Fundamental Considerations

Designing Confidential Systems

Researchers should design systems to ensure data confidentiality. Master-code sheets connecting participant IDs and names must be securely stored, password-protected, and/or encrypted. Data should be anonymized, and master-code sheets should be destroyed as soon as possible. To minimize risks to participants, research should be designed to be anonymous whenever feasible.

Considerations for Sensitive Data Collection:

• Exercise caution when collecting sensitive data from participants in public spaces to avoid accidental disclosure.
• Be aware of privacy concerns during recruitment, as volunteering for a study may reveal private details.
• Safeguard data collected or transmitted over the internet, considering potential privacy implications.

Anonymity is about identifiers. It refers to information/data or specimens that cannot be linked to the person from whom they were obtained because the information/data or specimens do not contain direct identifiers (e.g., name, address, birth date, IP address, etc.). In this case, the collected data is completely anonymous so the researcher cannot identify the participant.

Privacy refers to a participant’s right to control the access of others to their personal information. The research proposal should outline strategies to protect privacy including how the investigator will access information from or about participants. Processes for protecting privacy should be described.

Guidance for Researchers Regarding Privacy 

Follow the below guidelines to protect the research participants’ privacy during screening, consenting, and conducting the research 

• Conduct research procedures in person and in a private setting.
• Capture and review data in a private setting.
• Limit access to research data and activities to authorized personnel only.
• Limit the collection of participant information to the amount necessary to achieve the aims of the research.
• Approach participants in a setting or location that preserves their physical privacy and minimizes the risk of information being overheard by unauthorized individuals.  

Privacy concerns people and the collection of data, whereas confidentiality concerns the data itself.

Confidentiality refers to the researcher’s agreement with the participant about how the researchers manage participant data, including its storage, handling, and dissemination, and what will happen after the study is over and the data is presented (e.g., data will be destroyed after three years). The research proposal should outline strategies to maintain confidentiality, detailing controls for data storage, handling, and sharing of data. Researchers can develop a data security that meets minimum standards and is particular to their study.

Guidance for Researchers Regarding Confidentiality 

Consider how the research data/specimens will be labeled to align with research methodologies and requirements: 

• Identifiable: Data and/or specimens will be directly labeled with personal identifying information.
• Coded: Data and/or specimens will be labeled with a code that the research team can link to personal identifying information.
• Anonymous: Data and/or specimens will not be labeled with any personal identifying information, nor with a code that the research team can link to personal identifying information.

At a minimum, ensure the following measures will be taken to ensure confidentiality:            

• Store physical information/specimens with appropriate safeguards, such as in locked cabinets or restricted areas limited to authorized personnel.
• Protect electronic data with security measures such as unique usernames/passwords and dual-factor authentication where feasible.
• Restrict copying and use of study materials.
• Install and regularly update security software (firewalls, antivirus, anti-intrusion) on all devices used in the study.
• Encrypt data on removable drives and during transfer.

IRB Considerations

The IRB evaluates research proposal strategies for maintaining confidentiality to assess: 

• Adequacy of methods to shield participants' identity and protect confidentiality.
• Plans for long-term confidentiality protection of research data, including a schedule for destruction of identifiers associated with the data.
• The recruitment materials clearly describe the study parameters.
• Adequacy of consent forms in describing confidentiality risks and data access and under what circumstances data may be shared (i.e., with government agencies, sponsors).
• The HIPPA authorization section should clearly identify what will be accessed, who will have access and for what purpose access is required, if appropriate.

HIPAA is the federal legislation that governs all uses and disclosures of Protected Health Information (PHI), for both the living and the dead, to protect individual privacy. While UMassD is not a Covered Entity, some research projects may take place within other organizations that are Covered Entities such as healthcare facilities. In such cases, researchers must be prepared to use and control PHI in compliance with the provisions of HIPAA and any commitments the HIPAA defines the 18 identifiers that create PHI when linked to health information. The following identifiers are those of the individual or of relatives, employers, or household members of the individual.  

• Names;
• All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census:
• The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and
• The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
• All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
• Phone numbers;
• Fax numbers;
• Electronic mail addresses;
• Social Security numbers;
• Medical record numbers;
• Health plan beneficiary numbers;
• Account numbers;
• Certificate/license numbers;
• Vehicle identifiers and serial numbers, including license plate numbers;
• Device identifiers and serial numbers;
• Web Universal Resource Locators (URLs);
• Internet Protocol (IP) address numbers;
• Biometric identifiers, including finger and voice prints;
• Full face photographic images and any comparable images; and
• Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data)

Recruitment and advertising materials are considered an extension of the informed consent and participant selection process. Consequently, recruitment activities cannot commence until the IRB has granted approval. All recruitment methods and materials, including flyers, letters, brochures, email advertisements, radio announcements, and similar items, must be reviewed and approved by the IRB before use. These materials must also be submitted for review and re-approval during the continuing review process. The content must avoid creating undue influence or containing misleading or exculpatory language.

