patients) with information about the registry in advance can give them time to prepare questions and thoughtfully consider whether they wish to consent to participation. A flexible consent structure that allows patients to opt out of activities of a sensitive nature can reduce barriers to consent and participation.
Carsley S, Borkhoff CM, Maguire JL, et al. Cohort Profile: The Applied Research Group for Kids (TARGet Kids!). Int J Epidemiol. 2015;44(3):776–88. PMID: 24982016. DOI: 10.1093/ije/dyu123 [PMC free article : PMC4521122 ] [PubMed : 24982016 ] [CrossRef]
Morinis J, Maguire J, Khovratovich M, et al. Paediatric obesity research in early childhood and the primary care setting: The TARGet Kids! Research Network. Int J Environ Res Public Health. 2012 Apr;9(4):1343–54. Epub 2012 Apr 16. PMID: 22690197. DOI: 10.3390/ijerph9041343. [PMC free article : PMC3366615 ] [PubMed : 22690197 ] [CrossRef]
Birken CS, Maguire J, Mekky M, et al. Parental factors associated with screen time in preschool children in primary-care practice: a TARGet Kids! study. Public Health Nutr. 2011 Apr 5:1–5. PMID: 21466741. DOI: 10.1017/S1368980011000516. [PubMed : 21466741 ] [CrossRef]
Maguire JL, Birken CS, Jacobson S, et al. Office-based intervention to reduce bottle use among toddlers: TARGet Kids! Pragmatic, randomized trial. Pediatrics. 2010 Aug;126(2):e343–50. PMID: 20624802. DOI: 10.1542/peds.2009-3583. [PubMed : 20624802 ] [CrossRef]
| Description | The STS/ACC TVT Registry™ tracks patient safety and real-world outcomes related to transcatheter valve replacement and repair procedures. The registry collects data on patient demographics, procedure details, and facility and physician information to support analyses of patient outcomes and clinical practice patterns. The Centers for Medicare & Medicaid Services (CMS) has approved the registry as meeting the requirements outlined in the national coverage decisions for transcatheter aortic valve replacement (TAVR) and transcatheter mitral valve repair (TMVR). The participant agreement for the registry permits the registry sponsors to conduct cardiovascular research using a limited dataset. The registry sponsors’ policy requires that all research be conducted consistent with the Common Rule. |
|---|---|
| Sponsor | The Society of Thoracic Surgeons (STS) and the American College of Cardiology (ACC) |
| Year Started | 2012 |
| Year Ended | Ongoing |
| No. of Sites | 617 hospitals |
| No. of Patients | 67,353 |
Aortic stenosis is the most common valvular abnormality in the United States, and the prevalence of this condition is expected to increase as the U.S. population ages. Until recently, surgical aortic valve replacement has been the only effective treatment for adults with severe symptoms. Transcatheter heart valve procedures provide is new treatment options for patients who are not eligible for conventional heart valve replacement or repair surgery, but evidence is lacking on long-term patient outcomes.
In 2012, CMS issued a Medicare National Coverage Decision for TAVR. Under the decision, CMS permits Medicare coverage for TAVR only when (1) the procedure is performed with a device approved by the U.S. Food and Drug Administration (FDA) consistent with labeled indications and any other FDA requirement; (2) the procedure is performed in facilities meeting certain requirements; and (3) when all patients undergoing the TAVR procedure are included in a national TAVR registry or participate in an approved clinical study. The national TAVR registry must consecutively enroll TAVR patients, accept all manufactured devices, follow patients for at least one year, and comply with all relevant regulations related to the protection of human research subjects. The National Coverage Decision specifically requires that the registry collect data on the following outcomes: stroke, all-cause mortality, transient ischemic attacks, major vascular events, acute kidney injury, repeat aortic valve procedures, and quality of life.
The development of a national registry to meet these requirements was challenging, particularly due to the need to collect at least one year of followup and quality of life data. The registry was expected to enroll hundreds of sites and thousands of patients, making it time consuming, administratively cumbersome, and expensive to obtain local institutional review board (IRB) approval for each site and informed consent for each patient.
The registry developers determined that the national TAVR registry was most likely to be successful if it collected data that was already routinely documented as part of the standard of care and was able to obtain a waiver of informed consent from a central IRB.
