Good Clinical Practices

 Introduction

1. Introduction to Good Clinical Practice (GCP)

What is Good Clinical Practice?

Good Clinical Practice (GCP) is an international ethical and scientific standard for
conducting biomedical and behavioral research involving human participants. The
objective of this guideline is to provide a unified standard across the European
Union (EU), Japan, the United States, Canada, and Switzerland to facilitate the
mutual acceptance of data from clinical trials by Regulatory Authorities.
The current system of Good Clinical Practice has evolved, in part, in response to
revelations of past episodes in which research participants were grossly abused.
Exposure of these incidents provided much of the momentum for the development
of regulations and ethical guidelines on the protection of human research
participants.

Why is GCP training necessary?

This training is important for all staff involved in Clinical Research and ensures an
understanding of the principles adopted in research.
 GCP is widely accepted and expected in all research involving human
participants.
 GCP is not specific to a protocol, but rather is general and applicable to all
protocols.
Anyone directly involved in the design or conduct, oversight, or management of
research involving human participants, including research site staff, back-up staff,
contractors, subcontractors, and consultants who perform key study functions,
should complete the GCP training. Non-study staff at the research site who provide
standard care or other non-study related services should be encouraged to
complete the GCP training, but they are not required to do so.
The course is self-paced and takes approximately 4-6 hours to complete.
Completion of the course is required every three years for NIH-affiliated staff to
ensure that all researchers stay informed of developments regarding GCP, such as
changes in federal regulations concerning the protection of vulnerable research
participants, electronic data, or privacy protections. Others are encouraged to
consult and comply with their institutional, regulatory, and other oversight
committee guidelines for recertification requirements.

2. The Good Clinical Practice Guidelines

What are the Good Clinical Practice guidelines?

The Good Clinical Practice (GCP) guidelines were prepared in association with the
International Council for Harmonization (ICH). Consolidating many of the same
principles set out in earlier codes of medical ethics, the GCP guidelines provide a
framework for the fair, scientifically sound conduct of research studies involving
human participants. The ICH GCP (R1) guidelines, dated June 10, 1996, were
published in the U.S. Federal Register in 1997 and revised to version R2 on
November 9, 2016. These guidelines apply to all research involving human
research participants.
The purpose of the ICH GCP guidelines is twofold:
 To ensure that the rights, safety, and confidentiality of participants in clinical
trials are protected.
 To ensure that the data collected in clinical trials, as well as the reported results
of clinical trials, are accurate and credible.
The principles in this guideline may be applied to all clinical investigations involving
human participants, such as those involving an investigational product, a marketed
drug, a medical device, or a behavioral intervention.

ICH GCP Principles

 Clinical trials should be conducted in accordance with the ethical principles that
have their origin in the Declaration of Helsinki, and that are consistent with GCP
and the applicable regulatory requirement(s).
 Before a trial is initiated, foreseeable risks and inconveniences should be
weighed against the anticipated benefit for the individual trial participant and
society. A trial should be initiated and continued only if the anticipated benefits
justify the risks.
 The rights, safety, and well-being of trial participants are the most important
considerations and should prevail over the interests of science and society.
 The available nonclinical and clinical information on an investigational product
should be adequate to support the proposed clinical trial.
 Clinical trials should be scientifically sound and described in a clear, detailed
protocol.
 A trial should be conducted in compliance with a protocol that has received
prior institutional review board (IRB) approval.
 The medical care given to, and medical decisions made on behalf of,
participants should always be the responsibility of a qualified physician or, when
appropriate, a qualified dentist.
 Each individual involved in conducting a trial should be qualified by education,
training, and experience to perform his or her respective task(s).
 Freely given informed consent should be obtained from every participant prior
to clinical trial participation.
 All clinical trial information should be recorded, handled, and stored in a way
that allows its accurate reporting, interpretation, and verification.
 The confidentiality of records that could identify participants should be
protected, respecting the privacy and confidentiality rules in accordance with
the applicable regulatory requirement(s).
 Investigational products should be manufactured, handled, and stored in
accordance with applicable good manufacturing practice (GMP). They should
be used in accordance with the approved protocol.
 Systems with procedures that assure the quality of every aspect of the trial
should be implemented.

Check “ICH Guideline E6 Good Clinical Practice documentation.”

What is the Code of Federal Regulations?

The Code of Federal Regulations (CFR) is the codification (systematic
arrangement) of rules published in the Federal Register by the executive
departments and agencies of the U.S. Government. The principles of Good Clinical
Practice (GCP) are codified in several sections, or titles, of the CFR.
Noncompliance with these regulations may result in suspension of a research
study as well as fines and penalties.

Which parts of the CFR must researchers be familiar with?

Researchers and clinicians participating in clinical trials need to be familiar, at a
minimum, with the following sections of the CFR, which are directly relevant to
research involving human participants:

21 CFR 11
This section regulates the handling of electronic data and electronic signatures
when an Electronic Data Capture system is used. It is enforced by the U.S. Food
and Drug Administration (FDA).
21 CFR 50
This section, enforced by the FDA, regulates the informed consent process, setting
out the elements of informed consent, exceptions from the general requirements,
and other related information.

21 CFR 54
This section, enforced by the FDA, regulates investigator conflicts of interest.

21 CFR 56
This section, enforced by the FDA, regulates the membership, responsibilities, and
operations of Institutional Review Boards (IRBs).

21 CFR 312
This section, enforced by the FDA, regulates the conduct of studies involving the
use of Investigational New Drugs.

21 CFR 314
This section, enforced by the FDA, regulates the application procedure for approval
of new drugs.

42 CFR 2 and 42 CFR 2a

These are the confidentiality regulations, which fall under the jurisdiction of the
Department of Health and Human Services (DHHS). Section 2 deals with the
confidentiality of alcohol and drug use patient records. Section 2a deals with the
protection of research participants' identity.

45 CFR 46
This regulation also governs Institutional Review Board (IRB) membership,
functions, and operations. In addition, it includes the general requirements for
informed consent and codifies additional protections for vulnerable participants.
Subpart A of this regulation is also known as the Common Rule. which has recently
undergone revision and will be effective in 2018. Subparts B, C, and D include
provisions for pregnant women, children, and prisoners in research studies. It is
enforced by the DHHS Office for Human Research Protections.

45 CFR 160 and 45 CFR 164

These are the Health Insurance Portability and Accountability Act (HIPAA) privacy
rules, which are enforced by the DHHS Office of Civil Rights.

3. Other Federal Regulations

What other federal regulations must researchers be familiar with?

Research that involves the use of controlled substances must comply with U.S.
Drug Enforcement Administration regulations (21 CFR 1300).
In addition to the Office of the Commissioner, the Food and Drug Administration
(FDA) oversees scientific activities in four areas. These areas include Medical
Products and Tobacco, Foods and Veterinary Medicine, Global Regulatory
Operations and Policy, and Operations. Scientific investigations involving drugs are
subject to FDA regulations. In addition to regulating the use of investigational new
drugs (21 CFR 312) and marketing of drug (21 CFR 314) mentioned in Part 3 of
this module, FDA regulations apply to Good Manufacturing Practice (GMP), such
as:
 21 CFR 210 — Current Good Manufacturing Practice in Manufacturing,
Processing, Packing, or Holding of Drugs; and
 21 CFR 211 — Current Good Manufacturing Practice for Finished
Pharmaceuticals.
Another Federal law is the Health Insurance Portability and Accountability Act
(HIPAA) Privacy Ruleand HIPAA Security Rule, which protects the privacy of
research participants and their personal health information. (HIPAA is discussed in
more detail in the Confidentiality & Privacy module, Part 8).
NIH policies regulate grant management. For more information on the NIH Grants
Policy, reference the website here.
What additional regulations affect clinical research?
Countries, states, cities, and institutions may implement additional policies for the
protection of human participants. These policies may impose requirements more
stringent than those set down in federal regulations. Where more stringent local
policies on human participant protection have been enacted, researchers must
ensure at all times that their studies are designed and conducted in a manner that
complies with both local and federal requirements.

4. Summary of Key Points

 Good Clinical Practice (GCP) is an international ethical and scientific standard

for the design, conduct, performance, monitoring, auditing, recording, analysis,
and reporting of clinical trials. This standard provides assurance that:
o The rights, safety, well-being, and confidentiality of trial participants are
protected.
o The data collected in clinical trials as well as the reported results of clinical
trials are credible and accurate.
 The current system of Good Clinical Practice has evolved, in part, in response
to revelations of past episodes in which research participants were grossly
abused.
 The Good Clinical Practice guidelines provide a framework for the fair,
scientifically sound conduct of research studies involving human participants.
Therefore, all trials should be conducted according to Good Clinical Practice
(GCP) and all research staff should be trained and remain current in GCP.
 All key personnel who submit applications to the National Institutes of Health for
competing or noncompeting projects that involve human research participants
must receive training in the protection of human research participants.
 The Code of Federal Regulations (CFR) is the codification (systematic
arrangement) of rules published in the Federal Register by the executive
departments and agencies of the U.S. Government. The principles of Good
 Clinical Practice are codified in several sections, or titles, of the CFR.
Noncompliance with these regulations may result in suspension of a research
study as well as fines and penalties.
 Countries, states, cities, and institutions may implement additional policies for
the protection of human participants. These policies may impose requirements
more stringent than those set down in federal regulations. Where more
stringent local policies on human participant protection have been enacted,
researchers must always ensure that their studies are designed and conducted
in a manner that complies with both local and federal requirements.

Institutional Review Boards

1. What is an Institutional Review Board?

Structure
An Institutional Review Board (IRB) is an independent body established to protect
the rights and welfare of human research participants. Under Title 45 Part 46 of the
Code of Federal Regulations (45 CFR 46), any research that is federally funded
must be reviewed and approved by an IRB.
Any clinical investigation involving a product regulated by the U.S. Food and Drug
Administration (FDA) must also be reviewed and approved by an IRB (21 CFR 56).
Individual institutions or sponsors may require that all research, no matter how it is
funded, be reviewed and approved by an IRB.
An IRB has specific authority over the conduct of research under its jurisdiction. No
clinical study may begin enrolling participants until it has received IRB approval.
The IRB has the authority to:
 Approve, disapprove, or terminate all research activities that fall within its local
jurisdiction according to relevant federal regulations and institutional policy.
 Require modifications in protocols, including protocols of previously approved
research.
 Require that participants be given any additional information that will assist
them in making an informed decision to take part in research. (Requirements
for informed consent are covered in the Informed Consent module.)
 Require documentation of informed consent or allow a waiver of
documentation. (Documentation of informed consent is covered in the Informed
Consent module.)
Every institution that participates in research studies must identify an IRB to review
and approve those studies. The IRB must follow the requirements of 45 CFR 46
(described in this module) and of the Office for Human Research Protections.
Some research sites are under the jurisdiction of two or more IRBs. In these cases,
the IRBs may perform joint review, separate review or agree to abide by the review
of one of the involved IRBs.
This module provides an overview of the regulations governing IRBs. Many of the
topics covered here are also addressed in other modules of this training program.