Ethical Considerations:

• Avoid Undue Influence:Ensure any compensation or incentives are reasonable and do not unduly influence participants. Avoid high-pressure tactics that might create a sense of urgency.
• Privacy and Confidentiality:Handle personal information collected during recruitment confidentially and protect privacy. Implement measures to safeguard contact information.
• Inclusivity and Fairness:Ensure recruitment practices are inclusive and non-discriminatory, making efforts to reach under-represented groups. Recruitment materials should be accessible to people with disabilities and available in multiple languages if needed.
• Cultural Sensitivity:Tailor recruitment materials to respect cultural and social norms, avoiding culturally insensitive or offensive language and imagery.
• Transparency:Clearly disclose the identity of the researcher(s) and their institutional affiliation. Inform potential participants of any potential conflicts of interest that may affect the research. If applicable to the study design, or required by a funding agency, the PI is responsible for tracking the ethnicity or race of participants who are recruited into studies.  In such cases, investigators should ask participants to self-identify at the time of consent. 

Common Recruitment Methods:

All recruitment methods must be described in the protocol application, common recruitment methods include:

• Advertisements:Use flyers, notices, and/or media to recruit subjects, such as flyers posted in public settings, newspaper ads, and radio and television advertisements.
• Direct Recruitment:Approaching people in public settings, snowball sampling, use of social networks, and social media.
• Research Subject Pools:Utilizing the research subject pools for participant recruitment.
• Introduction Letters:Provide colleagues with an IRB-approved introduction letter describing the study. Researchers must not access participant/patient names, addresses, or phone numbers; interested individuals must initiate contact.
• Referral Requests:Send an IRB-approved letter asking for referrals of eligible participants. Researchers may provide the referring individual with IRB-approved recruitment material for distribution to potential participants. Interested participants must contact the researchers for additional information.

Recruitment from Medical Practices or Facilities

For studies involving patients from a medical practice or treatment facility, investigators not affiliated with the practice or facility must not directly recruit patients. Initial contact must be made by a physician or an employee of the practice or facility. Recruitment can, for instance, be in the form of a flyer posted in the waiting area or handed to potential participants by a physician or employee. Due to HIPAA regulations, medical practices or treatment facilities may not provide telephone numbers or addresses of their patients.

Advertisements should contain information that provides enough detail to allow the prospective participant to determine his/her eligibility and interest. 

Elements of any advertisement to recruit participants should be limited to the following: 

• Name and Affiliation: The name of the Principal Investigator (PI) and their UMass Dartmouth department.
• Research Description: An accurate and concise description of the research purpose or condition under study (e.g., “Comparing low fat vs. low carb diets for weight loss” or “Studying acculturation of Cuban immigrants”).
• Eligibility Criteria: A summary of key eligibility criteria (e.g., acceptable age range, physical limitations) that will be used to include or exclude participants.
• Benefits: A straightforward and truthful description of any benefits to participants (e.g., “Free health screening”).
• Compensation: If applicable, a statement about the availability and amount of compensation (e.g., “Participants may receive up to $100”).
• Commitment: Information about the amount of time or other commitments required from participants.
• Location and Contact: The location where the research will take place and contact information for obtaining additional details.

Advertisements cannot incorporate elements that: 

• State or imply a certainty of a favorable outcome or other benefit beyond what is in the informed consent form.
• Use overly enticing language like “free” or “exciting.”
• Visual effects which may create undue influence, the use of text in all capital letters or an extra-large font while the rest of the ad is in lower case or a smaller font.
• For FDA-regulated research studies (new drugs/devices) or studies on nutritional supplements:
• Make claims that the supplement, drug, device, or biologic is safe or effective for the purpose under investigation or that the supplement, drug, device, or biologic is known to be equivalent or superior to any other supplement drug, device, or biologic.
• Use terms such as “new treatment,” “new supplement” or “new medication” without identifying it as investigational.

Recruitment/Advertising Tips and Suggestions 

• Understand the Target Population: Identify the media channels and platforms that are commonly used by the target population. Determine where they typically seek information and tailor your recruitment strategies accordingly. What media does the population read or view?  Where do they go for information? 
• Efforts to Recruit Diverse Groups: Make deliberate efforts to include participants from minority and under-represented groups. Clearly describe these efforts in the protocol application to ensure inclusivity.
• Clarity and Accessibility: Ensure that recruitment flyers and materials are easy to read and understand. Use lay language suitable for an 8th-grade reading level (similar to popular magazines and newspapers). Choose font styles and sizes that are easy to read, such as Times New Roman, Arial, or Garamond.
• Email and Online Recruitment: For recruitment via email, listservs, social media, etc., include the statement: “This research study was approved by the UMass Dartmouth IRB, Protocol # __________.”
• Privacy and Confidentiality: Ensure all recruitment materials and methods respect the privacy and confidentiality of potential participants. Avoid using personal data without consent and ensure any personal information collected during recruitment is securely handled.

