eConsent Guidance

Table of Contents

• General Information
• Definitions
• e-Signature Requirements
• FDA Regulated Research
• PittPRO e-Consent Process Requirements
• Available Resources and Tools
• Frequently Asked Questions

General Information

The University of Pittsburgh (Pitt) allows researchers to use electronic methods to conduct the informed consent process.  The use of an electronic consent process in a research study requires Institutional Review Board (IRB) approval prior to its implementation.  This guidance provides the IRB’s expectations and requirements when implementing an electronic consent form and/or process. 

The investigator responsibilities remain the same regardless of the media/format used to conduct the consent process.  Additionally, while an electronic consent process is an option and alternative to existing means of obtaining consent, some participants may be unable to engage in this process.  Its use as the sole means of obtaining consent may not be appropriate as it would exclude such participants from taking part in the research. 

Consent form documents, regardless of how they are delivered to the participants, must contain all elements of informed consent required by federal regulations (45 CFR 46.116 and 21 CFR 50.25). The information must be in language understandable to the participant or the participant’s legally authorized representative (LAR) and conveyed in a manner that minimizes the possibility of coercion or undue influence regarding the participant’s decision to participate in a study.

Definitions

Electronic Consent (e-consent): The process of using some type of electronic media (including text, graphics, audio, video, passive and interactive websites, biological recognition devices, etc.) to convey consent information and/or to document informed consent.

Electronic Signature (e-signature): An electronic sound, symbol or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.  This should be: 1) Unique to the signer, 2) Capable of being verified, 3) Under the signer’s sole control

In-Person consent: The consent process occurs between the participant and person obtaining consent who are in the same physical location. The consent form may be delivered electronically (e.g., via an iPad or tablet) and/or may be signed electronically if documentation of consent is required.

Remote consent: The consent process occurs between the participant and the person obtaining consent who are NOT in the same physical location. This interaction may involve electronic communications (e.g., email, fax, or text), audio (e.g., phone) and/or video (e.g., Zoom, Teams, etc.) modalities. The consent form may be delivered using web-based software, email, postal service mail, or a mobile phone, and/or signed electronically if documentation of consent is required.

Handwritten Signature: A physical signature or other identifying mark made with ink, electronic stylus, or finger on a paper or electronic document.

21 CFR 11: The Food and Drug Administration’s (FDA) regulations on electronic records and signatures.

Protected Health Information (PHI): Subject to the HIPAA privacy rule, it is individually identifiable health information, whether oral or recorded in any medium, that may include demographic information and

-is created or received by a ‘covered entity’ that is a health care provider, health plan, or health clearinghouse,
-relates to the individual's past, present, or future physical or mental health condition of an individual, and/or to payment for health care services and
-identifies the individual directly or contains sufficient data so that the identity of the individual can be readily inferred.

Private Information: Includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (e.g., a medical record).

Identifiable Private Information: Private information for which the identity of the participant is or may readily be ascertained by the investigator or associated with the information.

Note: Health information obtained by the researcher directly from the research participant (i.e. self-report) solely for research purposes does not meet the definition of PHI requiring the researcher to follow the HIPAA Privacy Rule. However, if researchers are placing research results into the participant’s medical record, HIPAA compliance is required.

e-Signature Requirements

The e-Signature must be linked to the person signing the e-Consent form. This can be done using any of the following methods:

• The research team observes the signature either in person or using video, and documents this in the research notes or by recording the session with the agreement of the research participant.
• Using the participant’s full name and date of birth combined with one or more security questions, such as mother’s maiden name, participant’s place of birth, or name of participant’s high school.
• Providing the research participant with a personalized link to the document.

When necessary, research participants may be asked to show their identification documentation during a videoconference. Scanning or photographing of identification documents should occur only when it would be required in an in-person consent process. 

If other methods to verify signature are being considered, contact Askirb@pitt.edu. 

Note: Clicking an icon absent any identity validation does not meet the definition of an e-signature. It is an acceptable consent process when the protocol is IRB approved with a waiver to document informed consent.  

FDA Regulated Research

If the research is FDA regulated (includes drugs or devices) and does not meet the criteria for a waiver to document informed consent, the FDA requires that the e-consent system be 21 CFR 11 compliant.  At Pitt, systems that are 21 CFR 11 compliant include the validated version of REDCap and 21 CFR 11 compliant DocuSign.

For additional information, refer to the following guidance:  

• FDA Guidance for Industry: Part 11, Electronic Records; Electronic Signatures Scope and Application (September 2003)
• DHHS and FDA Joint Guidance: Use of Electronic Informed Consent Questions and Answers Guidance for Institutional Review Boards, Investigators, and Sponsors
• FDA Guidance: Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024)

PittPRO eConsent Process Requirements

Available Resources and Tools

This section includes examples of electronic platforms that are currently available at the University of Pittsburgh.  If other platforms are being considered, consult with Pitt IT. If UPMC platforms are necessary or desired, consult with your Departmental Administrator or UPMC IT.