2. Purpose of an IRB?

The purpose of an IRB is to safeguard the rights, safety, and well–being of all
human research participants. The IRB fulfills this purpose by:
 Reviewing the full study plan (see section IRB responsibilities for the
documents which comprise a full protocol) for a research study to ensure that
the research meets the criteria specified in 45 CFR 46.111. (See summarized
Criteria for IRB approval of research.)
Summarized from information presented later in this module
The Belmont Report (the report of the National Commission for the
Protection of Human Subjects of Biomedical and Behavioral Research)
established three key principles that underlie the current system of
human research protections: respect for persons, beneficence, and
justice. These principles are woven into the criteria for IRB approval of
research.
To approve a research protocol, the IRB must ensure that:
 o Risks to participants are minimized.
o Risks to participants are reasonable in relation to anticipated benefits.
o Selection of participants is equitable.
o Informed consent is properly obtained and documented.
o Adequate provision is made for monitoring the data collected to ensure
the safety of participants.
o Adequate provision is made to protect participants’ privacy and maintain
the confidentiality of data.
o Additional safeguards are included for vulnerable populations.
 Confirming that the research plans do not expose participants to unreasonable
risks.
 Reviewing and approving proposed payments or other compensation to study
participants.
 Ensuring that human participant protections remain in force throughout the
research by conducting continuing review of approved research. This
continuing review is conducted at intervals appropriate to the degree of risk
posed by each study, but not less frequently than once a year.
 Considering adverse events, interim findings, and any recent literature that may
be relevant to the research.
 Assessing suspected or alleged protocol violations, complaints expressed by
research participants, or violations of institutional policies.
 Reviewing proposed changes to previously approved studies.
The IRB may suspend or terminate ongoing research that:
 Is not being conducted in accordance with IRB requirements, or
 Is associated with unexpected or serious harm to participants.
The IRB may also suspend or terminate research when additional information
results in a change to the study's likely risks or benefits.

3. Membership of an IRB
An IRB must have a diverse membership that includes both scientists and non-
scientists. Scientific members may include researchers, physicians, psychologists,
nurses, and other mental health professionals. Non-scientific members of an IRB
may have special knowledge of a certain population (pregnant women, children, or
prisoners).
Collectively, IRB members must have the qualifications and experience to review
and evaluate the scientific, medical, behavioral, social, legal, and ethical aspects of
a proposed study. An IRB must have at least five members. However, it may have
as many members as necessary to perform a complete and adequate review of
research activities. The following table lists the minimum criteria for IRBs based on
ICH guidelines as well as FDA guidelines for research in the U.S.

Diversity of Membership
IRB membership must be diverse in terms of race, gender, and cultural heritage.
Members must be sensitive to issues such as community attitudes.
Every effort must be made to ensure that no IRB consists entirely of men or
entirely of women. However, no one can be appointed to an IRB solely based on
gender.
No IRB may consist entirely of members of one profession.
Each IRB should include at least one member whose primary concerns are in
scientific areas and one member whose primary concerns are in non-scientific
areas.
Each IRB should include at least one member who is not affiliated with the
institution or study site.

Knowledge of Vulnerable Populations

If the IRB reviews research that involves vulnerable populations — such as
children, prisoners, pregnant women, or disabled or cognitively impaired persons
— its membership should include one or more persons who are knowledgeable
about and/or experienced in working with these populations. The individuals
specializing in vulnerable populations may be fulltime voting members or alternates
to fulltime voting members.

Conflicts of Interest
No IRB member may participate in the review of any project in which he or she has
a conflicting interest, except to provide information requested by the IRB.
An investigator may be a member of an IRB. However, the investigator (or any
other IRB member) cannot participate in the review or approval of any research in
which he or she has a current or potential conflict of interest. The investigator
should be absent from the meeting room while the IRB discusses and votes on the
research in which he or she has an interest.

Non-Voting Members
The IRB may invite individuals with competence in special areas to assist in the
review of issues that require expertise beyond or in addition to that of the IRB
members. These consultants are not voting members of the IRB. However, when
research involves vulnerable populations, individuals specializing in these areas
must be voting members of an IRB and maintained on the IRB roster accordingly.

4. Responsibilities of an IRB

The principal responsibilities of an IRB include the following:

Provision of an Infrastructure to Support the Ethical Review of Proposed and

Ongoing Research
This infrastructure includes the following IRB processes:
 Perform its functions according to written operating procedures.
 Maintain written records of its activities and minutes of its meetings.
 Comply with all applicable federal and state regulatory requirement(s).
 Should review a proposed clinical trial within a reasonable timeframe.
 Make its decisions at announced meetings at which a quorum is present.
 Retain all relevant records (e.g., written procedures, membership lists, lists of
occupations/affiliations of members, submitted documents, minutes of
meetings, and correspondence) for a period of at least 3 years after completion
of a study and make them available upon request from any regulatory authority.
 Notify investigators promptly in writing of its decisions, stating the reasons for
those decisions and noting the procedures for appeal.

Reviewing and Understanding the Full Plan of Study

To provide a full review, the IRB should obtain the following documents (examples
of information included in a full plan of study):
 Study protocol(s) and protocol amendment(s).
 Written Informed Consent Form(s) and consent form updates that the
investigator proposes to use.
 Documents and other media relating to participant recruitment procedures (e.g.,
advertisements).
 Written information to be provided to participants including questionnaires and
explanatory materials.
 Information about payments and compensation available to participants.
 Investigator's Brochure.
 Available safety information, including references to relevant literature.
 Investigator's current curriculum vitae and/or other documentation that provides
evidence of the investigator's qualifications.
 Any other documents needed to fulfill the IRB's responsibilities.

Keeping a Written Record of IRB Decisions

The following written records should be kept pertaining to an IRB's review of a
proposed study:
 Identification of the study.
 List of documents reviewed.
 Decision reached:
o Approval.
o Disapproval.
o Rationale for disapproval.
 Termination or suspension of prior approval.
 Date decision was reached.
 Correspondence with the investigator.

Considering the Investigator's Qualifications

The IRB should consider the qualifications of the investigator for the proposed
study, as documented by a current curriculum vitae or other relevant
documentation.
Conducting Continuing Review of Ongoing Studies
The IRB conducts continuing review of each ongoing study at intervals appropriate
to the degree of risk to human participants. By regulation, this interval must be at
least once per year.

Requesting More Information When Necessary

The IRB may request more information to assist in their review. One of the reasons
for such a request would be when the IRB judges that the additional information
would add meaningfully to the protection of the rights, safety, or well-being of
participants.

Reviewing Incentives for Participation

Payment to participants for their participation in a research study must never be
coercive in either amount or method of distribution. (This issue is also discussed in
the Informed Consent module.)
The IRB should review both the amount and method of payment to participants to
assure that neither exerts undue influence on study participants. Payments to
participants should be prorated (divided in a proportional manner) and not entirely
contingent on a participant's completion of the study (no large, consolidated
payment at the end).
The IRB should confirm that information regarding payment to participants,
including the methods, amounts, and schedule of payments to study participants, is
justified by the protocol and set forth in the written Informed Consent Form and any
other written information provided to participants. The way payment will be
prorated should be specified.
Some IRBs have written requirements concerning what is adequate compensation
for study participants. Investigators should be familiar with these requirements
before submitting a protocol to the IRB for approval.

5. Expedited Review
An IRB may use an expedited review procedure for research that:
 Involves no more than minimal risk and
 Falls into a category that appears on an approved list of categories of research
eligible for expedited review.
An IRB may also use expedited review to approve minor changes in previously
approved research that are made during the period (1 year or less) for which the
approval is authorized. The IRB must have written procedures that specify how an
expedited review will be conducted.
An expedited review (which may involve less waiting time for IRB approval) may be
carried out by the IRB chairperson or by one or more experienced IRB members
designated by the chairperson. The reviewers may exercise all the authorities of
the IRB except that of disapproving the research. A proposal submitted for
expedited review may be disapproved only by the full IRB.

Research Eligible for Expedited Review

The Department of Health and Human Services has determined that certain types
of research involve no more than minimal risk and are therefore eligible for
expedited review.
The following are examples of research that may be eligible for expedited review:
 Collection of hair or baby teeth.
 Collection of external secretions, including sweat and saliva.
 Recording of data from adults using noninvasive procedures that are routinely
employed in clinical practice (not including exposure to electromagnetic
radiation outside the visible range, for example, x-rays or microwaves.)
 Collection of blood samples by venipuncture.
 Voice recordings made for research purposes, such as investigations of speech
defects.
 Moderate exercise by healthy volunteers.
 Study of existing data, documents, records, pathological specimens, or
diagnostic specimens.
Further information about the types of research that may be eligible for expedited
review may be found on the Office of Human Research Protections website.

6. Investigators' Responsibilities to the IRB

The investigator must:

 Ensure that the IRB receives all the documents it requires to review the
proposed research.
 Admit no participant to a study before the IRB has issued its written approval of
the study.
 Make no changes to or deviations from the study protocol without prior written
approval from the IRB, except when necessary to eliminate immediate hazards
to participants.
 Report promptly to the IRB:
o Changes to or deviations from the protocol, including changes made to
eliminate immediate hazards to study participants.
o Changes that increase the risk to participants or significantly affect the
conduct of the study.
o All adverse drug reactions that are both serious and unexpected.
o New information that may adversely affect the safety of participants or
the conduct of the study.
Reporting requirements may vary, and it is the investigator's responsibility to know
the individual reporting requirements of each IRB involved with the research study.
For example, an IRB may require that every serious adverse drug reaction be
promptly reported, whether it was unexpected or not.
 Respond in a timely fashion to all requests from the IRB for additional
information about a research study.
 Submit progress reports to the IRB annually, or more frequently, if requested by
the IRB, and submit a final report to the IRB when the study is completed or
terminated.
 7. IRBs and Multi-Site Research

Multi-site trials funded by NIH are characterized by the involvement of multiple

institutions and study sites engaged in a single research study. CTN studies are an
example of multi-site trials funded by the National Institute on Drug Abuse (NIDA).
When a research study involves more than one institution, each institution is
responsible for safeguarding the rights and well-being of research participants at
that institution.
With the implementation of the NIH policy on Use of a Single Institutional Review
Board for Multi-Site Research (effective May 25, 2017), multi-institutional research
in the U.S. involving non-exempt human participants will use a single IRB. Based
on 45 CFR 46.114, the use of a single IRB allows for a more streamlined IRB
review and increases efficiencies while maintaining the protection of human study
participants (NIH Office of Extramural Research, 2016).
For more information, including the scope and applicability of the Use of a Single
Institutional Review Board for Multi-Site Research, reference the NIH policy.
Additional resources are available on the NIH Office of Science Policy’s website for
single IRB (sIRB).

8. Summary of Key Points

 The purpose of an Institutional Review Board (IRB) is to safeguard the rights,

safety, and well-being of all human research participants.
 Any federally funded research involving human participants must be reviewed
and approved by an IRB.
 Any clinical investigation involving a product regulated by the FDA must be
reviewed and approved by an IRB.
 An IRB has the authority to approve or disapprove all research activities that fall
within its jurisdiction. It may disapprove a research project with a request for
modification. It also has the authority to suspend a research study that it
previously approved.
 All previously approved ongoing research must be reviewed by an IRB at least
once a year to determine whether approval should be continued.
 Every institution, including in the NIDA Clinical Trials Network (CTN), that
participates in a clinical study must identify all IRBs that have jurisdiction to
review and approve the protocol.
 To approve a research protocol, the IRB must ensure that:
o Risks to participants are minimized.
o Risks to participants are reasonable in relation to anticipated benefits.
o Selection of participants is equitable.
o Informed consent is properly obtained and documented.
o Adequate provision is made for monitoring the data collected to ensure
the safety of participants.
o Adequate provision is made to protect participants and maintain
confidentiality of data.
o Additional safeguards are included for vulnerable populations.