The guidelines outlined below are meant to help investigators determine a reasonable amount of compensation that can be given to research participants and place some boundaries on what is and is not "reasonable." Compensation for research participants should be reasonable, considering the time involved, inconvenience to the participant, and any costs incurred while participating. The compensation should not be so large as to constitute a form of coercion. Compensation of approximately the current minimum wage would be considered reasonable.

IRB Considerations:

During the initial review of a research protocol, the IRB reviews both the amount of compensation proposed and the method and timing of disbursement to ensure neither are coercive or present undue influence. The following are some guidelines:

• Compensation Details: The amount of compensation in the informed consent document is clearly stated.
• Accrual of Compensation: Compensation should not be contingent upon completing the study but instead accrues as the study progresses.
• Bonuses and Incentives: Bonuses or incentives for completing a study or reaching milestones are acceptable, provided they are not coercive. The IRB will determine if the incentive amount is appropriate.
• Compensation for Withdrawal: Compensation for participants who withdraw should be provided promptly, ideally close to the point of withdrawal to avoid undue delay. For instance, compensating a participant soon after withdrawal from a long-term study is acceptable. However, it would not be inappropriate to compensate a participant at the end of a three-day study if they withdrew on one day.
• Third-Party Payments: Payments to a third party for a participant’s involvement are discouraged, as they can be perceived as coercive.

Consent Form Considerations:

Researchers should ensure their compensation plan listed within the consent form addresses:

• Conditions on Compensation: An explanation of any conditions on compensation. Example: “You will receive compensation at the rate of $15 per hour with an additional $5 bonus on study completion”.
• Amount and Form: Clearly outline the amount and form of compensation. Example: “For this 1-hour study you will receive $20 upon study completion in the form of an Amazon gift card.”. 
• Distribution Method: A description of how compensation will be distributed, including any required information collected. Example: “At the conclusion of each study day, participants will receive an email with the amount and form of compensation specified above. Contact information will be stored separately from data and will not be made public.”
• Compensation for Withdrawal: Circumstances under which participants may or may not be compensated. Example: You may stop participating in this study at any time at which point you will be eligible for the prorated compensation of $15 per hour”.

Documentation Considerations:  

Investigators responsible for keep a compensation which keeps track of:

• Participant ID
• Gift Card#
• Dollar amount
• Researcher Name
• Researcher Signature
• Date Distributed
• Participant Signature (or a check mark confirming disbursement)

For online gift cards, keep copies of the online receipt and, if applicable, confirmation that the participant received the gift card should be kept with the log. Ensure compensation records are kept confidential and separate from research data to protect participant privacy. If anonymity is required, the participant’s signature may be omitted and replaced with a check mark confirming disbursement.

For more information, please see Guidance on Use of Gift Cards for Human Subject Participant Guidelines.

Course Credit Incentives

If participants in research will receive course credit instead of monetary compensation, researchers should consult the Guidance on Students as Research Participants resource for more information and guidance.

External Funding for Compensation

UMassD requires all external funding for compensation to be managed through either the researcher’s department or the Office of Research Administration (ORA). Departmental funding will be distributed via college specific protocols and all other funding sources will be managed through a study account set up by the ORA. Upon receiving IRB approval for the study, researchers should contact the appropriate departmental or ORA personnel to establish their account. Student researchers will need their sponsoring faculty on the account.  For more information, please contact ORA via email at ora.info@umassd.edu.   