When designing the data collection instruments for the registry, the developers worked closely with surgeons and interventional cardiologists to understand which data are already collected. The developers were able to limit the registry data collection effort to data already collected routinely, thereby allowing registry data to be abstracted from the medical record with no data collected solely for the purposes of the registry. In particular, the registry developers carefully considered how to collect followup data and quality of life data without requiring the collection of information solely for the purposes of the registry.
Based on discussions with surgeons and interventional cardiologists, the developers determined that patients are seen for followup care routinely at 30 days and 1 year following the procedure. Published guidelines have established the use of the Kansas City Cardiomyopathy Questionnaire (KCCQ) to assess quality of life as a standard of care for TAVR patients at these followup visits. The registry was designed to use the data collected at these followup visits, including the KCCQ, to meet the requirements for collecting long-term outcomes and quality of life information.
The registry began collecting data in 2012 and has been approved by CMS as meeting the requirements of the Medicare National Coverage Decision. The ACC and STS, the institutions operating the registry, are considered the only entities engaged in research, while the participating sites are considered to be providing data only. The registry was approved only by the single IRB designated under the ACC/STS’s Federalwide Assurance. Based on the registry protocol, the IRB determined that the ACC/STS are engaged in research on human subjects and granted a waiver of informed consent. The waiver of informed consent was awarded primarily because the participating sites are collecting and submitting information that is already documented in the medical record as part of the standard of care. As the registry operators, the ACC and STS submit data, including patient identifiers, to CMS as required by the National Coverage Decision. However, the ACC and STS only conduct research on a limited dataset, and any research studies not covered by the protocol are submitted to the IRB for review.
Because the ACC and STS have IRB approval and a waiver of informed consent, and because the data are already collected as part of the standard of care, the individual sites participating in the registry do not necessarily need to go through an IRB prior to enrolling in the registry. Some individual sites elect to submit the registry to their local IRB, in many cases because they intend to use the data they collect for the registry in additional research studies and are required by policy to seek IRB review. The local IRBs generally have reached the same conclusion as the central IRB. However, a local IRB may reach a different conclusion, perhaps due to differences in the data collection process at an individual site. For example, the data collection process at an individual site may provide an opportunity to consent the patient, in which case the IRB may not grant a waiver of informed consent. In these cases, the individual site will follow the advice of the local IRB.
Since its launch in 2012, the registry has collected data on over 70,000 patients, resulting in a clinically rich data repository that has produced dozens of publications and presentations. The registry also meets multiple needs for different stakeholders; for example, CMS receives data to inform policy decisions on requirements for TAVR (such as the proposed decision memo released in early 2019), the FDA receives data to monitor device safety, and industry can leverage the existing registry infrastructure to meet post-approval FDA requirements in an efficient manner and to generate data to support expansion of approved indications.
Protecting the subjects whose data will be used is of the utmost importance when developing a registry. When developing a registry, sponsors should consider the planned data collection effort in the context of requirements for IRB review and informed consent. This approach may help the registry identify a strategy that protects patients’ privacy without overburdening the participating sites.
Carroll JD, Shuren J, Jensen TS, et al. Transcatheter Valve Therapy Registry Is A Model For Medical Device Innovation And Surveillance. Health Affairs. 2015;34(2):328–34. PMID: 25646114. DOI: 10.1377/hlthaff.2014.1010. [PubMed : 25646114 ] [CrossRef]
©2020 United States Government, as represented by the Secretary of the Department of Health and Human Services, by assignment.
All rights reserved. The Agency for Healthcare Research and Quality (AHRQ) permits members of the public to reproduce, redistribute, publicly display, and incorporate this work into other materials provided that it must be reproduced without any changes to the work or portions thereof, except as permitted as fair use under the U.S. Copyright Act. This work contains certain tables and figures noted herein that are subject to copyright by third parties. These tables and figures may not be reproduced, redistributed, or incorporated into other materials independent of this work without permission of the third-party copyright owner(s). This work may not be reproduced, reprinted, or redistributed for a fee, nor may the work be sold for profit or incorporated into a profit-making venture without the express written consent of AHRQ. This work is subject to the restrictions of Section 1140 of the Social Security Act, 42 U.S.C. § 1320b-10. When parts of this work are used or quoted, the following citation should be used:
