Ethical Internet Research:
Informed Consent
Regulations and Realities
Laura Odwazny, JD
Elizabeth Buchanan, PhD
Disclaimer
This presentation does not constitute legal
advice. The views expressed are the
presenter’s own, and do not bind the U.S.
Department of Health and Human Services
or its components.
Objectives
 To identify specific internet research settings and
conditions for consent
 To discuss how to apply Common Rule regulatory
requirements for informed consent to internet research
 To review regulatory flexibilities applicable to consent in
internet research
 To review parental consent and child assent in internet
research involving minors
 To provide sample language for informed consent
documents for internet research regarding data security
and confidentiality of research-related information
Internet Research
Internet Research
Internet-based research, broadly defined, is research which utilizes
the Internet to collect information through an online tool, such as an
online survey; studies about how people use the Internet, e.g.,
through collecting data and/or examining activities in or on any online
environments; and/or, uses of online datasets, databases, databanks,
repositories.
o Internet as a TOOL FOR research or…
o Internet as a MEDIUM/LOCALE OF research
 TOOL=search engines, databases, catalogs, etc…
 MEDIUM/LOCALE=chat rooms, MUDs, MOOs, newsgroups, web
sites, MMORPGs, blogs, skype, social media, tweets, online
course software, etc
 Increasingly, the line between tool and locale is blurring in the face
of social media, mobile apps, and cellular devices
Forms of Research:
Exploring Where Human Subjects and
Informed Consent Fits
 Consider Methodologies, Venues, Types of Data Generated
through:
 Quantitative Research
 Data Aggregation, Scraping, Transaction Log Analysis,
Network Analysis, Statistical Analysis, Surveys, etc
 Qualitative Research
 Ethnography, Focus Groups, Observation, Surveys,
Content/Discourse Analysis, etc
 Emerging use of synchronous data
collection/sharing across methodologies
 “Momentary Sampling”
 Geosocial networking
7
9
Do note:
 OHRP has no guidance on internet
research specifically
 Hot off the presses…SACHRP considering
Internet research
(http://www.hhs.gov/ohrp/sachrp/mtgings/i
ndex.html)
 Many boards have separate guidelines and
best practices for internet research (See
http://www.uwstout.edu/ethicscenter/uploa
d/IRBs-with-Internet-Research-Guidelines2.pdf)
“Common Rule”
Regulatory Requirements
When is consent required?
 Research
 Involving human subjects
 Conducted or supported by Common Rule
agency or covered by applicable FWA
 Not exempt
 Not eligible for waiver of informed consent
(Note: not available for FDA-regulated research except for
emergency research, and other life-threatening or military situations
outlined in FDA regulations at 21 CFR 50.23)
Challenge: Getting consent in
internet research
 Sometimes no direct researcher – subject interaction
 Interaction could be through an avatar, profile,
survey tool
 Not always clear who subjects are
Fluidity, Pseudonymity, Multiple Identities
 May not be feasible to obtain documentation of consent
 May provide more PII than necessary (could increase
risk); type of forum, e.g. chat rooms
More points on informed consent
 Regulations do not recognize “passive consent”
(a common error in internet research)
o “Passive consent” or “opt-out” procedure requires waiver of
informed consent (or elements) and waiver of documentation
 Regulations do not recognize “secondary subject”
 Need for re-consent?
o Longitudinal research -- minors who reach age of majority
 Deception research
o Requires waiver of consent or of some elements
o Challenges in debriefing subjects
 Accessing all members of online community
 Should investigator be allowed to search for former members
to contact in order to debrief?
Also consider…
 How subjects will be contacted
o Access may be through moderator or member in internet locale
 When and where the subjects are approached
about participation
o How to avoid misrepresentation by researcher?
o Outside of formal study space?
Examples of Online
Consent Processes
We started with a welcome page that briefly
summarized the points of key interest
We brought our eligibility criteria forward
so we did not waste non-eligible persons’ time.
Consent portal
Subject Recruitment
Subject recruitment
 OHRP considers subject recruitment part of
informed consent
o Recruitment plan must receive IRB review/approval
prior to initiation
 Online recruitment methods
o Twitter app
o Blog posting
o YouTube videos
o “Push” methods
o Robo calls, texts
OHRP guidance on subject recruitment
 OHRP guidance on IRB review of clinical trial
websites
http://www.hhs.gov/ohrp/policy/clinicaltrials.html
 No IRB review needed for descriptive information:
o
o
o
o
o
o
study title
purpose of the study
protocol summary
basic eligibility criteria
study site location(s)
how to contact the study site for further information
OHRP guidance (continued)
 IRB review needed if additional information is provided
o Description of research risks/potential benefits
o Solicitation of identifiable private information (e.g. eligibility survey)
o Incentives – monetary and non-monetary
 What needs to be reviewed:
o Recruitment plan, not the actual webpage
 But screen shots may be helpful to the IRB!