• A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's participation, a description of the procedures to be followed, and identification of any experimental procedures;
• A description of any reasonably foreseeable risks or discomforts to the subject;
• A description of any benefits to the subject or to others that may reasonably be expected from the research;
• A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;
• A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;
• For research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained;
• An explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights, and whom to contact in the event of a research-related injury to the subject;
• A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled; and
• For research that involves the collection of biospecimens, include both of the following statements:
• A statement that clarifies whether the research will (if known) or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of that specimen) and
• A statement that the subject’s biospecimens (even if identifiers are removed) may be used for commercial profit and whether the subject will or will not share in this commercial profit;
• For research that involves the collection of identifiable private information or identifiable biospecimens, include one of the following statements:
  • A statement that identifiers might be removed from the identifiable private information or identifiable biospecimens and that, after such removal, the information or biospecimens could be used for future research studies or distributed to another investigator for future research studies without additional informed consent from the subject or the legally authorized representative, if this might be a possibility; or
  • A statement that the subject's information or biospecimens collected as part of the research, even if identifiers are removed, will not be used or distributed for future research studies.
• A statement that the particular treatment, intervention, or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) that are currently unforeseeable;
• Anticipated circumstances under which the subject's participation may be terminated by the investigator without regard to the subject's or the legally authorized representative's consent;
• Any additional costs to the subject that may result from participation in the research;
• The consequences of a subject's decision to withdraw from the research and procedures for orderly termination of participation by the subject;
• A statement that significant new findings developed during the research that may relate to the subject's willingness to continue participation will be provided to the subject;
• The approximate number of subjects involved in the study;
• A statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, and if so, under what conditions; and
• For FDA-regulated research:

• • A statement which clarifies information about all experimental procedures that will be completed during the clinical trial.
  • A statement that clarifies the possibility that the FDA may inspect the records.

• For applicable clinical trials, the following statement is to be included: “A description of this clinical trial will be available on http://www.ClinicalTrials.gov as required by U.S. Law. This Web site will not include information that can identify you. At most, the Web site will include a summary of the results.  You can search this website at any time.”

Documentation of consent entails prospective participants, their legally authorized representative (LAR), or the parents or legal guardians of children who are potential participants being presented with a consent document on which they sign their name to document that they agree to participate in the study. This can also be done electronically. A copy is given to the participant. Participants and their legally authorized representatives must be given ample time to review the consent with the study team. However, if certain criteria are met, the study team has the option to request alterations of the consent process. Below you will find the different types of obtaining informed consent. Please note that regardless of the method of consent, all approval criteria for the consent process must be met. Consent is usually obtained concurrently with an authorization to view the Personal Health Information (PHI), personally identifiable information (PII), or student education records for participants. At UMassD, authorization is obtained on the same document as the consent. You must describe your process for obtaining informed consent for participation in the protocol.   

Situations When Written Documentation Is Used

Written Paper Consent:

The typical Written Consent process takes place in person. A potential participant or their Legally Authorized Representative (LAR) is provided a physical copy of the consent form during the consent process. The research team will discuss the study in depth with the potential participant/LAR and answer any questions they may have. Sufficient time will be provided to the individual/LAR to consider participation, including the opportunity to discuss the research study with anyone outside of the study team. If the participant/LAR chooses to take part in the research study, a written signature and date is obtained from the participant/LAR, as well as the person obtaining consent, and a signed/dated copy is provided to the participant.

Written Electronic Consent (eConsent): 

Electronic Written Consent captures an electronic signature and date from the study participant as well as the person obtaining consent, often referred to as “eConsent”, can take place either in person or remotely. Study teams may also opt to consent individuals in person using an electronic device such as a tablet or computer. Alternatively, they may remotely consent participants in their home or other sites, using email or electronic platform, with a telephone call or meeting via teleconference. The Investigator and/or their delegate is responsible for carrying-out an effective informed consent process, whether it is in person or remote. The protocol should describe this process, including steps to verify the identity of the participant, ensuring an in-depth discussion of the study and answering all questions. The OHRP & FDA Use of Electronic Informed Consent Guidance may be useful in developing your electronic/online informed consent process, including verifying the identity of participants that are consented electronically.  Different platforms can be used to obtain valid electronic signature such as: Qualtrics, DocuSign, AdobeSign, RedCap among others. If your study is FDA-regulated or is obtaining HIPAA authorization, the platform must be secure and compliant with 21 CFR Part 11. 

It is considered a best practice to document in the participant file that the informed consent process has occurred. The study team should document the consent process in the study record.

Potential participants, or the parents of children who are potential participants, are presented (either verbally or in writing) with the same information required in a written consent document, but documentation of the process (signing of the consent form) has been waived by the IRB. This process is often used in minimal risk research involving the administration of online or mailed surveys, telephone interviews, or when anonymous sensitive information is collected and there is a desire to not have written documentation that links the participant to the research study. In cases in which the documentation requirement is waived, the IRB may require the investigator to provide participants with a written statement regarding the research.

