Consent Form Language for HIPAA Compliance

With the implementation of the Health Insurance Portability and Accountability Act (HIPAA), consent forms for all studies that accrue subjects within Duke University Health System must be modified for HIPAA compliance. Below is sample language for the consent form and suggestions for where it may be added.

Please review this language in light of your particular consent form(s). Not all of this language will need to be added to each consent form. Please note that the headings indicate WHERE in the consent form the language should be added IF the language is appropriate for the specific consent form.

For your convenience, the concepts that are required in all consent forms are highlighted below. Please remove the highlighting prior to submitting the consent form to the IRB office.

HIPAA does not remove any of the requirements of informed consent set forth in the other federal regulations.

As a result, this new language may replace language currently found in your consent and/or this new language may need to be added to your consent, but it will not be cause for removal of any consent requirements such as the description of study procedures, alternatives to participation, study-related injury, and contact information. In addition, it does not replace the concept that the subject will be informed of any new findings that might affect the subject's willingness to enter or continue in the study.

The specific requirements for a valid authorization are:  The information  Who may use or disclose the information  Who may receive the information  Purpose of the use or disclosure  Expiration date or event  Individual’s signature and date  Right to revoke authorization  Right to refuse to sign authorization  Re-disclosures not protected

Throughout these examples, there are bracketed notations where information needs to be filled in on a consent form specific basis. Please remember to add the appropriate information where the brackets are located. For example, where [PI] is noted, insert the principal investigator’s name.

PLEASE NOTE: A signed consent form must be maintained at DUHS for as long as the research records are retained --- at least 6 years after the study is completed, or if the subject is a child, until the child reaches the age of 21, whichever is longer. This can be satisfied by placing the consent form in the medical record or by keeping it in the study's research files.

Version Date: 4/11/2008, 11/2/2015 Consent Form Language INTRODUCTION

If Duke University Health System will be paid to conduct the study:

The sponsor of this study, [Sponsor Name], will pay Duke University Health System {and Dr. [PI] if relevant} to perform this research.

This study is sponsored by a grant from the National Institutes of Health. Portions of Dr. [PI]’s and [his/her] research team’s salaries are being paid by this grant.

COSTS TO SUBJECT/COMPENSATION FOR PARTICIPATION

If the drug or device will be provided free of charge but no payment to DUHS or PI.

The sponsor, [Sponsor Name], will provide the [drug or device by name] free of charge to participating research subjects.

For research that includes treatment:

You will receive medical care as a part of this research study. You or your insurance company will [not] be charged or held responsible for the costs of that care.

Or where relevant: All study-related costs associated with your being in this study will be paid by the sponsor, [Sponsor Name]. You or your insurance company will [not] be charged or held responsible for the costs of your routine care (the care you would have received if you were not in this study).

If you do not sign this consent form, you will continue to receive care, but not as a part of this study.

RIGHT NOT TO PARTICIPATE OR TO WITHDRAW

One of the following 6 sections must be included in every consent form. Please determine which category applies to your study, and add the appropriate section.

For Studies involving an FDA regulated product (drug, device, or biologic) (Outside DUHS Sponsor)

You may choose not to be in the study, or, if you agree to be in the study, you may withdraw from the study at any time. If you withdraw from the study, no new data about you will be collected for study purposes unless the data concern an adverse event (a bad effect) related to the study. If such an adverse event occurs, we may need to review your entire medical record. All data that have already been collected for study purposes, and any new information about an adverse event related to the study, will be sent to the study sponsor.

Your decision not to participate or to withdraw from the study will not involve any penalty or loss of benefits to which you are entitled, and will not affect your access to health care at Duke. If you do decide to withdraw, we ask that you contact Dr. [PI] in writing and let [him/her] know that you are withdrawing from the study. [His/her] mailing address is [address].

For Studies involving an FDA regulated product (drug, device, or biologic) (DUHS Sponsor)

You may choose not to be in the study, or, if you agree to be in the study, you may withdraw from the study at any time. If you withdraw from the study, no new data about you will be collected for study purposes unless the data concern an adverse event (a bad effect) related to the study. If such an adverse event occurs, we may need to review your entire medical record.

Version Date: 4/11/2008, 11/2/2015 2 Your decision not to participate or to withdraw from the study will not involve any penalty or loss of benefits to which you are entitled, and will not affect your access to health care at Duke. If you do decide to withdraw, we ask that you contact Dr. [PI] in writing and let [him/her] know that you are withdrawing from the study. [His/her] mailing address is [address].