Informed consent

1. What is Informed Consent?

When most people hear the phrase “informed consent,” they think of the legal
document that explains the study and contains the required dated signatures.
However, informed consent is first and foremost a continuing process. This
includes a person voluntarily agreeing to participate in a research study after being
fully informed about it via verbal discussion with study staff, followed by
documentation in a written, signed, and dated informed consent form. A
participant’s consent will be continually sought during the course of the study, and
the participant will be notified of any changes to the study, along with any other
pertinent information that may influence their decision to remain in the study.
While documentation of informed consent is required in most clinical studies, there
are occasions when a waiver or alteration of written informed consent is obtained
from the Institutional Review Board (IRB) for some or all study participants. The
fundamental criteria for waivers and alterations of informed consent are located in
45 CFR 46.116(c) and 45 CFR 46.116(d). Please consult the local IRB for
determining when it is appropriate to waive the requirement for written consent.
The informed consent document should contain all of the information that the
person needs to make an informed decision about taking part in the study. Many
research teams use the consent document to guide the verbal explanation of the
study to potential participants.
The participant must sign and date the informed consent document before taking
part in any study procedures. Signing the consent form is NOT the final step in the
informed consent process. The participant may withdraw consent and decline to
participate in the study at any time before or after signing the consent document
until their participation in the study is completed.
The general requirements for informed consent in federally funded research are
spelled out in 45 CFR 46.116 and 21 CFR 50.20. Some states have enacted
requirements for informed consent that go beyond federal regulations. This module
reviews the requirements for informed consent that are set out in federal
regulations and in the Good Clinical Practice guidelines of the International Council
for Harmonization (ICH GCP 4.8.10). It is the principal investigator’s responsibility
to know and abide by any additional state requirements.
All researchers must ensure that the process of obtaining informed consent from
study participants not only conforms to federal, state, and local regulations but also
respects each individual’s right to make a voluntary, informed decision.

2. The Informed Consent Document

Study Purpose
The consent document must state (ICH GCP 4.8.10):
 That the trial involves research.
 The purpose of the trial.

Study Treatment and Randomization

The consent document must state (ICH GCP 4.8.10):
 The trial treatment(s) and the probability for random assignment to each
treatment (if a randomized clinical trial).

Study Procedures
The consent document must state (ICH GCP 4.8.10):
 The trial procedures to be followed, including all invasive procedures.
 The participant’s responsibilities.
 Those aspects of the trial that are experimental.
 The expected duration of the participant’s involvement in the trial.

Risks of Taking Part in the Study

The consent document must state (ICH GCP 4.8.10):
 The reasonably foreseeable risks or inconveniences to the participant and,
when applicable, to an embryo, fetus, or nursing infant.

Benefits of Taking Part in the Study

The consent document must state (ICH GCP 4.8.10):
 The reasonably expected benefits. When there is no intended clinical benefit to
the participant, the participant should be made aware of this.

Alternatives to Taking Part in the Study

The consent document must state (ICH GCP 4.8.10):
 The alternative procedure(s) or course(s) of treatment that may be available to
the participant, and their important potential benefits and risks.
Points to note: IRBs often want the informed consent document to list other
therapies available for the condition under treatment in addition to other treatment
options at the facility where the study is being conducted.

Costs of Participation and Compensation in the Event of Injury

The consent document must state (ICH GCP 4.8.10):
 The compensation and/or treatment available to the participant in the event of
trial-related injury.
 The anticipated expenses, if any, to the participant for participating in the trial.
Points to note: When research involves more than minimal risk to the participant,
the consent document must describe the treatment and compensation that will be
provided in the event that a participant sustains a research-related injury. The
language in the consent cannot appear to limit the participant’s rights in seeking
damages related to injury in a trial.
Federal regulations do not limit the definition of “injury” to a physical injury. An
injury may be psychological, social, financial, or of another nature.

Payment for Taking Part in the Study

The consent document must state (ICH GCP 4.8.10):
 The anticipated prorated payment, if any, to the participant for participating in
the trial.
Points to note: Payment to participants for their participation in a research study
must never be coercive in either amount or method of distribution.

Voluntary Nature of Study

The consent document must state (ICH GCP 4.8.10):
 That the participant’s participation in the trial is voluntary and that the
participant may refuse to participate or withdraw from the trial, at any time,
without penalty or loss of benefits to which the participant is otherwise entitled.
 The foreseeable circumstances and/or reasons under which the participant’s
participation in the trial may be terminated.
Confidentiality of Personal Information
The consent document must state (ICH GCP 4.8.10):
 That the monitor(s), the auditor(s), the IRB, and the regulatory authority(ies) will
be granted direct access to the participant’s original medical records for
verification of clinical trial procedures and/or data, without violating the
confidentiality of the participant, to the extent permitted by the applicable laws
and regulations and that, by signing a written informed consent form, the
participant or the participant’s legal representative is authorizing such access.
 That records identifying the participant will be kept confidential and, to the
extent permitted by the applicable laws and/or regulations, will not be made
publicly available. If the results of the trial are published, the participant’s
identity will remain confidential.
Points to note: Certificates of Confidentiality are issued by the National Institutes of
Health (NIH) to prevent investigators from having to release (e.g., via a subpoena)
names or other identifying information about research participants.
Certificates of Confidentiality provide additional protection for participants who are
enrolled in studies in which information is being collected that, if disclosed, could
have adverse consequences for participants or could damage their financial
standing, employability, insurability, or reputation.

New Information that may Affect Study Participation

The consent document must state (ICH GCP 4.8.10):
 That the participant or the participant’s legally acceptable representative will be
informed in a timely manner if information becomes available that may be
relevant to the participant’s willingness to continue participation in the trial.

Study Contacts
The consent document must state (ICH GCP 4.8.10):
 The person(s) to contact for further information regarding the trial and the rights
of trial participants in the event of trial-related injury.
Duration of Participation and Number of People Taking Part in the Study
The consent document must state (ICH GCP 4.8.10):
 The expected duration of the participant's participation in the trial.
 The approximate number of participants involved in the trial.
Points to note: A consent form should be written in non-technical language that
participants would understand. Also, it should be written in language consistent
with the participants educational level, cultural views, and familiarity with research.

3. Special Requirements Concerning Consent

The information that must be provided in an informed consent document is

specified in 45 CFR 46.116, 21 CFR 50.20, and ICH E6 GCP 4.8.10. In the
following sections, we will take a closer look at how this information is presented in
a sample informed consent document.
The consent document should include the following:
 State that the study involves research.
 Briefly explain the purpose of the research, the reason(s) why the person is
being invited to participate, and the expected duration of the person’s
participation in the study.
 Describe the procedures or interventions to be carried out, identifying which
procedures are investigational and which might be provided as standard care in
another setting.
 Explain the use of research methods such as randomization and placebo
controls.
 Describe any foreseeable risks or discomforts to the participant. Estimate how
likely it is that these risks and discomforts will occur.
 Describe the steps that will be taken to prevent or minimize risks or discomforts
to the participant.
 Acknowledge that participation in the study may pose unknown and
unforeseeable risks.
 Describe any benefits to the participant or to others that the research may
reasonably be expected to produce. Estimate how likely it is that these benefits
will occur.
 Disclose any appropriate alternative procedures or courses of treatment that
may benefit the participant.
 Describe the extent to which records will be kept confidential and provide
examples of people or organizations that may have access to research records
(e.g., hospital personnel, study sponsors, staff of the U.S. Food and Drug
Administration).
 For research that involves more than minimal risk, explain and describe any
compensation and any medical treatments that are available if participants are
injured as a result of participation in the study, where further information can be
obtained, and who should be contacted in the event of a research-related injury.
 Explain who should be contacted for answers to questions about the research
and the participant’s rights (including the name and phone number of the
principal investigator).
 State that participation in the study is voluntary and that declining to participate
or deciding to withdraw at any time will involve no penalty or loss of benefits to
which the participant is otherwise entitled.
 State that the participant’s signature will indicate that he or she has decided to
participate in the study, having read and discussed the information presented to
him or her about the research.
 Provide any other information that prospective participants might need to make
an informed decision about whether or not to participate in the research study,
such as any recently obtained information about the investigational drug’s
toxicity in animals.

Informed Consent of Trial Participants (ICH GCP 4.8.10)

Both the informed consent discussion and the written informed consent form and
any other written information to be provided to participants should include
explanations of the following:
 That the trial involves research.
 The purpose of the trial.
 The trial treatment(s) and the probability for random assignment to each
treatment.
 The trial procedures to be followed, including all invasive procedures.
 The participant’s responsibilities.
 Those aspects of the trial that are experimental.
 The reasonably foreseeable risks or inconveniences to the participant and,
when applicable, to an embryo, fetus, or nursing infant.
 The reasonably expected benefits. When there is no intended clinical benefit to
the participant, the participant should be made aware of this.
 The alternative procedure(s) or course(s) of treatment that may be available to
the participant, and their important potential benefits and risks.
 The compensation and/or treatment available to the participant in the event of
trial-related injury.
 The anticipated prorated payment, if any, to the participant for participating in
the trial.
 The anticipated expenses, if any, to the participant for participating in the trial.
 That the participant’s participation in the trial is voluntary and that the
participant may refuse to participate or withdraw from the trial, at any time,
without penalty or loss of benefits to which the participant is otherwise entitled.
 That the monitor(s), the auditor(s), the IRB, and the regulatory authorities will
be granted direct access to the participant’s original medical records for
verification of clinical trial procedures and/or data, without violating the
confidentiality of the participant, to the extent permitted by the applicable laws
and regulations and that, by signing a written informed consent form, the
participant or the participant’s legally acceptable representative is authorizing
such access.
 That records identifying the participant will be kept confidential and, to the
extent permitted by the applicable laws and/or regulations, will not be made
 publicly available. If the results of the trial are published, the participant’s
identity will remain confidential.
 That the participant or the participant’s legally acceptable representative will be
informed in a timely manner if information becomes available that may be
relevant to the participant’s willingness to continue participation in the trial.
 The person(s) to contact for further information regarding the trial and the rights
of trial participants, and whom to contact in the event of trial-related injury.
 The foreseeable circumstances and/or reasons under which the participant’s
participation in the trial may be terminated.
 The expected duration of the participant’s participation in the trial.
 The approximate number of participants involved in the trial.

Special Requirements Concerning the Consent of Pregnant Women

When a research activity involves pregnant women as participants:
 Both mother and father must be informed about any potential impact of the
research on the fetus.
 Both mother and father must consent to the woman’s participation in the
research. However, the father’s consent is not required in the following
circumstances:
o The purpose of the research is to meet the health needs of the mother.
o The father’s identity or whereabouts cannot be determined.
o The father is not reasonably available.
o The pregnancy resulted from rape.
 If either parent is unable to consent because of availability, incompetence, or
temporary incapacity, the informed consent of one parent will suffice provided
the criteria in the previous bullet points are not met.
 Consent of a legally acceptable representative of either or both parents does
not suffice for informed consent.
Additional protections for pregnant women involved as participants in research are
set forth in 45 CFR 46 Subpart B.
Special Requirements Concerning the Consent of Children
The CFR defines children as:
“...persons who have not attained the legal age for consent to treatments or
procedures involved in the research, under the applicable law of the jurisdiction in
which the research will be conducted.” (45 CFR 46.402)
The legal age for consent in most states is 18; persons under age 18 are
considered minors. However, in some jurisdictions, persons under age 18 can
consent to treatment for substance use or dependence.
Additional protections for children and minors involved as participants in research
are set forth in 45 CFR 46 Subpart D.
When children or minors are involved in research, both the assent of the child or
minor and the permission of his or her parent(s) are usually required.
Permission means the agreement of parent(s) or a legal guardian to the
participation of their child or ward in research.
Assent means a child’s agreement to participate in research. Failure to object is
not assent.
In most cases, both parents must give their permission for their child or minor’s
participation in research. However, exceptions to this requirement are permitted in
certain circumstances. An exception is also permitted in the case of an
emancipated minor.
Although children may be legally incapable of giving informed consent, they may
nevertheless be able to assent to or dissent from participation in research.
Out of respect for children as developing persons, children should be asked
whether or not they wish to participate in the research, particularly if:
 The research does not involve interventions that are likely to benefit the
participants, and
 The child can understand what it means to be a volunteer for the benefit of
others.
A child’s assent should be sought when the child is capable of providing such
assent, taking into account his or her age, maturity, and psychological state. The
age that a child needs to attain to give assent varies from state to state. In certain
circumstances, the IRB may determine that research can proceed without the
assent of the children involved.

