3/14/2012. Disclaimer. Objectives

Transcription

1 The webinar will begin shortly. Thank you for joining us! To listen to the audio portion of this webinar, please dial (toll free) or and reference passcode 1981#. For technical assistance at any time, please call (for LiveMeeting Support) or (for Peach New Media) or Ethical Internet Research: Informed Consent Regulations and Realities Laura Odwazny, JD Elizabeth Buchanan, PhD Ethical Internet Research: Informed Consent Regulations and Realities Joan Rachlin, JD, MPH Executive Director March 15, :00-2:30 PM ET 1

2 Elizabeth Buchanan, PhD Director and Endowed Chair in Ethics Center for Applied Ethics University of Wisconsin-Stout Laura Odwazny, JD Senior attorney Office of the general counsel U.S. Department of Health and Human Services (DHHS) Disclaimer This presentation does not constitute legal advice. The views expressed are the presenter s own, and do not bind the U.S. Department of Health and Human Services or its components. Objectives To identify specific internet research settings and conditions for consent To discuss how to apply Common Rule regulatory requirements for informed consent to internet research To review regulatory flexibilities applicable to consent in internet research To review parental consent and child assent in internet research involving minors To provide sample language for informed consent documents for internet research regarding data security and confidentiality of research-related information 2

3 Internet Research Internet research Internet-based research, broadly defined, is research which utilizes the Internet to collect information through an online tool, such as an online survey; studies about how people use the Internet, e.g., through collecting data and/or examining activities in or on any online environments; and/or, uses of online datasets, databases, databanks, repositories. o Internet as a TOOL FOR research or o Internet as a MEDIUM/LOCALE OF research TOOL=search engines, databases, catalogs, etc MEDIUM/LOCALE=chat rooms, MUDs, MOOs, newsgroups, web sites, MMORPGs, blogs, skype, social media, tweets, online course software, etc Increasingly, the line between tool and locale is blurring in the face of social media, mobile apps, and cellular devices 3

4 Forms of research: exploring where human subjects and informed consent fit Consider methodologies, venues, types of data generated through: Quantitative research o Data aggregation, scraping, transaction log analysis, network analysis, statistical analysis, surveys, etc Qualitative research o Ethnography, focus groups, observation, surveys, content/discourse analysis, etc o Emerging use of synchronous data collection/sharing across methodologies o Momentary sampling o Geosocial networking 10 Do note: OHRP has no guidance on internet research specifically Many boards have separate guidelines and best practices for internet research 4

5 Common Rule Regulatory Requirements When is consent required? Research Involving human subjects Conducted or supported by Common Rule agency or covered by applicable FWA Not exempt Not eligible for waiver of informed consent (Note: not available for FDA-regulated research except for emergency research, and other life-threatening or military situations outlined in FDA regulations at 21 CFR 50.23) Challenge: getting consent in internet research Sometimes no direct researcher subject interaction o Interaction could be through an avatar, profile, survey tool Not always clear who subjects are o Fluidity, pseudonymity, multiple identities May not be feasible to obtain documentation of consent o May provide more PII than necessary (could increase risk); type of forum, e.g. chat rooms 5

6 Required Elements of Consent General requirements informed consent Circumstances of consent must give subject opportunity to consider participation, and minimize possibility of coercion or undue influence o Consider nature of subject payments, free drug or device Are mechanical turk payments just or fair? Compensation tailored to Internet context e e.g., PayPal, e-gift card o Issue: how to ascertain vulnerability of subjects to undue influence? Information given must be in language understandable to the subject o Be sure subjects have an opportunity (consent room in virtual world, dedicated contact) to ask questions as in F2F General requirements informed consent (2) Prohibition on exculpatory language Current OHRP guidance Exculpatory Language in Informed Consent Nov. 15, 1996 o Can t waive or appear to waive subject s legal rights o Can t release or appear to release investigator, sponsor, institution or its agents from liability for negligence 6