Conditions for Approval

If the written script of the information to be provided orally (if consent is obtained in person) or electronically displayed includes all required and appropriate elements of consent, the IRB may waive the requirement for the investigator to obtain a signed consent form for some or all participants if the research is not FDA regulated and one of the conditions below are true:

1. “The only record linking the participant, and the research would be the informed consent form AND the principal risk would be potential harm resulting from a breach of confidentiality. Each participant (or LAR) will be asked whether the participant wants documentation linking the participant with the research, and the participant’s wishes will govern.” This criterion may apply to research on sensitive or stigmatizing topics such as HIV, domestic violence, illegal activities, etc.
2. “The research presents no more than minimal risk of harm to participants AND involves no procedures for which written consent is normally required outside of the research context.” This criterion is often applicable to minimal-risk surveys, interviews, and focus group research.
3. “The participants or LARs are members of a distinct cultural group or community in which signing forms is not the norm, the research presents no more than minimal risk of harm to participants, AND there is an appropriate alternative mechanism for documenting informed consent.” This criterion may apply to minimal-risk research with indigenous populations or international research.

It is not appropriate to request a waiver of documentation of informed consent for human subject projects that collect biospecimens.

Situations When a Waiver of Documented Consent Is Used

Verbal/Oral Collection of Consent:

Some minimal-risk studies may qualify for verbal consent. Verbal consent can take place over the phone, a teleconference platform such as Zoom, teams, or even in person. This can include the use of a verbal informed consent script and/or providing the potential participant with a document describing the study (with required elements of informed consent) in combination with a discussion between the participant and study team. The study must meet the waiver of documentation of consent criteria for the study team to obtain verbal consent. Verbal consent does not require a signature from the participant; it is sufficient for the participant to verbally agree to take part in the research study as witnessed by a consenting study team member. It is considered a best practice to document in the participant file that the verbal consent process has occurred. The study team should document the consent process in the study record, such as with documentation of the consent process form or note-to-file.

Online Documentation of Consent: 

Some minimal-risk studies may qualify for online consent or emailing of a document that does not capture the participant’s electronic signature. For example, a simple online survey study may meet the criteria for a waiver of written documentation of consent. If so, the participant can simply select ‘I agree’ or ‘I disagree’ or ‘continue’ to consent to participate rather than providing an electronic signature. Different platforms can be used to obtain online consent without documentation of signature, such as REDCap, Qualtrics, Survey Monkey, etc. The platform must be able to determine who provides consent. Note: If PHI/PII is obtained with verbal/online consent, an alteration of HIPAA authorization must be obtained.

Some minimal-risk studies, where it is not possible to obtain informed consent, may qualify for a waiver or alteration to the requirements of informed consent. This means that all or some of the elements of informed consent may be waived. The protocol should include the justification for how the study meets the required waiver/alteration criteria. For example, a data review protocol where many participants may no longer be coming to the institution and the study would not be feasible without the waiver of informed consent. This waiver applies in special circumstances when the IRB determines that it is not necessary to obtain the participants’ consent to conduct the research.

Situations When a Waiver of Informed Consent Is Used

The IRB often grants a waiver of consent for retrospective chart review studies. On rare occasions, prospective collection of data through intervention or interaction with participants may be granted a waiver of consent.  With compelling reason, a waiver of consent may be granted for studies where secondary participants may be involved and it would be either prohibitive or potentially dangerous to obtain consent.  For example, parental permission for a child to participate may be waived if consenting the parent could be detrimental to the child. As another example, some research designs require that participants be left unaware of the particular purpose of the research, because the participants’ responses might be biased if they know in advance what the investigators are seeking. Such research designs do not preclude offering potential participants information about the research and giving them the opportunity to decide whether to participate.

The IRB may waive the requirements for obtaining parental or guardian permission if the determines that a research protocol is designed to study conditions in children or a participant population for which parental or guardian permission is not a reasonable requirement to protect the participants (for example, neglected or abused children), and the following 2 additional criteria are also met:

1. An appropriate mechanism is in place to protect the children, and
2. The waiver is not inconsistent with federal, state, or local law (45 CFR 46.408(c)). The choice of an appropriate substitute mechanism (for example, appointing a child advocate or an assent monitor) for protecting children participating in research would depend on the nature and purpose of the activities described in the protocol, the risk and anticipated benefit to the research subjects, and the child’s age, maturity, status, and condition (45 CFR 46.408(c)). Note that an IRB may waive the requirement for obtaining parental or guardian permission under 45 CFR 46.408(c) even if the research involves more than minimal risk to the child subjects.

The IRB may approve research involving deception, incomplete disclosure, or alteration of informed consent if it meets all applicable regulations. Deception occurs when participants are deliberately given false information about some aspect of the research, while incomplete disclosure occurs when they are not given information about the real purpose or the research's nature. Under HHS regulations, the IRB can waive the requirement for obtaining informed consent or parental permission or to approve a consent procedure that leaves out or alters some or all of the elements of informed consent otherwise required under the regulations. However, the FDA allows this only in special circumstances.