Using social media for recruitment –
matching tool
Social media as recruitment tool –
Twitter app
 Twitter app from TrialX
(3/20/09)
o Sample tweet: @trialx CT
studies for diabetes male 45
in new york
o Stated benefits:
 use of Twitter
 tweets are public -others can learn about
research by looking at
searches, which could
potentially increase
awareness of trials and
participation.
Social media as recruitment tool: “push” method
Blog post from the founder of
Inspire.com (3/1/09):
“I'm writing today to let you know
about some new features we're
introducing related to clinical
trials…What's new is that from time
to time we'll tell you about clinical
trials in which you may be interested
in participating. If you're not
interested in participating, simply do
nothing. If you do think you might be
interested, we'll provide a link where
you'll be able to read about a trial,
decide if you are interested in
participating, and fill out a short
survey to see if you may qualify. If it
appears that you may qualify, we'll
put you in touch with the physicians
conducting the trial so that you can
learn more and find out if you do
qualify.”
29
Ethical considerations with use of
social media for recruitment
 Trackbackability/greased nature of social media data
could generate unforeseen ethical challenges
o If recruitment method can identify an individual, any potential
downstream harms?
o Are risks being minimized (under 46.111 criteria)?
 Uncontrolled following discussion among
viewers/bloggers: interactive, not static
 Subsequent posts in effect add to posted information
 Must PI/IRB actively monitor social media sites used
for recruitment?
o Note: FDA pulled social media from guidance agenda
o FDA has draft guidance on m-research
Waiver of Informed Consent
Waiver of informed consent
45 CFR 46.116(d)[not for FDA-regulated research]
 Waiver may be of some or all of the required
elements, or of requirement for consent in toto
 IRB must find and document:
 Minimal risk research;
 Waiver will not adversely affect subjects’ rights and welfare;
 Research could not practicably be carried out without
waiver; and
 When appropriate, subjects provided with additional
pertinent information after participation
Challenges: applying waiver of
consent to internet research
 Minimal risk
o Probability and magnitude of harm/discomfort in the research not
greater than ordinarily encountered in daily life or during routine
physical or psychological examinations/tests (46.102(i))
o Risks associated with data security breach, likelihood of access
by 3rd parties alter conception of minimal risk in Internet
research?
 Less privacy, more observation in general in daily life
 If appropriate, provide additional information to subjects
after participation
o Issues with debriefing online community
Documentation of Informed Consent
and Waiver of Documentation
Documentation required unless waived
[waiver not permitted in FDA-regulated studies]
 If documentation required, “long form” or “short form”
procedure (45 CFR 46.117)
 For waiver, IRB must find:
o Consent document would be only record linking
subject to the research and principal risk is breach of
confidentiality, and each subject must be asked if
documentation wanted; or
o Minimal risk research; no procedures requiring
consent in a non-research context
 IRB may require investigator to give subjects written
statement regarding the research
Challenge: obtaining documentation
of consent in Internet research
 More difficult to obtain “hard copy” documentation
o Consider alternatives to traditional documentation, such as
electronic signatures
 How to date-stamp versions of consent forms? (Question
from IRB Forum, 11/17/2011)
o No regulatory requirement to date-stamp consent form versions
o Suggestion posted on IRB Forum in response: “We have
investigators type the approval information onto the online survey
-- it's just typed instead of a stamp.”
Electronic Signatures
Electronic signatures
Electronic signatures encompass a broad
gamut of technologies and methodologies,
ranging from an “I agree” button in a clickthru agreement…
to an electronic tablet which accepts a
handwritten signature (oftentimes referred
to as an eSignature)…
to a digital signature cryptographically tied
to a digital ID or certificate
John B. Harris, Adobe Security blog
entry "So what is an electronic signature
Electronic signatures
OHRP FAQ:
 Does not require specific
method of electronic
signature
 Provides points to consider
for the IRB to evaluate
method of obtaining
electronic signature
 Q: In what jurisdiction is the
research being conducted?
Research involving children
Identification of vulnerable subjects
 Are investigators required to confirm the
real identities of the subjects of internet
research?
 How to ascertain that subjects are not
children
o Age verification measures
o Nothing is 100%!
Definition of “children”
 “[P]ersons who have not attained the legal age for
consent to treatments or procedures involved in the
research, under the applicable law of the jurisdiction in
which the research will be conducted.” (emphasis added)
o In US, legal age of adulthood governed by state and local law:
may be exceptions to who is considered a child and additional
laws in places that define emancipated minors
o Note that definition considers specific treatments or procedures
involved in the research; state/local law might allow lower age for
consent to certain types of procedures
 In what jurisdiction is Internet research being conducted?