For Studies not involving FDA regulated products (Outside DUHS sponsor)

You may choose not to be in the study, or, if you agree to be in the study, you may withdraw from the study at any time. If you withdraw from the study, no new data about you will be collected for study purposes unless the data concern an adverse event (a bad effect) related to the study. If such an adverse event occurs, we may need to review your entire medical record. All data that have already been collected for study purposes, and any new information about an adverse event related to the study, will be sent to the study sponsor.

For Studies not involving FDA regulated products (DUHS sponsored)

You may choose not to be in the study, or, if you agree to be in the study, you may withdraw from the study at any time. If you withdraw from the study, no new data about you will be collected for study purposes unless the data concern an adverse event (a bad effect) related to the study. If such an adverse event occurs, we may need to review your entire medical record.

For Minimal Risk Studies (Risk no greater than the typical daily experience of a healthy person) (Outside DUHS sponsor)

You may choose not to be in the study, or, if you agree to be in the study, you may withdraw from the study at any time. If you withdraw from the study, no new data about you will be collected for study purposes other than data needed to keep track of your withdrawal. All data that have already been collected for study purposes will be sent to the study sponsor.

For Minimal Risk Studies (Risk no greater than the typical daily experience of a healthy person) (DUHS sponsored)

You may choose not to be in the study, or, if you agree to be in the study, you may withdraw from the study at any time. If you withdraw from the study, no new data about you will be collected for study purposes other than data needed to keep track of your withdrawal.

Version Date: 4/11/2008, 11/2/2015 3 Additional information that must be shared with the subject if applicable: In addition, you must return all unused study drug to Dr. [PI] or [his/her] staff. and/or

Dr. [PI] may ask you to return for a checkup before you stop your study drug if [he/she] thinks that stopping the drug suddenly may harm you. and/or

[He/she] may also ask you to complete the tests that would ordinarily occur when a person completes the study.

For withdrawal of samples

If you agree to allow your [tissue/blood/cells] to be kept for future research, you are free to change your mind at any time. We ask that you contact Dr. [PI] in writing and let [him/her] know you are withdrawing your permission for your [tissue/blood/cells] to be used for future research. [His/her] mailing address is [address]. At that time we will ask you to indicate in writing if you want the unused [tissue/blood/cells] destroyed or if your samples (having all identifying information removed that would link the sample to you) could be used for other research.

STATEMENT OF CONSENT You will be given a signed copy of this consent form. or "I have been told that I will be given a signed copy of this consent form."

CONFIDENTIALITY Study records that identify you will be kept confidential as required by law. Federal Privacy Regulations provide safeguards for privacy, security, and authorized access. Except when required by law or for your care, you will not be identified by name, social security number, address, telephone number, or any other direct personal identifier in study records disclosed outside of Duke University Health System (DUHS). For records disclosed outside of DUHS, you will be assigned a unique code number. The key to the code will be kept securely at DUHS.

For who will have access to study records and to whom information may be disclosed

As part of the study, Dr. [PI] and [his/her] study team will report the results of your study-related laboratory tests and x-rays to [Sponsor Name]. These would include laboratory tests such as your blood counts and tests to measure the function of your liver and kidneys, [other study specific tests], and [x-rays or scans of [ ]]. In addition, your records may be reviewed in order to meet federal or state regulations. Reviewers may include [representatives from the Food and Drug Administration, representatives of [Sponsor Name]], the Duke University Health System Institutional Review Board, [add others as appropriate]. If any of these groups review your research record, they may also need to review your entire medical record.

For research involving Duke patients: As part of this study, Dr. [PI] and [his/her] study team will ask you to have certain tests [and x-rays]. Some of these blood, urine and x-ray studies would have been done as part of your regular care. [He/She] will use these test results both to treat you and to complete this research. These test results will be recorded in your medical record and will be reported to the [research data office at Duke] OR [data coordinating center in…] OR [Sponsor Name]. Results of tests and studies done solely for this research study and not as part of your regular care will [also] OR [not] be included in your medical record.

For research involving healthy participants who are not Duke patients: All of the blood, urine and x-ray studies are being done only because you are in this study. The study results will [not] be [given to you to send] OR [sent] to your physician to include in your medical record.

Expiration date or event for the retention of records (Adult)

The study results will be retained in your research record for at least six years after the study is completed. At that time either the research information not already in your medical record will be destroyed or information identifying you will be removed from such study results at DUHS. Any research information in your medical record will be kept indefinitely. OR Version Date: 4/11/2008, 11/2/2015 4 The study results will be retained in your research record forever. Any research information in your medical record will also be kept indefinitely.