The IRB may approve research involving deception, incomplete disclosure, or alteration of informed consent if it meets all applicable regulations. Deception occurs when participants are deliberately given false information about some aspect of the research, while incomplete disclosure occurs when they are not given information about the real purpose or the research's nature. Under HHS regulations, the IRB can waive the requirement for obtaining informed consent or parental permission or to approve a consent procedure that leaves out or alters some or all of the elements of informed consent otherwise required under the regulations. However, the FDA allows this only in special circumstances.

Deception Submission Preparation:

1. Justifying the Use of Deception:
• Justify the use of deception in the Study Procedures Section, explaining why it is necessary to achieve the study’s goals. Provide prior evidence and data showing that such methods do not negatively affect subjects’ attitudes.
• Explain the process to debrief participants in the Procedures Section. Include details on when, who, and how the debriefing will occur. Address if the deception is likely to cause psychological discomfort and how this risk will be minimized.
• When incomplete information is provided in the consent document, it should be labeled simply as a consent document, not “informed” consent. The IRB must waive certain required elements of informed consent in such instances.
• Provide a copy of the debriefing statement(s) and any scripts used to orally explain the study.
2. Debriefing Requirements and Process:
• The debriefing must be an essential part of the consent process and is mandatory when the research involves deception. It provides a full explanation of the hypothesis, procedures, and reasons for deception.
• Participants should be debriefed immediately after the study and given a debriefing statement to take with them. For online studies, debriefing should occur as soon as a participant completes the research activity, with an email follow-up if necessary.
• The IRB must review and approve the debriefing statement.
• The debriefing process must be explained in your IRB submission, including who will conduct it. The debriefer should be a knowledgeable research team member.
3. Debriefing Form Should Include:
• Study title
• Researcher’s name and contact information
• Thank participants for their participation
• Explain the study’s purpose, hypothesis, and aim in lay terms
• Explain how and why participants were deceived
• Describe how deception results will be evaluated
• If applicable, give participants the opportunity to withdraw consent for the use of their data or recordings
• Offer to provide study results
• Provide references for further reading and a list of resources for participants if they experience distress

Researchers may find the use of deception or incomplete disclosure necessary for their study. The IRB will closely review such techniques. Deception or incomplete disclosure should be justified in the IRB protocol submission, which should not be submitted for Exempt Review. Depending on the deception, the study will be reviewed under Expedited or Full Board Review processes.

For adults and children, a waiver or alteration of the requirements for obtaining informed consent can occur under any of the following three provisions set forth by HHS:

1. Research in general: an IRB may waive or alter the requirement of informed consent under 45 CFR 46.116(d), provided that the IRB finds and documents that all of the following four conditions are met:

1. the research involves no more than minimal risk to the participants;
2. the waiver or alteration will not adversely affect the rights and welfare of the participants;
3. the research could not practicably be carried out without the waiver or alteration; and
4. whenever appropriate, the participants will be provided with additional pertinent information after participation.

1. Public benefit or service programs: an IRB may approve a consent procedure that alters some or all the elements of informed consent, or waive the requirement to obtain informed consent under HHS regulations at 45 CFR 46.116(c), provided that the IRB finds and documents that both of the following conditions are met:

1. the research could not practicably be carried out without the waiver or alteration; and
2. the research or demonstration project is to be conducted by or participant to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine:

1. public benefit or service programs;
2. procedures for obtaining benefits or services under those programs;
3. possible changes in or alternatives to those programs or procedures; or
4. possible changes in methods or levels of payment for benefits or services under those programs.

1. Research in emergency settings: an IRB may also waive the requirement for obtaining informed consent if it finds and documents that the research meets the requirements of the HHS Secretarial waiver under 45 CFR 46.101(i) that permits a waiver of the general requirements for obtaining informed consent in a limited class of research in emergency settings.

The FDA only permits an IRB to approve a clinical investigation without participants’ informed consent in the following circumstances:

1. Emergency Use From HHS: https://www.hhs.gov/ohrp/regulations-and-policy/guidance/emergency-research-informed-consent-requirements/index.html

2. Exception from Informed Consent for Planned Emergency Research FDA: https://www.fda.gov/media/80554/download

3. Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable FDA: https://www.fda.gov/medical-devices/ivd-regulatory-assistance/overview-ivd-regulation

4. Circumstances when the U.S. President may waive informed consent for military personnel for administration of an investigational product to members of the armed forces

All Research Data shall be preserved in the custody of, or as arranged by, the Principal Investigator on behalf of UMassD, and may include preservation with the grantor agency. The Principal Investigator (PI) has the primary responsibility for the collection, management, integrity, preservation, security, and destruction of Research Data, appropriate marking, and reporting of all UMassD’s intellectual property that may be included in, or derived from, the Research Data. This includes ensuring that:

• Protocols Compliance: All research team members follow protocols, including ethical conduct without fabrication, falsification, or plagiarism.
• Training: All team members receive the required UMassD IRB training (e.g., CITI).
• Documentation: The study process is reconstructible, including the retention of documents.
• Data Security: Data is stored and maintained properly and safely for the required retention periods.
• Data Destruction: Data is accurately and securely destroyed after the required retention period.
• Data Quality: Data is maintained with clarity, completeness, and organization so that an external reviewer can determine adherence to the IRB-approved protocol, institutional policies, and regulatory requirements.