45 CFR part 46, subpart D –
permission and assent
 “Children” by definition do not have legal ability to consent
to the research procedures
 Parent/guardian provides permission for child to participate
in research [45 CFR 46.408]
o Either one or both parents, depending on circumstances
o Documentation required under 45 CFR 46.117, unless waived
 Child assent
o Required if IRB determines children are capable
Challenge: obtaining parental
permission for internet research
 Internet use affords children independence and
autonomy; request for parental permission may be
perceived as lack of respect
 Parental skepticism of researcher because of heightened
awareness of Internet predators, online stalking
 If IRB conservatively requires physical documentation of
permission, increased effort to print/mail form
o Also, even if researcher promises to use pseudonyms to refer to
child, identifying info contained in parent’s signature, return
address or postmark may cause parental concern
(Stern S, in E.A. Buchanan (Ed.) Readings in Virtual Research Ethics:
Issues and Controversies (2004); Duncan, et al, (2009); Kauer, et al,
(2008, 2009))
Waiver of permission
[not for FDA-regulated research]
 Parental/guardian permission may be waived if:
o Subpart A waiver of consent requirements met (45 CFR 46.116);
or
o Research designed to study conditions in children/population for
which parental permission would not protect the subjects (e.g.
neglected or abused children), and both:
 appropriate substitute mechanism in place to protect children, and
 waiver not inconsistent with Federal, state, or local law (45 CFR
46.408(c)).
More on waiver of permission or assent
 IRB may waive requirement for parental or guardian
permission under 45 CFR 46.408(c) even if the research
involves more than minimal risk
 Documentation of parental permission may be waived
under 46.117 criteria
 IRB decides whether children are capable so as to
require assent; assent may be waived according to
45 CFR 46.408(a) or 46.116
 Documentation of assent not required
Sample language for consent
documents – confidentiality
and data security
Best practices for describing
confidentiality protections
 Explain how data are transmitted. Is a survey host (Zoomerang,
Survey Monkey) used? Will the host retain identifiable data? Will the
data be encrypted?
 Explain how data are maintained. In individually identifiable form,
aggregate form, anonymized?
 Becoming more and more significant with data sharing and data
use agreements (NIH, NSF mandates); important for researchers
to work with IRBs in planning for data sharing!
 Explain data security plan
 See, for example Harvard or North Carolina
 Do not absolutely guarantee confidentiality
 If aggregated anonymized data will be made publicly available,
consider whether subjects could be (re)identified.
Let the Data do the Talking?
“Classic consents must therefore transition
away from attempting to guarantee
individuals’ privacy. Rather, new forms of
consent should aim at educating research
subjects on what the data collected on
them can say and the degree to which it
can or cannot be protected.” (Schadt,
2012)
Sample Language for Consent
Documents
 Address the efforts in place to protect the data
(encryption, secure servers); Harvard’s policy is excellent
example (security.harvard.edu)
 Identify potential tracking measures if using work or
public computers or recommend use of private
computers
 Disclose what third party sites may be used for collection,
storage, dissemination and that access by third parties is
possible
 “Although every reasonable effort has been taken,
confidentiality during actual Internet communication
procedures cannot be guaranteed.”
Sample Language for Consent
Documents
 “Your confidentiality will be kept to the degree
permitted by the technology being used. No
guarantees can be made regarding the
interception of data sent via the Internet by any
third parties.” (Penn State)
 Address uncertainty in data longevity in more
open-ended terms: “Data may exist on back ups
or server logs beyond the timeframe of this
research project”
 Move away from “locked file in a locked office”
mentality
Sample Language for Consent
Documents
 “Although it is unlikely that anyone will try to gain access to your
email, you have the right to know that email transmissions are not
private and therefore transmission of information through this form
cannot be guaranteed to remain confidential.” (Bard)
 “Please note that the online survey is hosted by Company ABC
which is a web survey company located in the USA. All responses to
the survey will be stored and accesses in the USA. This company is
subject to U.S. Laws, in particular, to the US Patriot Act/Domestic
Security Enhancement Act that allows authorities access to the
records that your responses to the questions will be stored and
accessed in the USA. The security and private policy for Company
ABC can be viewed at http://...”
 (with mobile device research): “Remote data deletion will be
performed in the event of a lost or stolen phone”
Sample Language for Consent
Documents
 Glickman, et al, 2012: “If you participate in this clinical
study, you should feel free to discuss the study with your
family and with other people who are close to you. You
should also tell any health care providers who treat you
that you are in the study. However, to help make sure
that the data from the study is as accurate and reliable as
possible, please do not discuss information about the
study in public places while the study is in progress.
Public places may be situations like support groups, or
may be places like internet message boards. If you have
questions about side effects, please talk to your study
nurse or study doctor.”
OHRP Resources
Web site: hhs.gov/ohrp
FAQs: hhs.gov/ohrp/faq.html
Guidance: hhs.gov/ohrp/policy/index.html
Educational resources: hhs.gov/ohrp/education/
News distribution list: hhs.gov/ohrp/news/index.html
Email: ohrp@hhs.gov
Telephone: (866) 447-4777 (toll-free)
(240) 453-6900
54
5
Contact Information
Elizabeth Buchanan
buchanane@uwstout.edu
Laura Odwazny
Laura.Odwazny@hhs.gov