Research Ethics & Privacy

The rules that protect research volunteers

Federal rules protecting people in research were first published by the Department of Health and Human Services. Their first section, Subpart A of 45 CFR 46, is called the Common Rule because 15 federal departments and agencies adopted it at the same time in 1991; it was revised in 2017 (the “2018 Requirements”) to reflect how research has changed. Three further subparts add protections for groups that could be considered vulnerable, including Subpart D for research with children, and Subpart E covers IRB registration. OHRP describes two key protections: appropriate review and approval by an Institutional Review Board, and the general requirement that researchers obtain informed consent in language participants can understand.

What informed consent must tell you

OHRP describes informed consent as an active exchange of information between the researcher and the prospective participant — not just a signature — with three features: disclosing what you need to make a decision, helping you understand it, and promoting a voluntary choice. Ordinary language should replace technical terms, and people who do not speak English should be given a consent document in a language they understand. The regulations require that each participant be told:

1. 1That the study is research, its purpose, how long you would take part, what procedures are involved and which are experimental
2. 2Any reasonably foreseeable risks or discomforts
3. 3Any benefits to you or to others that may reasonably be expected
4. 4Appropriate alternative treatments or procedures, if any
5. 5How far the confidentiality of records identifying you will be maintained
6. 6For more-than-minimal-risk research: whether compensation or medical treatment is available if injury occurs
7. 7Whom to contact with questions about the research, your rights, or a research-related injury
8. 8That participation is voluntary, that refusing carries no penalty, and that you may stop at any time without penalty

The eight basic elements of informed consent required by the HHS regulations at 45 CFR 46.116(a), paraphrased from OHRP’s Informed Consent FAQs.

Children: permission and assent

When a child takes part, the regulations require the permission of a parent or guardian and — when the IRB judges the child capable — the child’s own assent, meaning the child’s agreement to take part. SPARK, for example, asks children aged 10 through 17 and dependent adults to assent if they are able, after the information has been explained to them. OHRP notes that “passive” or opt-out procedures do not meet the requirement for parental permission.

What “de-identified” and “data sharing” mean

Study results summarize group data from all participants; ClinicalTrials.gov notes that even when individual-level data are listed, it is not in a way that lets readers identify a person. Many studies share data with other researchers. In SPARK’s description of its own practice, all research data that could identify you or your child is replaced with a study code called a global unique identifier (GUID) before it is shared; researchers must apply, be approved, and sign an agreement not to try to identify any participant; data are never shared for non-research purposes without consent; and identifying details such as names or email addresses are not shared unless you specifically agree, for example to be contacted about another study. SPARK also states plainly that de-identification carries a small remaining risk of re-identification, and that data already shared before a withdrawal cannot be taken back. NIH, for its part, expects researchers it funds to share genomic data “broadly and responsibly,” with institutional certifications and IRB involvement.

Genetic data: what consent usually covers

Genetic research adds choices of its own. In SPARK’s program, consenting to the genetics portion means allowing researchers to study your DNA; you are asked separately whether you want to be told about any genetic change found; leftover DNA may be stored, stripped of identifying information, for future approved autism research; and you can take part in the surveys without consenting to give saliva or share genetic data. SPARK says it does not and will never sell data or DNA, and points to two legal protections: a Certificate of Confidentiality, which lets researchers refuse to disclose identifying information in legal proceedings (with stated exceptions, such as required reporting of child abuse), and the Genetic Information Nondiscrimination Act (GINA), under which genes linked to autism should not affect existing health coverage. ASAN states that genetic autism research must be led and controlled by the autistic community and never used for eugenics.

Where HIPAA fits

The HIPAA Privacy Rule gives you rights over health information held by “covered entities” — health plans, most health care providers and clearinghouses — including the right to see and get a copy of your records and to receive a notice of how information may be used. HHS notes that many organizations holding health information, including most schools, are not covered by HIPAA. A study’s consent form and the Common Rule govern what the study may do with your data; ask the research team how both apply.