7 Proposed new OHRP-FDA joint guidance (published for comment 9/7/11) Defines exculpatory language as language that has the general effect of freeing or appearing to free an individual or an entity from malpractice, negligence, blame, fault, or guilt Practical effect: some waivers of subject s legal rights permissible in informed consent if language does not meet the standard of exculpatory language o Most notably, waiver of any right of subject to compensation for the use of biospecimens given for research or for derived commercial products o Waiver of right for compensation for research-related injuries still exculpatory Eight required elements [45 CFR (a) and 21 CFR 50.25(a)] 1. Statement that study is research; information about purposes, duration, procedures 2. Reasonably foreseeable risks or discomforts o Risk of breach of confidentiality always present in internet research o Remixed, recontextualized data challenges; change in tool or venue TOS/EULA o Consider any conflicts with the TOS (DeWalt on gaming, for example) o Data not sensitive now may become sensitive with new ways to identify respondents (keypress interval timing ratios; domain address + cell phone location) does this present reasonably foreseeable risks? Eight required elements (continued) 3. Reasonably expected benefits to subject or others 4. Alternatives to research participation which might be advantageous to the subject o Alternate sites, study pages versus actual venue, fictitious profiles 5. Extent, if any, to which confidentiality of records identifying subject will be maintained o The internet is not a secure medium transmission of data may be vulnerable o Subjects may be surveilled unknowingly to them or the researcher (key stroke monitoring, data capture, spyware) o Digital maleficence, lost devices, unknown provenance of data 7

8 22 Best practices for describing confidentiality protections Explain how data are transmitted. Is a survey host (Zoomerang, Survey Monkey) used? Will the host retain identifiable data? Will the data be encrypted? Explain how data are maintained. In individually identifiable form, aggregate form, anonymized? o Becoming more and more significant with data sharing and data use agreements (NIH, NSF mandates); important for researchers to work with IRBs in planning for data sharing! Explain data security plan o See, for example Harvard (security.harvard.edu) Do not absolutely guarantee confidentiality If aggregated anonymized data will be made publicly available, consider whether subjects could be (re)identified. o Ohm: The utility and privacy of data are linked, and so long as data is useful, even in the slightest, then it is also potentially reidentifiable Eight required elements (continued) 6. Information on compensation for injuries/medical treatment (unless minimal risk) 7. Contact person for information on research, injury, subject s rights o Consider if local contact advisable (e.g., psych study), which may pose a challenge to investigator to identify 8. Voluntary participation, no penalty or loss of benefits for refusal or withdrawal o In Internet locales, can one opt out? How to exclude nonsubjects in contextualized locales, e.g., Facebook? 8

9 Six additional elements [45 CFR (b) and 21 CFR 50.25(b)] 1. Statement that there may be risks that are unforeseeable o Greased, malleable data 2. Under what circumstances investigator could terminate subject s participation o Be clear it is research, not participation in the internet venue or site that t would be terminated t 3. Additional costs to subjects 4. Consequences of subject s withdrawal from research; procedures for termination Six additional elements (continued) 5. Statement that subjects will be told of new findings which might affect willingness to continue to participate o No need for prior IRB review before providing this info to already-enrolled subjects; consent should be amended before enrolling new subjects 6. Approximate # of subjects in study o How many participants in any given setting is always in flux o Major challenges when a study announcement goes viral More points on informed consent Regulations do not recognize passive consent (a common error in internet research) o Passive consent or opt-out procedure requires waiver of informed consent (or elements) and waiver of documentation Regulations do not recognize secondary subject Need for re-consent? o Longitudinal research -- minors who reach age of majority Deception research o Requires waiver of consent or of some elements o Challenges in debriefing subjects Accessing all members of online community Should investigator be allowed to search for former members to contact in order to debrief? 9

10 Also consider How subjects will be contacted o Access may be through moderator or member in internet locale When and where the subjects are approached about participation o How to avoid misrepresentation by researcher? o Outside of formal study space? Examples of Online Consent Processes We started with a welcome page that briefly summarized the points of key interest 10

11 We brought our eligibility criteria forward so we did not waste non-eligible persons time. Consent portal Subject Recruitment 11

12 Subject recruitment OHRP considers subject recruitment part of informed consent o Recruitment plan must receive IRB review/approval prior to initiation Online recruitment t methods o Twitter app o Blog posting o YouTube videos o Push methods o Robo calls, texts OHRP guidance on subject recruitment OHRP guidance on IRB review of clinical trial websites No IRB review needed for descriptive information: o study title o purpose of the study o protocol summary o basic eligibility criteria o study site location(s) o how to contact the study site for further information OHRP guidance (continued) IRB review needed if additional information is provided o Description of research risks/potential benefits o Solicitation of identifiable private information (e.g. eligibility survey) o Incentives monetary and non-monetary What needs to be reviewed: o Recruitment plan, not the actual webpage But screen shots may be helpful to the IRB! 12