Special Requirements Concerning the Consent of Prisoners

Because of their incarceration, prisoners may be under constraints that potentially
affect their ability to make a truly voluntary decision about whether or not to
participate in a study.
45 CFR 46.303 defines a prisoner as:
“Any individual involuntarily confined or detained in a penal institution. The term is
intended to encompass individuals sentenced to such an institution under a
criminal or civil statute, individuals detained in other facilities by virtue of statutes or
commitment procedures which provide alternatives to criminal prosecution or
incarceration in a penal institution, and individuals detained pending arraignment,
trial, or sentencing.”
Additional safeguards for the protection of prisoners involved in research (set forth
in 45 CFR 46 Subpart C) include the following:
 The IRB must approve the study as prisoner research.
 The IRB that reviews and approves the study must include a prisoner or
prisoner advocate in its membership.
 A majority of the IRB members (exclusive of prisoner members) must have no
association with the prison(s) involved in the research, apart from their
membership on the IRB.
 The study must present no more than minimal risk to the participants.
 The proposed research must involve the study of:
o The possible causes, effects, and processes of incarceration and
criminal behavior.
o Prisons as institutional structures or prisoners as incarcerated persons.
o Conditions that particularly affect prisoners (e.g., vaccine trials; research
on hepatitis, which is prevalent in prisons; research on social and
 psychological disorders such as alcohol use disorder, substance use
disorder, and assault).
o Practices intended to improve the health or well-being of the participants.

4. The Informed Consent Process

Elements of the Informed Consent Process

Part 1 of this module examined the informed consent document in detail. Part 4 will
examine the process of obtaining informed consent from potential study
participants.
To be valid, informed consent must be based on the following:

Capacity to Give Informed Consent

Before the informed consent process can begin, the potential participant must be
deemed capable of understanding his or her actions and making a reasoned
decision. If the person lacks capacity because he or she is a minor, is ill, or for any
other reason, special provisions must apply (such as a life-threatening emergency),
or the person may not be included in the study.
A person who has a court-appointed legal guardian or who has been determined
by a court to be legally incompetent cannot sign an Informed Consent Form even if
he or she has the capacity to make a decision. This determination is made by the
legal system and not by clinicians.

Disclosure of all Relevant Information

The research team must disclose all relevant information about the study to the
potential participant. The information disclosed must be sufficient to enable the
potential participant to make an informed reasoned decision about whether to
participate. This information generally includes:
 The purpose of the study.
 The nature of the procedure or intervention that is being studied.
 Reasonable alternatives to participation in the study.
 The potential risks and benefits as well as the uncertainties of study
participation.
 The participants obligations for the duration of the study.

Comprehension by the Participant

The potential participant must understand the information disclosed to him or her
about the research study. The participant is free to ask questions to the study team
as well as take additional time to make a decision regarding participation. The
research team must be able to evaluate the potential participant’s ability to
understand what his or her participation in the study would involve. The informed
consent document might include a quiz or other documented assessment to
assess whether the participant truly understands the study.

Voluntary Agreement by the Participant

The participant must agree to participate in the research study and his or her
agreement must be voluntary and free from coercion or undue influence.

Right to Withdraw
The participant must be informed that he or she has a right to withdraw from the
study at any time and for any reason, without penalty or loss of benefits that he or
she would otherwise be entitled to receive.
If a participant wishes to withdraw from a study in which an experimental drug is
being tested, he or she must be informed of any procedures that are recommended
to ensure safe withdrawal from the study drug. The participant must also be
advised of any consequences of withdrawal, such as the inability to continue taking
the study medication. No further data will be collected on the participant, but the
participant will be informed that data already collected can be used for study
analysis.
The research team or principal investigator may terminate participation in a study if
it is in the best interest of the participant.
 5. Inviting Potential Participants to Enroll in a Research Study

Written documentation of Institutional Review Board approval of the study, consent

document(s) and recruitment materials (where appropriate) must be obtained and
provided to the sponsor. NIDA and the CTN Lead Investigator must give their
approval before recruitment can begin at a study site.
Members of the research team may find it helpful to keep the following questions in
mind as they go through the process of recruiting participants for a study:

Is the participant capable of understanding information about the study and

giving informed consent voluntarily?
Adults have the capacity to consent when they possess sufficient mental capability
to:
 Understand information given to them.
 Appreciate the relevance of the information to their circumstances.
 Make a reasoned decision about whether or not to participate in a particular
study.
Capacity to consent may be affected by several factors, including:
 Age.
 Cognitive (mental) impairment.
 Illness.
 Treatments.
Capacity to consent is study-specific. A person may have sufficient capacity to
carry out daily activities and make personal decisions, but he or she may not have
sufficient capacity to appreciate the relevance of a given research study to his or
her circumstances. On the other hand, a person may be incapacitated in daily
activities but still have the capacity to consent to study participation.
For some participants or groups of participants, the investigator or the IRB may
decide to obtain an independent capacity assessment. This may involve consulting
a psychiatrist or neurologist for a determination of an individual’s cognitive ability
and ability to understand the details and implications of a study protocol.
If a person is unable to provide informed consent, a legal representative may give
permission for the individual to participate in research in some circumstances. A
legal representative may be:
 A parent (for minors only).
 A legal guardian, as determined by state law, who can make health care
decisions for a person who is unable to consent.
 An individual who holds a valid durable power of attorney for health care.
Because of variability in legal opinions about the authority of the holder of a
durable power of attorney for health care, the investigator should clarify whether
institutional and IRB policies permit the holder of a durable power of attorney for
health care to give informed consent for participation in research on behalf of a
study participant.

Has the participant been given sufficient, accurate information about the
study?
To be informed means to have thorough knowledge of a matter. To be able to give
informed consent, participants must have sufficient, accurate information about a
study. This means that participants should be able to answer the following
questions:
 What is the purpose of the research?
 Does the study involve an experimental treatment or procedure?
 Does the study involve random assignment to one treatment or another?
 What must I do as a study participant?
 What are the anticipated risks and benefits of participation in the study?
 What alternative treatments or procedures are available?
 Will participants in the study receive any compensation?
 Will I have any expenses for participating in the study?
 How long will my participation in the study last?
 Will my study records be kept confidential?
 Will I be informed in a timely manner about any issues that might affect my
willingness to continue taking part in the study?
 Who is in charge of the study?
 Will I receive treatment whether I participate in the study or not?
 May I withdraw from the study at any time if I change my mind and no longer
wish to take part?

To ensure that a participant has been given sufficient, accurate information about a
study, a member of the research team should:
 Talk with the participant about the study’s purpose and requirements.
 Provide fliers or brochures that describe the study or provide general
information about clinical research, if available.
 Invite the participant to ask questions and respond to questions asked by the
participant.
 Give the participant plenty of time to read the informed consent document and
ask questions about it.
 Give the participant a copy of the informed consent document to take home and
read before signing it. Additionally, give the participant a copy of the consent
form after he or she has signed it.
 Invite the participant to call with questions later and provide the names and
phone numbers of people to call.
Potential study participants may have difficulty focusing for an extended period of
time for various reasons. For example, in some study populations (e.g., substance
use disorders), such difficulty could be related to co-occurring illness, chronic pain,
or withdrawal from substance use. Information must be presented in a language
they can understand, at a pace they can keep up with, and in a manner that invites
questions.
Sometimes information about a study may be presented to a group of potential
participants. In this situation, it is important to meet with participants individually,
ensuring that each person has the opportunity to ask questions in private.
Does the participant understand the information he or she has been given
about the study?
The research team must be satisfied that the participant understands what he or
she has been told about the study. Participants who are in withdrawal, depressed,
manic, or otherwise psychiatrically or cognitively impaired may not be able to give
informed consent.
The best way to be sure that the participant understands the information he or she
has been given about the study is to review the consent document with the
participant, line-by-line. Then, ask the participant questions about the study to
ascertain what information he or she has absorbed.
It may be helpful to prepare a quiz to test the participant’s understanding of the
study. Such a quiz would have to be prepared in advance and submitted to the IRB
for review and approval along with the other consent documents.
There are instances when it is challenging to assess that participants understand
the information they have been given. Consider the following conditions.

A Participant has Limited Speaking Ability in English

45 CFR 46.116 requires that:
“the information given to the participant or the representative shall be in language
understandable to the participant or the representative.” In practice, most IRBs
require the informed consent document to be translated for potential participants
who have limited or no understanding of spoken English. Researchers must follow
the procedure approved by the IRB for obtaining consent from these participants.
It is also important to be aware of specific language differences that may be
confusing to participants who are not fluent in English. For example, in Spanish,
the word “once” means the number 11. An instruction to “take this medication once
daily” might be confusing to a Spanish-speaking participant.

A Participant has Limited Reading Ability

45 CFR 46.117 states:
“[the consent] form may be read to the participant or the participant’s legally
authorized representative, but in any event, the investigator shall give either the
participant or the representative adequate opportunity to read it before it is signed.”
The participant may take the consent home and return at a later date with a
decision.

Both 45 CFR 46.117 and ICH E6 GCP 4.8.9 state that if a participant is unable to
read, a witness must be present throughout the informed consent discussion and
must sign the consent form(s).

Is the participant’s decision to participate in the study entirely voluntary or

has he or she been coerced or influenced in any way (e.g., by circumstances
or by other people)?
Coercion occurs if an individual perceives that he or she could be harmed or
punished for refusing to take part in a study, or if he or she feels compelled due to
financial circumstances.
Historically, individuals in relationships of dependence or unequal power have
been particularly vulnerable to coercion. Coercion occurred in the 1960s at
Willowbrook State School when some parents could not admit their child to the
school unless they agreed to the child’s participation in studies in which children
were deliberately infected with hepatitis.
Blatant coercion such as this, as well as coercive financial incentive, is rare today
because of the vigilance of research teams and IRBs. However, in some cases,
coercion may occur subtly and unintentionally. This kind of coercion can be more
difficult to detect.

Does the participant understand that signing the informed consent document
indicates agreement to participate in the study?
In most cases, the dated signature of the participant, or his or her legally
authorized representative, on the informed consent document indicates that the
participant understands the study and is willing to participate. Signing the informed
consent document should be the final step in the informed consent process.
A member of the research team must sign the consent form to confirm that:
To the best of the team member’s knowledge, the participant has understood the
information given to him or her about the study and is volunteering without
coercion.
The informed consent process followed the procedures authorized by the local
IRB.
ICH GCP requires that the person conducting the informed consent discussion sign
the form.
The participant should be given a copy of the signed consent document. The
original must be kept on file in the research offices per local IRB guidelines.