For student theses and projects, the faculty sponsor (i.e., thesis chair/mentor) retains the primary responsibility of ensuring these responsibilities, regardless of whether the student is listed as a PI or Co-PI.  In the event of the PI’s incapacity, their supervisor must immediately designate an appropriate person to take custody of research data or take custody of the research data until other appropriate arrangements are made for alternative custody. 

When storing research information, access should be limited to those individuals who have a specific research need to access the information. Requirements for storing data include:

• Access: Limit access to research data to individuals with a specific research need.
• Security Measures: Implement complex passwords, avoid sharing accounts, limit room and system access, use locked storage areas (e.g., file cabinets, offices), and encryption when necessary.
• Paper Documents: Store in locked boxes and/or locked cabinets in designated research areas at UMassD. Use secure methods for transportation, such as locked briefcases or lockboxes.
• Online Materials: Use secure online storage systems, including UMassD-based secure online storage.
• Data Transfer: Use encrypted, secure transfer systems or approved transfer processes/systems required by the sponsor agency to share files between collaborators or sponsor agencies.

The PI must ensure retention of research data documenting the methods and accuracy of data collection and interpretation is retained.  If a participant subsequently withdraws from a study, the PI must document this and retain the database if there are publications/presentations based on the database containing the withdrawn participant’s data. Research Data disclosed or referenced in publications, including the primary experimental results, must be retained for a minimum of three (3) years from the date of study closure or the final expenditure report to the funding agency, whichever is longer. 

In addition, any of the following circumstances may justify longer periods of retention:

• Sponsored research grants, contracts, and cooperative agreements may mandate different retention periods (including state and local sponsors which may require longer retention periods following the final project close-out). 
• Data must be kept for as long as may be necessary to protect any intellectual property, including FDA drug/biologic applications resulting from the work
• If there are questions or allegations about the validity of the data or appropriate conduct of the research, the PI must retain all of the original research data until such questions or allegations have been completely resolved.
• If any charges regarding the research arise, such as allegations of scientific misconduct or conflict of interest, data must be retained until such charges are fully resolved
• Any research that involves collecting identifiable health information is subject to HIPAA requirements. As a result, records must be retained for a minimum of 6 years after each subject signed an authorization.
• If a student is involved, data must be retained at least until the degree is awarded or it is clear that the student has abandoned the work

Data retained beyond these periods is at the discretion of the PI or the laboratory/department head.  Research data is normally retained in the administrative unit (i.e. PI office/labor department office/lab) where generated and must be retained in a UMassD facility unless specific permission to do otherwise is granted by the Provost.

UMassD Access: Designated agents of UMassD have the right to access research data for research performed at UMassD, supported by UMassD-administered funds, or using UMassD facilities. Both the PI and UMassD retain the right of access regardless of the location of the PI or the Research Data. Access will be for reasonable cause, at reasonable times, and after reasonable notice, except in emergencies.

Sponsored Agencies: Sponsored agencies may also have access rights depending on funding and agency requirements.

Public Access: The public may request access to research data from federal agencies through the Freedom of Information Act (FOIA) and from UMassD for published research findings used by the Federal Government in agency actions. In these instances, consultation with the UMassD IRB, UMassD counsel, and the sponsoring agency is required, and information released may be restricted or limited as per laws and HIPAA regulations. This may include presentation of the data in a format (e.g., aggregate) to protect participants’ privacy, avoid violating stipulated terms of the informed consent, and prevent triangulation of data to identify or contact participants. Sponsors such as the NIH, NSF, and others have policies governing the sharing of data and dissemination of research results, which the PI must comply with.

Information or data that would violate the confidentiality of sources or subjects involved in the Research shall not be disclosed except in accordance with law or regulation.

When required by law, regulation or contract, or to fulfill other obligations, UMassD may transfer title or custody of Research Data and records at its discretion (for instance, if required by a sponsor or funding agency).  In such cases, UMassD, insofar as possible, will ensure access by Principal Investigators, Investigators, and other appropriate individuals to that Research Data.

Research Data that is required to be transferred or shared with a sponsor/funding agency should be transferred using a secure encrypted transfer system, in accordance with UMassD and the sponsor/funding agency policies. If another method is used, it must be secure and approved by UMassD and the sponsor/funding agency.