DocuSign

DocuSign is a secure cloud service that provides e-signature technology for the signing of documents and the creation of document signature workflows. DocuSign can streamline the process of getting documents signed and routing documents through a review and approval cycle.

• Standard DocuSign – available to all Pitt staff via the myPitt Portal.
• 21 CFR Part 11 Compliant DocuSign – a help desk ticket must be submitted to Pitt IT for access to this system.

For additional information refer to University of Pittsburgh DocuSign eSignature Service general information.

REDCap

REDCap is a secure web-based application developed by Vanderbilt University to optimize clinical trial data collection and provide a secure, online consent process.  Pitt offers two versions:

• Standard REDCap – available to all researchers with an IRB approved study. 
• Validated (21 CFR 11) REDCap – available only to researchers conducting a clinical study under a faculty held Investigational New Drug (IND) or Investigational Device Exemption (IDE) Application

Requests for the use of REDCap should be sent to hs.appsupport@pitt.edu.

For additional information refer to University of Pittsburgh REDCap.

Qualtrics

Qualtrics is an online survey service that allows users to create surveys, collect and store data securely, and analyze responses.  It is available to Pitt students, faculty, and staff at all campuses at no cost through the myPitt portal. It has been vetted and authorized by the Office of University Counsel and Pitt’s Information Security Officer. Most uses of Qualtrics for consent will not meet the definition of e-signature and would require a waiver to document consent.  Please see the Waivers of Consent guidance for more information.

Questions related to the Qualtrics system should be sent to hs.appsupport@pitt.edu.

Helpful Hints

Good research practices should be followed for any consent process.  Please keep in mind that there maybe additional considerations for remote or eConsent:

• Ensure participants can move backwards and forwards and/or stop and continue reviewing the e-consent within the electronic system.
• Prompt participants to print or otherwise save a copy of the e-consent form (or state how the copy will be given to the subject).
• Remind participants to conduct a remote discussion in a private location to help ensure privacy and confidentiality.
• Ask participants questions such as:
  • What phone number should I call if we get disconnected? What phone number should I call if there is an emergency, and I need to get help for you?
  • Are you in a location where you are comfortable discussing this research and/or your healthcare?
  • Please show me picture ID (often for parent/legally authorized representative of participant).
• Develop Standard Operating Procedures (SOP) for managing e-consent documentation over the life of the study.
• Document the e-consent process for each participant in a narrative note.  Narrative notes should clearly cover any anomalies in the consent process.
• A narrative note is especially helpful when:
  • The participant and the person obtaining consent sign consent in different formats (e.g. one signs on paper and the other through an e-consent). 
  • The participant and the person obtaining consent signed the consent form at different times.

Frequently Asked Questions (FAQs)

If my participants will “click to consent”, do I need to include verification questions?

No.  Having a participant “click to consent” without any identity validation does not meet the definition of an e-signature but may be used in certain minimal risk situations.  Check “waiver to document consent” in Study Scope #2 and answer the corresponding questions.

Can I have some participants sign electronically and others using paper?

Yes.  As long as a particular consent process is approved in your protocol, you may use it.  The PittPRO Consent Process page should clearly outline the procedures to be followed.  Refer to the chart, PittPRO e-CONSENT PROCESS REQUIREMENTS for specifics. 

Who is permitted to obtain informed consent when an e-process is used? 

The requirements for those who may obtain informed consent are the same, regardless of the medium used.  Greater than minimal risk studies involving a drug, device or surgical procedure must have a licensed physician investigator obtain informed consent.  Minimal risk studies that do not involve a drug, device, or surgical procedure must have a listed investigator obtain informed consent.  Exceptions may be considered.  Please refer to the Obtaining Informed Consent for Human Subject Research guidance for comprehensive instructions and examples.

Who do I contact for help building my consent process in RedCap?

Requests for the use of REDCap should be sent to hs.appsupport@pitt.edu

What is 21 CFR 11 Compliance?

FDA requirements for electronic records and electronic signatures are set forth in 21 CFR Part 11 of the FDA regulations. All greater than minimal risk FDA-regulated research that is greater than minimal risk and minimal risk research where the requirement for documentation of consent has not been waived must comply. Please visit the FDA Guidance: Use of Electronic Informed Consent for additional information.

Can I use a sponsor’s e-consent system?

All systems that will be used need to be listed in PittPRO Electronic Data Management.  This information should include security info and validation of Part 11 compliance, if the research is FDA regulated. 

What do I need to upload into PittPRO Consent Forms if I am using an e-consent process?

You should upload only the Word version of the consent form.  When developing your document in the e-consent system, the format of the consent should be as similar to the IRB approved version in PittPRO as possible.  The content and text should be the same as IRB approved Word version. 

5/16/2025