6. Expedited Review

An IRB may use an expedited review procedure for research that:

 Involves no more than minimal risk and
 Falls into a category that appears on an approved list of categories of research
eligible for expedited review.
An IRB may also use expedited review to approve minor changes in previously
approved research that are made during the period (1 year or less) for which the
approval is authorized. The IRB must have written procedures that specify how an
expedited review will be conducted.
An expedited review (which may involve less waiting time for IRB approval) may be
carried out by the IRB chairperson or by one or more experienced IRB members
designated by the chairperson. The reviewers may exercise all of the authorities of
the IRB except that of disapproving the research. A proposal submitted for
expedited review may be disapproved only by the full IRB.
Research Eligible for Expedited Review
The Department of Health and Human Services has determined that certain types
of research involve no more than minimal risk and are therefore eligible for
expedited review.
The following are examples of research that may be eligible for expedited review:
 Collection of hair or baby teeth.
 Collection of external secretions, including sweat and saliva.
 Recording of data from adults using noninvasive procedures that are routinely
employed in clinical practice (not including exposure to electromagnetic
radiation outside the visible range, for example, x-rays or microwaves.)
 Collection of blood samples by venipuncture.
 Voice recordings made for research purposes, such as investigations of speech
defects.
 Moderate exercise by healthy volunteers.
 Study of existing data, documents, records, pathological specimens, or
diagnostic specimens.

7. Investigators' Responsibilities to the IRB

The investigator must:

 Ensure that the IRB receives all the documents it requires to review the
proposed research.
 Admit no participant to a study before the IRB has issued its written approval of
the study.
 Make no changes to or deviations from the study protocol without prior written
approval from the IRB, except when necessary to eliminate immediate hazards
to participants.
 Report promptly to the IRB:
o Changes to or deviations from the protocol, including changes made to
eliminate immediate hazards to study participants.
 o Changes that increase the risk to participants or significantly affect the
conduct of the study.
o All adverse drug reactions that are both serious and unexpected.
o New information that may adversely affect the safety of participants or
the conduct of the study.
Reporting requirements may vary, and it is the investigator's responsibility to know
the individual reporting requirements of each IRB involved with the research study.
For example, an IRB may require that every serious adverse drug reaction be
promptly reported, whether it was unexpected or not.
 Respond in a timely fashion to all requests from the IRB for additional
information about a research study.
 Submit progress reports to the IRB annually, or more frequently, if requested by
the IRB, and submit a final report to the IRB when the study is completed or
terminated.

8. IRBs and Multi-Site Research

Multi-site trials funded by NIH are characterized by the involvement of multiple

institutions and study sites engaged in a single research study. CTN studies are an
example of multi-site trials funded by the National Institute on Drug Abuse (NIDA).
When a research study involves more than one institution, each institution is
responsible for safeguarding the rights and well-being of research participants at
that institution.
With the implementation of the NIH policy on Use of a Single Institutional Review
Board for Multi-Site Research (effective May 25, 2017), multi-institutional research
in the U.S. involving non-exempt human participants will use a single IRB. Based
on 45 CFR 46.114, the use of a single IRB allows for a more streamlined IRB
review and increases efficiencies while maintaining the protection of human study
participants (NIH Office of Extramural Research, 2016).
 9. Summary of Key Points

 The purpose of an Institutional Review Board (IRB) is to safeguard the rights,

safety, and well-being of all human research participants.
 Any federally funded research involving human participants must be reviewed
and approved by an IRB.
 Any clinical investigation involving a product regulated by the FDA must be
reviewed and approved by an IRB.
 An IRB has the authority to approve or disapprove all research activities that fall
within its jurisdiction. It may disapprove a research project with a request for
modification. It also has the authority to suspend a research study that it
previously approved.
 All previously approved ongoing research must be reviewed by an IRB at least
once a year to determine whether approval should be continued.
 Every institution, including in the NIDA Clinical Trials Network (CTN), that
participates in a clinical study must identify all IRBs that have jurisdiction to
review and approve the protocol.
 To approve a research protocol, the IRB must ensure that:
o Risks to participants are minimized.
o Risks to participants are reasonable in relation to anticipated benefits.
o Selection of participants is equitable.
o Informed consent is properly obtained and documented.
o Adequate provision is made for monitoring the data collected to ensure
the safety of participants.
o Adequate provision is made to protect participants and maintain
confidentiality of data.
o Additional safeguards are included for vulnerable populations.
Confidentiality & Privacy

1. Introduction

Federal regulations require that research records identifying the participant be kept
confidential to the extent permitted by applicable laws and regulations. For
example, if the results of a clinical study are published, participants’ identities must
remain confidential (45 CFR 46 ; ICH GCP 4.8.10(o)).
Federal law also protects the confidentiality of individually identifiable health
information for all research participants. Other federal laws and regulations protect
the records and identity of vulnerable populations as well as study participants
receiving alcohol and drug use treatment.
This module summarizes federal laws and regulations that protect the
confidentiality and privacy of study participants.
In addition to federal laws and regulations, many states have enacted their own
laws and regulations to protect the confidentiality and privacy of individuals
receiving health care. Researchers must be familiar with the confidentiality and
privacy provisions that apply in the state where their studies are conducted.

2. Confidentiality of Clinical Trial Participant Records

What records must be kept confidential?

45 CFR 46 provides protections for the confidentiality of research participants as
follows:
 Subpart A – Basic protections of human research participants
 Subpart B – Additional protections for research participants that are pregnant
women, fetuses, neonates
 Subpart C – Additional protections for participants that are prisoners involved
biomedical and behavioral research
 Subpart D – Additional protections for research participants that are children
In addition to 45 CFR 46, the Health Insurance Portability and Accountability Act
(HIPAA) mandates privacy protections for individually identifiable health
information under 45 CFR 160 and 164. In general, whether research related or
not, all records of the identity, diagnosis, prognosis, or treatment of any person in a
clinical trial must be maintained. This includes any record in connection with
alcohol or drug use prevention, education, training, treatment, rehabilitation, or
research must be kept confidential. “Identity” includes not only the participant’s
name but also any other information that could be readily linked to the participant.
Additionally, applicable information may be in any form (e.g., paper, electronic,
verbal). The HIPAA Security Rule, also under 45 CFR 160 and 164, establishes
standards to protect individuals’ electronic personal health information.
For example, clinical research staff may not disclose that a participant is enrolled in
an HIV study. This type of disclosure would be in violation of the participant’s
confidentiality and can make things difficult for the participant given the stigma
associated with the disease in certain communities.
With certain exceptions, an alcohol or drug use treatment program may not
disclose to anyone outside the program that a particular person attends the
program, or disclose any information that identifies a person as an alcohol or drug
user, unless:
 the person consents to the disclosure in writing, or
 the disclosure is allowed by a court order and the study or research site is not
operating under a Certificate of Confidentiality (see Part 5 of this module for the
provisions and exceptions of Certificates of Confidentiality).
A breach of confidentiality is usually defined as any disclosure of protected
information about a participant to a third party without either a court order or
consent of the participant. The breach of confidentiality may be oral or written and
may occur by telephone, fax, or electronic means (e.g., electronic mail or other
internet-based method of communication).

3. Exceptions to Confidentiality Requirements

Federal regulations identify certain exceptions to the confidentiality requirements
for alcohol and drug use participant records. Consider the following circumstances
for disclosure:

“Need to Know” (42 CFR 2.12(c)(3))

Information in a participant's medical record can be disclosed to people within a
health program, or between a health program and an entity having direct
administrative control over that health program, as they may need this information
to perform duties related to the participant's diagnosis and treatment. For example,
a physician at the research site may provide participant information for the purpose
of referral for treatment of alcohol or drug use to another health entity within the
site or program.

Criminal Activity (42 CFR 2.12(c)(5))

Information in a participant's medical record can be disclosed to law enforcement
officers when the participant has committed or threatened to commit a crime on
program premises or against program staff.
The information disclosed must be limited to the circumstances of the incident,
including the participant's:
 Participant status.
 Name and address.
 Last known whereabouts.

Suspected Child Abuse or Neglect (42 CFR 2.12(c)(6))

Information in a participant's medical record can be disclosed when it is necessary
to report suspected child abuse or neglect to state or local authorities. However,
original participant records may not be used in civil or criminal proceedings that
arise from the report.
Armed Forces and Veterans Administration (42 CFR 2.2(e))
The confidentiality regulations do not apply to the exchange of information
regarding suspected child abuse and neglect within the Armed Forces or between
the Armed Forces health care facilities operated by the U.S. Veterans
Administration (VA). The regulations do not apply to the reporting of child abuse or
neglect under State law.
In addition, disclosure of confidential information without a participant's consent is
permitted in the situations described below ( 42 CFR 2.51 ).

Medical Emergencies (42 CFR 2.51(a))

Confidential information about a participant may be given to medical personnel in a
medical emergency for the purpose of treating a condition that poses an immediate
threat to the health of any person and requires immediate medical intervention.

Research Activities (42 CFR 2.52)

Confidential information about a participant may be disclosed for research
purposes, provided that the recipient of the information:
 Is qualified to conduct the research.
 Has a research protocol that ensures the information will be kept secure and
will not be re-disclosed except to the source from which it was obtained.
 Will not identify any individual participant in any report of the research.
In addition, a group of at least three independent persons must review the protocol
to ensure that:
 The rights and welfare of participants will be adequately protected.
 The risks of disclosing information about participants are outweighed by the
potential benefits of the research.

Audit and Evaluation Activities (42 CFR 2.53)

Confidential information about a participant may be disclosed for management
audits, financial audits, or program evaluation activities provided that the
information:
 Is not re-disclosed except to the source from which it was obtained.
 Is used only to carry out an audit or evaluation purpose or to investigate or
prosecute criminal or other activity as authorized by a court order.

Danger to Self (42 CFR 2.51; 45 CFR 164.512(j)(4))

If a participant speaks of an intention to kill himself or herself, the participant must
be evaluated by a qualified mental health professional. If the participant is found to
be at risk for suicide, confidential information may be disclosed to ensure his or her
safety. Specifically, it may be necessary to admit the participant to a hospital or to
notify an emergency response team.
A member of the research team who suspects a participant is in danger of harming
himself or herself should notify a supervisor, qualified counselor, or physician.

Danger to Others (42 CFR 2.51; 45 CFR 164.512(j)(4))

If a participant speaks of an intention to harm another person, he or she must be
evaluated by a qualified mental health professional. If the threat is considered
credible, a report must be made both to the police (42 CFR 2.12(c)(5)) and to the
identified target. A member of the research team who suspects a participant is in
danger of harming another person should notify a supervisor, qualified counselor,
or physician.

Communicable Diseases
Confidential information about a participant may be disclosed when the participant
has a disease that poses a risk to public health. All states require that cases of
selected communicable diseases be reported to local health authorities. Since
1999, certain infectious diseases have also been designated as notifiable to the
National Notifiable Diseases Surveillance System (NNDSS) of the U.S. Centers for
Disease Control and Prevention. However, state reporting to the NNDSS is
voluntary. All states generally report the internationally quarantinable diseases
(e.g., cholera, plague, yellow fever) in compliance with the World Health
Organization's International Health Regulations.
State, local, or institutional policies may also require that communicable diseases
be reported to other agencies. Researchers should contact their state health
departments to obtain current and complete information about communicable
disease reporting requirements in individual states.

Court Order
Disclosure of confidential information about a participant may be authorized by a
court order if the disclosure is:
 Necessary to protect against a threat to life or a threat of serious bodily injury
(e.g., child abuse, neglect, and threats against third parties) (42 CFR 2.63(a)
(1)).
 Necessary to the investigation or prosecution of a serious crime (e.g., homicide,
rape, kidnapping, armed robbery, and assault with a deadly weapon) (42 CFR
2.63(a)(2)).
 Relevant to a legal or administrative proceeding in which the participant offers
evidence that pertains to the confidential disclosure (42 CFR 2.63(a)(3)).
A court order alone does not compel disclosure of confidential information. A
subpoena or other legal mandate must be issued to compel disclosure.

