An IRB may
- approve an altered consent document, modifying or omitting some of the elements of information provided to participants (usually for research involving deception or concealment),
- waive the requirement to obtain informed consent altogether,
only if the IRB finds and documents that:
- the researcha involves no more than minimal risk to the participants;
- the research could not practicablyb be carried out without the waiver or alteration;
- the research could not practicably be carried out without access to the private information or biospecimens in an identifiable format;c
- the waiver or alteration will not adversely affect the rights and welfare of the participants;
- whenever appropriate, the participants (including their physicians, as applicable) are provided with additional pertinent information after participation.
a IRBMED interprets this to refer to the research procedures that will be conducted under the alteration/waiver of consent. It is permissible for greater than minimal risk research, for which documented informed consent is obtained, to have a subset of procedures covered under consent alteration/waiver.
b Federal regulations do not define the word practicably. Black’s Law Dictionary, on which courts sometimes rely in interpreting legislative or administrative agency intent, defines the term as: “reasonably capable of being accomplished; feasible.” An advisory group to HHS emphasizes the criterion is “that it is impracticable to perform the research, and not just impracticable to obtain consent.”
c FDA guidance does not mention this criterion; however, it is required of all consent waiver requests to IRBMED.
Waiver or alteration of parental permission for child participants follows the same criteria as above; waiver of assent by child participants is separate (45 CFR 46.408). See Assent of Children in Research.
When a research study intends a use or disclosure of HIPAA Protected Health Information (PHI) without a signed HIPAA authorization from the participant, the IRB must document that the waiver/alteration satisfies HIPAA requirements. These mirror points (1), (2), and (3) above, except that HIPAA specifies regarding minimal risk (point (1)):
Any use or disclosure of PHI in connection with the research project involves no more than a minimal risk to the privacy of individuals, as demonstrated by the following:
- there is an adequate plan to protect any identifiers from improper use or disclosure (e.g., they are kept in a locked cabinet only available to the researchers, or they are maintained in a password-protected database and only the researchers have access to the password);
- there is an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining the identifiers, or retention is otherwise required by law (e.g., there is a plan to break any links to identifiable information, unless the links need to be maintained, in which case a reason should be given);
- there are adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of PHI would be permitted by HIPAA (e.g., “the information will not be used or disclosed for any purpose other than this specific research project”);