13 13

14 Using social media for recruitment matching tool Social media as recruitment tool Twitter app Twitter app from TrialX (3/20/09) o Sample CT studies for diabetes male 45 in new york o Stated benefits: use of Twitter tweets are public -- others can learn about research by looking at searches, which could potentially increase awareness of trials and participation. Social media as recruitment tool: push method Blog post from the founder of Inspire.com (3/1/09): I'm writing today to let you know about some new features we're introducing related to clinical trials What's new is that from time to time we'll tell you about clinical trials in which you may be interested in participating. If you're not interested in participating, p simply py do nothing. If you do think you might be interested, we'll provide a link where you'll be able to read about a trial, decide if you are interested in participating, and fill out a short survey to see if you may qualify. If it appears that you may qualify, we'll put you in touch with the physicians conducting the trial so that you can learn more and find out if you do qualify

15 Ethical considerations with use of social media for recruitment Trackbackability/greased nature of social media data could generate unforeseen ethical challenges o If recruitment method can identify an individual, any potential downstream harms? o Are risks being minimized (under criteria)? Uncontrolled following discussion among viewers/bloggers: interactive, not static Subsequent posts in effect add to posted information Must PI/IRB actively monitor social media sites used for recruitment? o Note: FDA pulled social media from guidance agenda Waiver of Informed Consent 15

16 Waiver of informed consent 45 CFR (d)[not for FDA-regulated research] Waiver may be of some or all of the required elements, or of requirement for consent in toto IRB must find and document: o Minimal risk research; o Waiver will not adversely affect subjects rights and welfare; o Research could not practicably be carried out without waiver; and o When appropriate, subjects provided with additional pertinent information after participation Challenges: applying waiver of consent to internet research Minimal risk o Probability and magnitude of harm/discomfort in the research not greater than ordinarily encountered in daily life or during routine physical or psychological examinations/tests (46.102(i)) o Risks associated with data security breach, likelihood of access by 3 rd parties alter conception of minimal risk in Internet research? Less privacy, more observation in general in daily life If appropriate, provide additional information to subjects after participation o Issues with debriefing online community Documentation of Informed Consent and Waiver of Documentation 16

17 Documentation required unless waived [waiver not permitted in FDA-regulated studies] If documentation required, long form or short form procedure (45 CFR ) For waiver, IRB must find: o Consent document would be only record linking subject to the research and principal risk is breach of confidentiality, and each subject must be asked if documentation wanted; or o Minimal risk research; no procedures requiring consent in a non-research context IRB may require investigator to give subjects written statement regarding the research Challenge: obtaining documentation of consent in Internet research More difficult to obtain hard copy documentation o Consider alternatives to traditional documentation, such as electronic signatures How to date-stamp versions of consent forms? (Question from IRB Forum, 11/17/2011) o No regulatory requirement to date-stamp t consent form versions o Suggestion posted on IRB Forum in response: We have investigators type the approval information onto the online survey -- it's just typed instead of a stamp. Electronic Signatures 17

18 Electronic signatures Electronic signatures encompass a broad gamut of technologies and methodologies, ranging from an I agree button in a clickthru agreement to an electronic tablet which accepts a handwritten signature (oftentimes referred to as an esignature) to a digital signature cryptographically tied to a digital ID or certificate John B. Harris, Adobe Security blog entry "So what is an electronic signature anyway?" Electronic signatures OHRP FAQ: Does not require specific method of electronic signature Provides points to consider for the IRB to evaluate method of obtaining electronic signature Q: In what jurisdiction is the research being conducted? Research Involving Children 18

19 Identification of vulnerable subjects Are investigators required to confirm the real identities of the subjects of internet research? How to ascertain that subjects are not children o Age verification measures o Nothing is 100%! Definition of children [P]ersons who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted. (emphasis added) o In US, legal age of adulthood governed by state and local law: may be exceptions to who is considered a child and additional laws in places that define emancipated minors o Note that definition considers specific treatments or procedures involved in the research; state/local law might allow lower age for consent to certain types of procedures In what jurisdiction is Internet research being conducted? 45 CFR part 46, subpart D permission and assent Children by definition do not have legal ability to consent to the research procedures Parent/guardian provides permission for child to participate in research [45 CFR ] o Either one or both parents, depending on circumstances o Documentation required under 45 CFR , unless waived Child assent o Required if IRB determines children are capable 19