Requirements of State Law

States may determine additional exceptions to the requirements for confidentiality
of alcohol and drug use participant records. In some states, health care providers
must report suspected domestic violence to authorities. Members of the research
team should be familiar with their state's laws and regulations. Copies of relevant
state laws should be on file at each study site.
When the research is protected by a Certificate of Confidentiality (CoC), research
participants must be informed of the conditions that the certificate does not prevent
disclosure. The CoC conditions for disclosure are not all inclusive of the
circumstances mentioned above. (See Part 5 of this module for more information
on Certificates of Confidentiality.
 4. Maintaining Confidentiality of Research Participants

Maintaining the Security of Written Records

When not in use, written records covered by the confidentiality regulations must be
kept in a secure room, a locked file cabinet, a safe, or other secure place. Each
program must adopt written procedures to control access to and use of these
records.

What happens to participant records when a program is discontinued?

If a research site discontinues operation or is acquired by another program, there
are certain medical record responsibilities that must be followed regarding the
clinical records. Each site Principal Investigator must be aware of the procedures
and retention period requirements for medical and study related records
established by the sponsor and regulatory entities with oversight authority. For
example, in the Clinical Trials Network, when a program is discontinued, the
sponsor requires the program director to notify NIDA immediately to discuss the
retention of any essential source documents created during the clinical study from
which study data were obtained. Additionally, these documents must be kept at the
study site, at the site, or by the sponsor, for a period defined by the sponsor.

Medical Record Responsibilities

The program must purge participant-identifying information from its records or
destroy the records unless:
 The subject of the records gives written consent to transfer of the records to the
acquiring program or to any other designated program.
 The law requires that the records be kept for a specified period.
Retained records must be sealed in envelopes or other containers and:
 Sealed in envelopes or other containers.
 In accordance with 42 CFR 2.19(b)(1), labeled as follows: “Records of [insert
name of program] required to be maintained under [insert citation to statute,
 regulation, court order, or other legal authority requiring that records be kept]
until a date not later than [insert appropriate date].”
 Held by a responsible person who must destroy the records as soon as is
practicable at the end of the specified retention period.

Recommended Routine Practices for Maintaining the Confidentiality of

Research Participants
Researchers ordinarily use information that study participants have disclosed or
provided voluntarily (i.e., with their informed consent) for research purposes.
Because the relationship between researcher and study participant is based on
trust, it is most important to ensure that the confidentiality of this information is
maintained.
The following routine practices are recommended to ensure the confidentiality of
research participants:
 Substitute codes for information that identifies the participant (e.g., use
numbers instead of names to identify participants).
 Remove face sheets that contain identifiers, such as names and addresses.
 Properly dispose of all paper documents that contain identifiers.
 Limit access to all data that identifies participants.
 Educate research staff on the importance of maintaining confidentiality.
 Store paper records in locked cabinets.
 Assign security codes to computerized records.

5. Certificates of Confidentiality

What is a Certificate of Confidentiality?

A Certificate of Confidentiality provides an additional level of protection for the
privacy of participants in biomedical, behavioral, and clinical research studies.
Certificates of Confidentiality may be granted for studies collecting information that,
if disclosed, could have adverse consequences for study participants or damage
their financial standing, employability, insurability, or reputation. By protecting
researchers and institutions from being compelled to disclose information that
would identify research subjects, Certificates of Confidentiality help achieve the
research objectives and promote participation in studies by assuring confidentiality
and privacy to participants. For more information review the NIH Certificate of
Confidentiality Kiosk.

Key Points about Certificates of Confidentiality

 A Certificate of Confidentiality is not transferable from one researcher to
another.
 Every Certificate of Confidentiality has an expiration date. If the research
project covered by the certificate will not be completed by the expiration date,
the researcher must submit a written request for an extension well in advance
of the expiration date.
 The Certificate of Confidentiality must be amended if significant changes occur
in the research project (e.g., changes in key personnel, major changes in the
scope or direction of the research protocol, changes in the drugs administered
or the persons administering them). Amendment of the certificate must be
requested in writing, giving details of the changes, before the changes are
implemented.
 For a multi-site trial, one Certificate of Confidentiality (CoC) may be required for
all sites. However, each study investigator may contact the CoC coordinator
with the agency issuing the certificate.

Applying for a Certificate of Confidentiality

Certificates of Confidentiality are granted by the Department of Health and Human
Services (DHHS).
Additional Information Required
The following additional information is required in the application for a Certificate of
Confidentiality for any research project involving the administration of
investigational product:
 Identification of the drugs to be administered; description of the methods of
administration, including dosages.
 Evidence that the persons administering the drugs are authorized to do so.
 For controlled drugs, a copy of the research project's Drug Enforcement
Administration (DEA) registration form.

What Participants Should Know About a Certificate of Confidentiality

Participants must be told that a research project has been granted a Certificate of
Confidentiality. They must be informed that:
 Except under certain conditions, researchers may not be compelled to identify
research participants in any civil, criminal, administrative, legislative, or other
proceeding.
 The certificate is not transferable.
 The certificate has an expiration date.
 The certificate must be amended if major changes occur in the research
project.

6. HIPAA Privacy Rule

What is the HIPAA Privacy Rule?

The U.S. Congress passed the Health Insurance Portability and Accountability Act
(HIPAA) (Public Law 104-191) in 1996 to improve the efficiency and effectiveness
of the health care system. The law includes provisions requiring the Department of
Health and Human Services (DHHS) to adopt national standards for electronic
health care transactions. Congress recognized that the introduction of advances in
electronic technology into the health care system could erode the privacy of health
information. Consequently, Congress incorporated into HIPAA provisions that
mandated the adoption of federal privacy protections for individually identifiable
health information under 45 CFR 160 and 164.
DHHS issued the HIPAA Privacy Rule — also known as the Standards for Privacy
of Individually Identifiable Health Information — to put into operation these privacy
protections. It establishes for the first time a set of national standards for the
protection of certain health information. The Privacy Rule became effective on April
14, 2003. It is enforced by the DHHS Office of Civil Rights.
This section provides a brief overview of the main provisions of the HIPAA Privacy
Rule. For additional information, go to HIPAA Privacy Rule and Its Impact on
Research, a website created to inform the research community about the Privacy
Rule.

To whom does the HIPAA Privacy Rule apply?

The HIPAA Privacy Rule applies to covered entities. A covered entity is defined as.
 A health plan.
 A health care clearinghouse.
 A health care provider who transmits any health information electronically in
connection with transactions such as claims, benefit eligibility inquiries, and
referral authorization requests. Providers who use a billing service or other third
party to handle such transactions are also considered covered entities.

What information is protected by the HIPAA Privacy Rule?

The HIPAA Privacy Rule protects all individually identifiable health information that
is held or transmitted by covered entities and their business associates. The
information may be in any form (e.g., paper, electronic, verbal). The Privacy Rule
calls this information protected health information (PHI).
 7. Permitted Disclosures of Protected Health Information

Covered entities may use or disclose the “minimum necessary” amount of

protected health information (PHI) to or among themselves, without the individual's
authorization, for purposes of treatment, payment, and health care operations.
The only exceptions to the “minimum necessary” requirement are for the use and
disclosure of PHI:
 To or by health care providers for treatment purposes.
 To the individual who is the subject of the protected health information.
 To the Secretary of Health and Human Services, who has authority for the
Privacy Rule.
 Use or disclosure that is required by the law.
Additionally, covered entities may disclose PHI for certain “public policy” purposes
without the individual's authorization. However, they are required to track these
disclosures for accounting purposes.

Public Policy Purposes

The HIPAA Privacy Rule permits covered entities to use or disclose protected
health information (PHI) without the individual's authorization for the following
public policy purposes:
 When the disclosure is required by law.
 For public health activities (e.g., prevention or control of disease, notification of
adverse drug events).
 In cases of abuse, neglect, or domestic violence.
 For health care oversight activities authorized by law or regulations.
 For judicial and administrative purposes (e.g., a court order, subpoena, or
warrant).
 To a law enforcement official for law enforcement purposes.
 To a coroner, medical examiner, or funeral director when the information
concerns a deceased person.
 For cadaveric organ, eye, and tissue donation.
 For research purposes.
 To avert a serious threat to health or safety.
 For national security or intelligence activities.
 For workers' compensation purposes.

Permitted Disclosures of Protected Health Information for Research

Purposes

Research is defined as “any systematic investigation designed to develop or

contribute to generalizable knowledge.” Covered entities can disclose protected
health information (PHI) when:

Authorization is Obtained from the Participant

Under the HIPAA Privacy Rule, a research participant may authorize a covered
entity to use and disclose his or her protected health information (PHI) for research
purposes. The authorization form must be approved by the relevant Institutional
Review Board or a Privacy Board.

IRBs and Confidentiality

In accordance with the Belmont Report, IRBs must ensure adequate provision is
made to protect subjects’ privacy and maintain the confidentiality of data.

Protection of Subjects’ Privacy.

The IRB must consider whether the research involves an invasion of privacy.
Factors to be considered include:
 The private or sensitive nature of the information sought,
 The likelihood that subjects will regard the study as an invasion of privacy,
 The importance of the research, and
 The availability of alternative ways to conduct the study.

Confidentiality of Data
IRBs must evaluate whether adequate provisions exist to safeguard the
confidentiality of information that is collected.
Authorization for disclosures is obtained routinely from participants during the
informed consent process. The authorization may be combined with the Informed
Consent Form that a research participant signs when agreeing to participate in a
study, or the participant may sign a separate authorization form. In either case, the
authorization must include the following:
All members of the NIDA Clinical Trials Network (CTN) must ensure that the
process of obtaining informed consent from research subjects not only conforms to
federal, state, and local regulations but also respects each individual’s right to
make a voluntary, informed decision.
 Description of the information to be disclosed.
 Identity of the person who may use or disclose the information.
 Identity of the person to whom the information will be disclosed or by whom it
will be used.
 Purpose of the use or disclosure.
 Length of time the data will be retained with identifiers.
 Expiration date of the authorization.
 A statement of the participant's right to revoke authorization.
 A statement that information disclosed in accordance with an authorization may
no longer be protected by the Privacy Rule.
 Participant's signature and date of signature.
Treatment programs do not need to keep track of disclosures that are authorized
by the participant. In other words, once a program obtains a participant's
permission to disclose his or her PHI, there is no need to document each occasion
that a disclosure is made.
Sharing a Limited Data Set

A covered entity may enter into a data use agreement to use and disclose
protected health information (PHI) that is included in a limited data set without
obtaining either authorization or a waiver of authorization. Limited data sets may be
used or disclosed only for purposes of research, public health, or health care
operations.
The following identifiers are permitted in a limited data set:
 Admission, discharge, and service dates.
 Birth date.
 Date of death.
 Age.
 Geographical subdivisions (e.g., state, county, city, precinct, zip code).
The data use agreement must:
 Identify who is permitted to use or receive the limited data set.
 Stipulate that the recipient will:
o Not use or disclose the information other than as permitted by the
agreement or required by law.
o Use appropriate safeguards to prevent the use or disclosure of the
information except as permitted in the agreement.
o Hold any agent of the recipient (including subcontractors) to the
standards, restrictions, and conditions stated in the data use agreement.
o Not identify the information or contact the individuals whose information
is included in the limited data set.

De-Identifying the Health Information

Covered entities may “de-identify” protected health information (PHI) by removing

all individually identifiable health information from the record or file. Once health
information has been de-identified, it is no longer considered PHI and therefore is
not subject to the HIPAA Privacy Rule.