When individuals other than the Principal Investigator who are involved in research projects leave UMassD, they may take copies of Research Data for projects on which they have worked unless restricted by the specific terms of the applicable agreement with the sponsor of the research. Original data, however, must be retained at UMassD by the Principal Investigator.

If a Principal Investigator leaves UMassD, they are allowed to retain or take copies of the Research Data.  Additionally, they can request that a project be moved to another institution. Research Data may be transferred with the approval of the Provost for Research (or a designee), and with written agreement from the PI's new institution that guarantees: 1) its acceptance of custodial responsibilities for the data, and 2) UMassD’s access to the data, should that become necessary. UMassD may impose conditions beyond those stipulated in this policy on such transfer, and may ask the PI to leave copies of the Research Data with UMassD. In addition, other UMassD investigators associated with a collaborative research project may make copies of Research Data prior to a permitted transfer by the Principal Investigator, unless restricted by the specific terms of the applicable agreement with the sponsor of the research. When UMassD permits the Principal Investigator to leave UMassD with original Research Data, he or she must retain the Research Data for the period required by this policy and recognize that UMassD may need access to the Research Data. Departing PIs have an obligation to hold the Research Data in trust for UMassD and must return the Research Data to UMassD if requested during the retention periods contemplated by this policy. In addition, during the required retention period, such Research Data must be available to external sponsors, designated governmental officials, and other UMassD investigators associated with the collaborative research project, as appropriate. Investigators should note that many contractual agreements require the sponsor's consent before Research Data are transferred or removed from UMassD. Before transferring the original Research Data, the Principal Investigator is responsible for ensuring that any special conditions stated in the grant, contract, or agreement are met.

Consistent with federal policy and prevailing high education practice, Research Data belongs to UMassD and PI. When research is generated pursuant to a contract or agreement, ownership of the data is defined by the contract or agreement, which may include a data management plan.  The contract will be the determining document for the resolution of disputes.  It is recommended that the IRB and/or UMassD counsel is consulted prior to finalizing this agreement. The details of the contract should define all policies, procedures and issues related to ownership, including publication and dissemination of findings. For research that is sponsored by a federal and state agency, ownership is generally shared between UMassD and the government agency.  PIs should seek guidance from administrative officials at both institutions. In the event that data retention and maintenance practices are found to be contrary to this Policy, UMassD may make disposition of these Research Data and related property rights in a manner that is consistent with law and policy.

Data and Safety Monitoring is a critical component of research that ensures the safety of participants, and the integrity of the data collected. It involves systematic review and oversight of the research process to identify and address potential risks and issues that could impact participant safety or data quality.

When is Data and Safety Monitoring Recommended?

• Minimal Risk Research: While a formal DSMP is generally not required for minimal risk research, it is still advisable to have clear methods in place to protect confidentiality, privacy, and participant safety. Such measures should be proportionate to the minimal risk involved and include adequate provisions for monitoring.
• Good Clinical Practice (GCP) Compliance: For minimal-risk clinical trials that adhere to GCP standards, the development of a DSMP is recommended to ensure ongoing adherence to protocol and protection of participant welfare.

When is Data and Safety Monitoring Required?

• Greater Than Minimal Risk Research:A Data and Safety Monitoring Plan (DSMP) is mandatory for research involving more than minimal risk. This requirement ensures that adequate measures are in place to monitor participant safety, data validity, and overall study integrity. The complexity of the DSMP should align with the level of risk and complexity of the study.
• NIH-Funded Phase III Clinical Trials:For NIH-funded Phase III clinical trials, a Data and Safety Monitoring Board (DSMB) is required to oversee the trial’s progress and assess its safety and efficacy.

A Data and Safety Monitoring Board (DSMB) is an independent committee established to oversee data throughout the study. Its role is to ensure that the study continues to be scientifically and ethically justified. The DSMB monitors the data to assess whether the research should continue, be modified, or be stopped based on the study’s safety and efficacy.

DSMB Recommendations That Require Response or Action:

• Real-Time Submission: Reports containing DSMB recommendations that require immediate action must be submitted to the IRB in real-time.
• Response: Each report should be accompanied by a detailed response from the study team addressing the issues raised by the DSMB. This ensures that any recommended actions are acknowledged and acted upon appropriately.
• Submission: Submit these reports via a modification submission to the IRB promptly. Such reports may sometimes constitute a reportable event, necessitating timely IRB review and action.

Overall, the goal of data and safety monitoring is to ensure all research activities are conducted ethically and with due consideration for participant safety and data integrity. The IRB reviews the DSMP as part of the research protocol to ensure compliance with regulatory requirements and to assess whether the monitoring plan is adequate given the study's risk profile.