20 Challenge: obtaining parental permission for internet research Internet use affords children independence and autonomy; request for parental permission may be perceived as lack of respect Parental skepticism of researcher because of heightened awareness of Internet predators, online stalking If IRB conservatively requires physical documentation ti of permission, increased effort to print/mail form o Also, even if researcher promises to use pseudonyms to refer to child, identifying info contained in parent s signature, return address or postmark may cause parental concern (Stern S, in E.A. Buchanan (Ed.) Readings in Virtual Research Ethics: Issues and Controversies (2004); Duncan, et al, (2009); Kauer, et al, (2008, 2009)) Waiver of permission [not for FDA-regulated research] Parental/guardian permission may be waived if: o Subpart A waiver of consent requirements met (45 CFR ); or o Research designed to study conditions in children/population for which parental permission would not protect the subjects (e.g. neglected or abused children), and both: appropriate substitute mechanism in place to protect children, and waiver not inconsistent with Federal, state, or local law (45 CFR (c)). More on waiver of permission or assent IRB may waive requirement for parental or guardian permission under 45 CFR (c) even if the research involves more than minimal risk Documentation of parental permission may be waived under criteria IRB decides whether children are capable so as to require assent; assent may be waived according to 45 CFR (a) or Documentation of assent not required 20

21 Sample Language for Consent Documents Confidentiality and Data Security Sample language for consent documents Address the efforts in place to protect the data (encryption, secure servers); Harvard s policy is excellent example (security.harvard.edu) Identify potential tracking measures if using work or public computers or recommend use of private computers Disclose what third party sites may be used for collection, storage, dissemination and that access by third parties is possible o Although every reasonable effort has been taken, confidentiality during actual Internet communication procedures cannot be guaranteed. Sample language for consent documents Your confidentiality will be kept to the degree permitted by the technology being used. No guarantees can be made regarding the interception of data sent via the Internet by any third parties. (Penn State) Address uncertainty in data longevity in more openended terms: Data may exist on back ups or server logs beyond the timeframe of this research project Move away from locked file in a locked office mentality 21

22 Sample language for consent documents Although it is unlikely that anyone will try to gain access to your , you have the right to know that transmissions are not private and therefore transmission of information through this form cannot be guaranteed to remain confidential. (Bard) Please note that the online survey is hosted by Company ABC which is a web survey company located in the USA. All responses to the survey will be stored and accesses in the USA. This company is subject to U.S. Laws, in particular, to the US Patriot Act/Domestic Security Enhancement Act that allows authorities access to the records that your responses to the questions will be stored and accessed in the USA. The security and private policy for Company ABC can be viewed at (with mobile device research): Remote data deletion will be performed in the event of a lost or stolen phone (More on this in another session!) Sample language for consent documents Glickman, et al, 2012: If you participate in this clinical study, you should feel free to discuss the study with your family and with other people who are close to you. You should also tell any health care providers who treat you that you are in the study. However, to help make sure that the data from the study is as accurate and reliable as possible, please do not discuss information about the study in public places while the study is in progress. Public places may be situations like support groups, or may be places like internet message boards. If you have questions about side effects, please talk to your study nurse or study doctor. Advance Notice of Proposed Rulemaking (ANPRM) Improving informed consent Courtesy of Ivor Pritchard, OHRP 22

23 Overview of rulemaking process ANPRM NPRM Final Rule public comment (on areas of possible change no commitment) public comment (on draft regulation) Courtesy of Ivor Pritchard, OHRP ANPRM consent and exempt research Additional consent requirements for excused (formerly exempt) research? o Oral or written consent, depending, with waiver contemplated Oral w/o documentation for educational tests, surveys, focus groups, interviews (modifying exemption (b)(2)) Secondary use of data (modifying exemption (b)(4)) o originally collected for research purposes, consent required whether or not the researcher obtains identifiers o originally collected for non-research purposes, no change (no consent required unless identifiers are obtained) Stay tuned 23

24 OHRP resources Web site: hhs.gov/ohrp FAQs: hhs.gov/ohrp/faq.html Guidance: hhs.gov/ohrp/policy/index.html Educational resources: hhs.gov/ohrp/education/ News distribution list: hhs.gov/ohrp/news/index.html html Telephone: (866) (toll-free) (240) Contact Information Elizabeth Buchanan buchanane@uwstout.edu Laura Odwazny Laura.Odwazny@hhs.gov Questions and Comments To submit a question, simply click on the Q & A menu at the top of the screen. webinars@primr.org 24

25 Disclaimer Please note that the presentations and views are those of the individual speakers, and do not represent the organizational views of PRIM&R. Please complete the evaluation. Joan Rachlin, JD, MPH Executive Director Thank you! 25