Individually Identifiable Health Information

Under the HIPAA Privacy Rule, individually identifiable health information includes
the following:
 Names.
 All geographic subdivisions smaller than a state, including street address, city,
county, precinct, ZIP Code, and their equivalent geographical codes, except for
the initial three digits of a ZIP Code if, according to the current publicly available
data from the Bureau of the Census:
o The geographic unit formed by combining all ZIP Codes with the same
three initial digits contains more than 20,000 people.
o The initial three digits of a ZIP Code for all such geographic units
containing 20,000 or fewer people are changed to 000.
 All elements of dates (except year) for dates directly related to an individual,
including birth date, admission date, discharge date, date of death; and all ages
over 89 and all elements of dates (including year) indicative of such age, except
that such ages and elements may be aggregated into a single category of age
90 or older.
 Telephone numbers.
 Facsimile (fax) numbers.
 Electronic mail addresses (e-mail).
 Social security numbers.
 Medical record numbers.
 Health plan beneficiary numbers.
 Account numbers.
 Certificate/license numbers.
 Vehicle identifiers and serial numbers, including license plate numbers.
 Device identifiers and serial numbers.
 Web universal resource locators (URLs).
 Internet protocol (IP) address numbers.
 Biometric identifiers, including fingerprints and voiceprints.
 Full-face photographic images and any comparable images.
 Any other unique identifying number, characteristic, or code, unless otherwise
permitted by the Privacy Rule for re-identification.

Obtaining a Waiver of Authorization for Certain Research Activities

An Institutional Review Board or Privacy Board may waive, in whole or in part, the
requirement that the participant authorize the disclosure of protected health
information (PHI) if it is satisfied that:
 The use or disclosure involves no more than minimal risk to the privacy of
individuals because
o An adequate plan exists to protect health information identifiers from
improper use and disclosure and to destroy identifiers as soon as
practicable; and
o Adequate written assurances have been provided that the PHI will not be
reused or shared with any other person or entity, except as required by
law, for authorized oversight of the research study, or for other research
purposes.
 The research could not practicably be conducted without the waiver or
alteration.
 The research could not practicably be conducted without access to and use of
the PHI.

Privacy Board
A Privacy Board is a review body that may be established to act upon requests for
a waiver or an alteration of the authorization requirement under the Privacy Rule
for uses and disclosures of protected health information (PHI) for a particular
research study. A Privacy Board may waive or alter all or part of the authorization
requirements for a specified research project or protocol. A covered entity may use
and disclose PHI without authorization, or with an altered authorization, if it
receives the proper documentation of approval of such alteration or waiver from a
Privacy Board.

Preparing a Research Protocol

Covered entities may use and disclose protected health information (PHI) without
authorization if the researcher states in writing that:
 The use or disclosure is solely for the purpose of preparing a research protocol;
 No PHI will be removed from the covered entity's location; and
 The PHI sought is necessary for the research.

The Participant is Deceased

Covered entities may use and disclose protected health information (PHI) without
authorization if:
 The researcher states in writing that:
o The use or disclosure sought is solely for research on the PHI of
deceased persons;
o The PHI sought is necessary for the research; and
o The covered entity obtains documentation of the death of the persons
whose PHI is sought.

8. HIPAA Rights, Privacy, and Enforcement

Rights of Research Participants Under the HIPAA Privacy Rule

The Privacy Rule defines two new rights for research participants.

Right to an Accounting

Participants have a right to ask researchers for an accounting of their protected

health information (PHI) that has been obtained under a waiver of or exception to
the HIPAA Privacy Rule. An accounting of such disclosures may be requested for
the previous six years.
A researcher is not required to account for disclosures that were:
 Authorized by the participant;
 Contained in a limited data set; or
 Released as de-identified data.
Other instances where accounting is not required include for national security or
intelligence purposes, and disclosure to correctional institutions or law enforcement
officials.

Right to Revoke Authorization

Participants have the right to revoke their authorization of the use or disclosure of
their protected health information (PHI). However, the revocation has no effect if
the researcher has already made a disclosure in accordance with the participant's
original authorization.

Enforcement and Oversight of the HIPAA Privacy Rule

The DHHS Office of Civil Rights is responsible for enforcing compliance with the
HIPAA Privacy Rule and for investigating complaints about lack of compliance.
Failure to comply with the Privacy Rule may result in the levying of civil or criminal
penalties. For more information about enforcement of the Privacy Rule, go to
http://www.hhs.gov/ocr/hipaa/.

9. Summary of Key Points

 Federal law and regulations protect the confidentiality of participant records. In

addition, Federal law protects the confidentiality of identifiable health
information for all research participants.
 In general, all records of the identity, diagnosis, prognosis, or treatment of any
person that are maintained in connection with alcohol or drug use prevention,
education, training, treatment, rehabilitation, or research must be kept
confidential.
 The regulations identify certain exceptions to the confidentiality requirements.
Information in a participant's medical record can be disclosed:
o To people performing duties related to the participant's diagnosis,
treatment, or referral for treatment of alcohol or drug use.
o To law enforcement officers when the participant has committed, or
threatened to commit, a crime on program premises or against program
staff.
o When reporting suspected child abuse or neglect to state or local
authorities.
o To medical personnel in a medical emergency.
o For research purposes, with certain conditions.
o For management audits, financial audits, or program evaluation.
o If a participant is found to be at risk for suicide or if he or she makes a
credible threat to harm another person.
o When the participant has a communicable disease that poses a risk to
public health.
o When authorized by a court order.
o When required by state law.
 If a program discontinues operation or is acquired by another program, there
are certain medical record responsibilities that must be followed regarding the
clinical records. Each site Principal Investigator must be aware of the
procedures and retention period requirements for medical and study related
records established by the sponsor and regulatory entities with oversight
authority.
 A Certificate of Confidentiality provides an additional level of protection for the
privacy of participants involved in research studies.
 Except under certain conditions, a researcher who has obtained a Certificate of
Confidentiality cannot be compelled to identify research participants in any
federal, state, or local civil, criminal, administrative, legislative, or other
proceeding.
 Participants must be told that a research project has been granted a Certificate
of Confidentiality.
 The HIPAA Privacy Rule protects all individually identifiable health information
that is held or transmitted by covered entities and their business associates.
The information may be in any form (e.g., paper, electronic, oral). The Privacy
Rule calls this information protected health information (PHI). A covered entity
may not use or disclose PHI except as permitted or required by the Privacy
Rule.
 Covered entities may use or disclose the “minimum necessary” amount of PHI
to or among themselves, without the individual's authorization, for purposes of
treatment, payment, and health care operations.
 PHI may be disclosed for research purposes when the disclosure is authorized
by the research participant. Authorization for disclosures is obtained routinely
from participants during the informed consent process. Treatment programs do
not need to keep track of disclosures that are authorized by the participant.
 Health information that has been de-identified by the removal of all elements
that could identify an individual is no longer considered PHI and is not subject
to the Privacy Rule.
Participant Safety & Adverse Events

1. Introduction

Inherent Complexities of Client Safety and Adverse Events

Participant safety is a broad topic that cuts across all aspects of Good Clinical
Practice (GCP) as is discussed in the document the ICH Guideline for Industry:
Clinical Safety Data Management. Among other issues, ensuring participant safety
encompasses protocol design, quality-assurance monitoring, government
regulations, and ethical issues. It may also involve the use of clinical judgment and
entail situations/decisions on which no two clinicians may be in complete
agreement. As a result, new researchers may feel frustrated when questions arise
about participant safety.
This module focuses on ways of protecting participants’ safety and well-being as
well as how adverse events should be recorded and reported for clinical studies.
Because of the complexity of the topic, this module cannot cover every participant
safety issue that might arise in a clinical trial. Researchers are advised to seek
further guidance as needed from the study investigator or other knowledgeable
team members. The role of investigators in protecting the safety and well-being of
research participants is discussed further in this module.

Key Points About the Protection of Participant Safety

 The obligation to protect the well-being of study participants does not end when
a study receives Institutional Review Board (IRB) or Data and Safety Monitoring
Board (DSMB) approval, or when a participant signs the informed consent form.
The interests of study participants must be safeguarded at all times—and by
many entities—throughout a clinical research study.
 Ultimately, no single individual or institution can provide complete protection for
trial participants. A systematic plan must be followed for each trial to ensure
that everyone involved understands and fulfils his or her responsibilities.
 Research team members with adequate knowledge of clinical trials, statistics,
and the clinical disorder and the Investigational Product being studied must
review the study data regularly to ensure that events are properly interpreted
and reported.
 Ongoing communication among all study staff is an essential part of ensuring
participant safety.

Who is responsible for assuring the safety of study participants?

Investigator
In accordance with ICH GCP, the investigator or a sub-investigator that is a
qualified physician (or dentist, when appropriate) is responsible for all trial-related
medical decisions. The investigator must ensure that adequate medical care is
provided to a subject for any adverse events and inform the subject when care is
needed for an intercurrent illness that the investigator becomes aware of. (ICH
GCP E6(R2), 4.3)

Who is responsible for assuring the safety of participants in studies of

investigational new drugs?

In studies conducted under the Investigational New Drug (IND) regulations,

responsibility for ensuring compliance with FDA regulations on participant safety
rests with the sponsor of the IND under which the study is conducted.

The investigator is responsible for:

"protecting the rights, safety, and welfare of study participants under the
investigator’s care."
The U.S. Food and Drug Administration (FDA) requires the investigator to:
"promptly report to the IRB (Institutional Review Board) all unanticipated problems
involving risk to human subjects or others"
and to report to both the sponsor and the IRB:
"any serious adverse event, whether or not considered drug related and must
include an assessment of whether there is a reasonable possibility that the drug
caused the event" .

Responsibilities of Role Players in CTN

Role of the Lead Investigator

For each CTN protocol, the Lead Investigator (LI) is responsible for the accurate
documentation, investigation, and follow-up of all safety reports. In addition, the LI
must ensure that each Institutional Review Board (IRB) involved in the study is fully
informed of safety issues that may arise from the protocol.

Role of the Site Principal Investigator

In CTN studies, the Node Principal Investigator (PI) is responsible for assuring the
safety of study participants at research sites within his or her Node. This includes
responsibility for assuring the proper monitoring of study progress and the
evaluation and reporting of adverse events at the Node.
For any given protocol, the Node PI may delegate any of these tasks to other
appropriately qualified persons, such as the Protocol Principal Investigator (below),
affiliated with his or her Node. Such delegation of authority should be formally
designated in a delegation of responsibilities log.

Role of the Protocol Site Principal Investigator

In CTN studies, the Protocol Principal Investigator (PI) is charged with assuring the
safety of study participants at the research sites within the Node for which he or
she is responsible.
The Site PI is also expected to be knowledgeable about the policies of all local
IRBs concerning the reporting of adverse events and to adhere to these policies.
Role of the Study Medical Monitor
In CTN studies, the Study Medical Monitor is appointed by the Lead Investigator
and is responsible for reviewing reports of adverse events (AEs) and serious
adverse events (SAEs) that are submitted by study sites. He or she must ensure
that participants receive good clinical care and that safety concerns are identified
quickly and addressed appropriately. The Study Medical Monitor must:
 Review each AE/SAE and consider whether it may be related to study
participation.
 Determine if the safety event meets reportability criteria as per federal
regulations.
 Propose changes in the protocol or consent form, if warranted by the severity or
frequency of adverse events.

Role of the NIDA Study Medical Officer

In CTN studies, the NIDA Study Medical Officer has overall responsibility for
evaluating, monitoring, and reporting on the safety of participants.

Ongoing Informed Consent

As discussed in the Informed Consent module, informed consent is a process as

well as a legally required document. Throughout any study, researchers must
continue to keep study participants informed about any new information with regard
to the safety of the product and, in particular, about any new developments or
findings that may affect participants’ willingness to remain in the study.

Researchers must:
 Inform participants, in a language that they understand, about emerging
developments in the study, related studies utilizing the same Investigational
Product(s), or pertinent pre-clinical studies that are significant to participant
safety.
 Offer participants the opportunity to ask questions about the information they
have been given.
 Ensure that participants understand they may withdraw from the study at any
time and cannot be penalized for doing so.
 Be satisfied that each participant understands what he or she has been told and
is making a voluntary, informed decision to remain in the study.

2. Participant Safety & Adverse Events

What is an adverse event?

The Good Clinical Practice (GCP) guidelines of the International Council for
Harmonization (ICH) define an adverse event (AE) as: “any untoward medical
occurrence in a patient or clinical investigation subject administered a
pharmaceutical product and that does not necessarily have a causal relationship
with this treatment” (ICH GCP, E6(R2) 1.2).
The term adverse event is defined in the U.S. Code of Federal Regulations (CFR)
Title 21 Section 312.32(a) as follows: "any untoward medical occurrence
associated with the use of a drug in humans, whether or not considered drug
related."
ICH guidelines for Clinical Safety Data Management: Definitions and Standards for
Expedited Reporting uses the ICH GCP definition.
An AE may be “any unfavorable or unintended" sign, symptom, or disease that
occurs in a person who has taken a medication. The occurrence does not need to
be related to the drug treatment.
An adverse event (AE) may be:
 A physical event (e.g., a rash).
 A psychological event (e.g., depressed mood).
 A laboratory event (e.g., elevated blood sugar).
 An increase in the severity or frequency of a pre-existing symptom or condition
(e.g., increased pain in a painful tooth)
An adverse event may also be referred to as an “adverse experience.”

Situations involving the use of a drug in humans in which an adverse event may
occur
An adverse event (AE) may occur as a result of:
 A drug overdose, whether accidental (e.g., the patient is of a small size or has
poor metabolism of the drug) or intentional (e.g., suicide attempt).
 An interaction with food or with another medication.
 Drug abuse (e.g., the patient faints when taking a nonprescribed drug to “get
high”).
 Drug withdrawal (e.g., the patient stops taking a prescribed medication and has
a seizure).
 Any failure of expected pharmacological action (e.g., a drug given to slow a
patient’s heart rate instead increases the heart rate).
 The use of a drug in professional practice (e.g., when an approved [marketed]
drug is given to a patient and he or she develops a rash). The patient does not
need to be enrolled in a clinical trial.

Examples of events that should or should not be reported as adverse events

An adverse event (AE) may occur as a result of:
 Worsening of a withdrawal symptom—even if it is a symptom noted in the
patient’s medical history form—should be recorded as an AE if it occurs during
the course of a study. Withdrawal symptoms can be coded as such to
differentiate them from similar AEs that are not withdrawal related.
 Stable chronic conditions (e.g., arthritis that is present before the participant
enters a clinical trial and does not worsen) are not considered AEs. These
conditions should be accounted for in the participant’s medical history.
 Reports of unintentional overdose of any medication (including the study
medication) that result in no associated adverse reaction should not be reported
as AEs. They should be routinely followed up to ensure that information is as
complete as possible with regard to symptoms, treatment, and outcome.
 Drug abuse during a study should not be recorded as an AE unless it worsens
during treatment (e.g., the participant is hospitalized for detoxification).

What is an adverse event in a behavioral study?

As defined in the previous section, an AE is commonly understood to be an event

that occurs during treatment with a drug or device. However, the definition can also
be applied to any “untoward occurrence” that occurs in any clinical trial, including
behavioral studies.
For trials that are not regulated by the FDA, the Investigators and protocol teams
may define the term adverse event to reflect what is clinically and scientifically
relevant to their study.
Thus, for a behavioral trial that does not involve treatment with a drug, an AE may
be defined as:
“Any unfavorable, unintended diagnosis, symptom, sign (including an abnormal
laboratory finding), syndrome, or disease that occurs during the study, having been
absent at baseline, or—if present at baseline—appears to worsen.” (Interim
Guidelines for NIH Intramural Principal Investigators and for NIH Institutional
Review Boards on Reporting Adverse Events)
In certain studies, including some behavioral studies, it may be important to
capture the occurrence of nonmedical events such as arrest, imprisonment, and
violence to others, which may be contributing factors to an AE or may indicate that
an AE has occurred. As an example of the latter, a participant’s increased drug use
– an AE – could result in an arrest.
Investigators may elect to capture nonmedical events that may be behavioral (e.g.,
violence) or social (e.g., arrest, imprisonment) on the AE Case Report Form (CRF),
or such events may be captured elsewhere.

Roles and responsibilities of the Lead Investigator

The Lead Investigator (LI) is a CTN-specific role for the investigator that has overall
responsibility for the entire study. The LI convenes a Protocol Team that assists
with all aspects of the development and operation of the study. In other studies,
this role may be considered the Prinicipal Investigator.
The Project Director (or Protocol Coordinator) is the LI’s “right hand.” He or she is
responsible for coordinating and carrying out day–to–day study operations. The
Project Director is a member of the Protocol Team and is the primary contact for
questions about the overall study.
Other roles and responsibilities represented on the Protocol Team usually include,
but may not be limited to, the following:
 Data Management
 Quality Assurance
 Training
 Regulatory Affairs

What is an adverse drug reaction?

The terms adverse event and adverse drug reaction are easily confused, but they
have distinctly different meanings. As discussed in earlier sections, an adverse
event (AE) is any “untoward occurrence” in a patient or clinical study participant
that need not be related to treatment.
By contrast, an adverse drug reaction (ADR) implies an adverse event that results
from a medicine or treatment (i.e., there is a degree of relatedness between the
adverse reaction and the treatment).
FDA regulations define an ADR as
“an undesirable effect, reasonably associated with the use of a drug, that may
occur as part of the pharmacological action of the drug or may be unpredictable in
its occurrence” (21 CFR 201.57(c)).
Remember: Although every ADR is also an AE, only some AEs will also be ADRs.
Therefore, it is very important to collect clear and complete information about every
AE.
What is a serious adverse event?

An AE is considered serious if it poses a threat to the patient’s life or functioning.

The FDA defines a serious adverse event (SAE) as any untoward medical
occurrence that:
 Results in death, or
 Is life-threatening (places the patient at risk of death), or
 Requires hospitalization or prolongs an existing hospitalization, or
 Causes persistent or significant disability or incapacity, or
 Is a birth defect, or
 Requires medical intervention to prevent one of the above outcomes (e.g., an
asthma attack that requires intensive treatment in an emergency room, a
seizure that does not result in hospitalization but requires medical treatment).
An AE needs to meet only one of the above criteria to be considered serious. A
change in vital signs, diagnostic tests (e.g., an electrocardiogram), or laboratory
test results may be an SAE if the change is of sufficient magnitude to meet one of
the above criteria.
An adverse event is judged “serious” on the basis of the threat it poses to a
patient’s life or functioning. For example, a patient could be diagnosed with
pneumonia in his or her doctor’s office and given antibiotics to take at home. The
pneumonia is an AE, but not an SAE
However, if the patient is hospitalized for the pneumonia, that is considered an
SAE. (The SAE is pneumonia resulting in hospitalization.)
It is also imperative to clarify between severe and serious. While the intensity of an
event may be severe, it may not meet the criteria for serious (e.g. Severe
Migraine). Severity is discussed in this module.
Elective surgery (i.e. surgery that is planned prior to entry into the study) is not a
Serious Adverse Event. For example, removal of bunions on feet, nose
reconstruction, planned hysterectomy, etc.
What is a serious adverse event in a behavioral study?

The definition of an SAE in the previous section is commonly understood to relate

to clinical studies of drug treatments. However, the definition can be applied to any
kind of clinical study, including behavioral studies.
The Investigator of a study may, for the purposes of the study, limit or expand the
FDA criteria for an SAE to reflect the specific risks of the study intervention and the
characteristics of the study population.
The Investigator may describe in the research protocol other AEs that in that
particular study are to be considered serious, although the AE may not meet the
FDA criteria. For example, all suicide attempts may be considered SAEs in a
specific research protocol, whether or not they require hospitalization or place the
patient at immediate risk of death. On the other hand, certain occurrences that
would be considered SAEs under the standard definition, such as hospitalizations
for normal childbirth or voluntary admissions for detoxification, may be explicitly
defined not to be reportable as AEs and/or SAEs, if the Investigator so chooses.
Any such modifications to the definition of an SAE must be approved during the
protocol review process and by the appropriate IRBs.

What is an unexpected adverse event?

For clinical studies that involve the use of marketed drugs (as opposed to
investigational new drugs), FDA defines an unexpected AE as:
 An AE that is not listed in the drug’s current labeling, or
 An AE that is more severe or more specific than indicated in the labeling.
For clinical studies in which investigational new drugs are used, the FDA defines
an unexpected AE as:
 An AE that is not consistent with the information about the drug’s risks that
appears in the relevant source document(s) (e.g., protocol, Investigator's
Brochure, and consent documents), or
 An AE that is not consistent with the risk information, or
 An AE that has occurred within the class of drugs, but not specifically with the
Investigational Product.

What is an investigational new drug?

The Code of Federal Regulations (CFR) defines an investigational new drug as
“...a new drug or biological drug that is used in a clinical investigation.” An
investigational new drug also applies to new indications, formulations, or routes of
administration of an existing drug or biologic, as well as ventures to alter the
current approved labeling or advertising.
According to 21 CFR 312.3(b),
“Clinical investigation means any experiment in which a drug is administered or
dispensed to, or used, involving one or more human subjects. For the purposes of
this part, an experiment is any use of a drug except for the use of a marketed drug
in the course of medical practice.”

What is a research protocol?

The research protocol provides a general overview of the proposed research. It
must be approved by the designated Institutional Review Board (IRB) before the
research can begin. Any changes to the protocol must also be approved by the
IRB.
The research protocol must briefly describe the following aspects of the research
study:
 Why the study is being done.
 What will be done in the study.
 Where the study will be done.
 Who is involved in the research study.
 When study interventions will take place.

Investigator's Brochure
A compilation of the clinical and nonclinical data on the investigational product(s)
that is relevant to the study of the investigational product(s) in human subjects
along with basic information on the drug (if it is a tablet, injection, spray, etc.,) to be
administered.

What is an unexpected adverse event in a behavioral study?

In studies conducted under the Investigational New Drug regulations, the known
risks and expected benefits of an investigational new drug are described in the
Investigator's Brochure.
However, an Investigator’s Brochure is often not prepared for behavioral studies.
For this reason, researchers who conduct behavioral studies are expected to
describe in the research protocol any adverse events that might be expected to
occur in the study population as a result of the experimental behavioral
intervention. They must also briefly describe these events in the consent
documents.
In a behavioral study, therefore, an unexpected adverse event would be an AE that
is not mentioned in the protocol or consent documents or an AE that has not been
seen before. Additionally, unexpected AEs in a behavioral study can be considered
as unanticipated problems (discussed further below) and are thereby regulated
under 45 CFR46.

What is an unanticipated problem?

The Office of Human Research Protections (OHRP) defines unanticipated

problems involving risks to study participants and others as an event that meets all
of the following criteria:
 unexpected (in terms of nature, severity, or frequency) given (a) the research
procedures that are described in the protocol-related documents, such as the
IRB-approved research protocol and informed consent document; and (b) the
characteristics of the subject population being studied;
 related or possibly related to participation in the research (in this guidance
document, possibly related means there is a reasonable possibility that the
 incident, experience, or outcome may have been caused by the procedures
involved in the research); and
Suspected unanticipated problems must be promptly reported to the IRB, who will
make the subsequent determination to report it to the proper regulatory authority.
Although unanticipated problems are found but not defined in 45 CFR 46, all NIH
funded studies are required to comply with 45 CFR 46. For OHRP’s current
guidance on unanticipated problems, follow the link here.