Expiration date or event for the retention of records (Minors)

The study results will be retained in your child’s research record for six years after the study is completed or until your child reaches the age of 21, whichever is longer. At that time either the research information not already in your child's medical record will be destroyed or information identifying your child will be removed from such study results at DUHS. Any research information in your child's medical record will be kept indefinitely.

The study results will be retained in your child’s research record forever. Any research information in your child’s medical record will also be kept indefinitely.

Temporary restriction of access to study records for blinded studies

Some information collected about you only for this research study may be kept in a research study record separate from your medical record, and some research information may also be part of your medical record. You will not have access to this research information until the end of the study. However, it will be available to your physicians if needed for your care.

The sponsor may share data

For sponsor generated studies:

This information may be further disclosed by the sponsor of this study, [Sponsor Name]. If disclosed by the sponsor, the information is no longer covered by the federal privacy regulations.

For PI funded studies:

If this information is disclosed to outside reviewers for audit purposes, it may be further disclosed by them and may not be covered by the federal privacy regulations.

Example of Confidentiality Section for Duke Patients

Study records that identify you will be kept confidential as required by law. Federal Privacy Regulations provide safeguards for privacy, security, and authorized access. Except when required by law or for your care, you will not be identified by name, social security number, address, telephone number, or any other direct personal identifier in study records disclosed outside of Duke University Health System (DUHS). For records disclosed outside of DUHS, you will be assigned a unique code number. The key to the code will be kept securely at DUHS.

As part of the study, Dr. [PI] and [his/her] study team will report the results of your study-related laboratory tests and x-rays to those named below. These will include laboratory tests such as your blood counts and tests to measure the function of your liver and kidneys, [other study specific tests], and [x-rays or scans of [ ]]. Some of the blood, urine and x-ray studies would have been done as part of your regular care. Dr. [PI] will use these test results both to treat you and to complete this research. These test results will be recorded in your medical record and will be reported to the [research data office at Duke] OR [data coordinating center in…] OR [Sponsor Name]. Results of tests and studies done solely for this research study and not as part of your regular care will [also] OR [not] be included in your medical record.

Your records may be reviewed in order to meet federal or state regulations. Reviewers may include [representatives from the Food and Drug Administration, representatives of [Sponsor Name]], the Duke University Health System Institutional Review Board, [add others as appropriate]. If any of these groups review your research record, they may also need to review your entire medical record.

Version Date: 4/11/2008, 11/2/2015 5 The study results will be retained in your research record for at least six years after the study is completed. At that time either the research information not already in your medical record will be destroyed or information identifying you will be removed from such study results at DUHS. Any research information in your medical record will be kept indefinitely.

Example of Confidentiality Section for Non-Patients

Study records that identify you will be kept confidential as required by law. Federal Privacy Regulations provide safeguards for privacy, security, and authorized access. Except when required by law, you will not be identified by name, social security number, address, telephone number, or any other direct personal identifier in study records disclosed outside of Duke University Health System (DUHS). For records disclosed outside of DUHS, you will be assigned a unique code number. The key to the code will be kept securely at DUHS.

As part of the study, Dr. [PI] and [his/her] study team will report the results of your study-related tests to those named below. These test results will be reported to the [research data office at Duke] OR [data coordinating center in…] OR [Sponsor Name].

Your records may be reviewed in order to meet federal or state regulations. Reviewers may include representatives of [Sponsor Name], the Duke University Health System Institutional Review Board, [add others as appropriate]. If any of these groups review your research record, they may also need to review your entire medical record.

The study results will be retained in your research record for at least six years after the study is completed. At that time either the research information not already in your medical record will be destroyed or information identifying you will be removed from such study results at DUHS. Any research information in your medical record will be kept indefinitely.

Example of Statement of Consent

"The purpose of this study, procedures to be followed, risks and benefits have been explained to me. I have been allowed to ask the questions I have, and my questions have been answered to my satisfaction. I have been told whom to contact if I have additional questions. I have read this consent form and agree to be in this study with the understanding that I may withdraw at any time. I have been told that I will be given a signed copy of this consent form."

Example of Statement of Consent for Consent forms for Minor Subjects

"The purpose of this study, procedures to be followed, risks and benefits have been explained to me. I have been allowed to ask the questions I have, and my questions have been answered to my satisfaction. I have been told whom to contact if I have additional questions. I have read this consent form and agree to allow my child to be in this study with the understanding that I may withdraw him/her at any time. If my child is 6 years of age or older, this study has been explained to him/her and he/she agrees to participate. I have been told that I will be given a signed copy of this consent form."

Version Date: 4/11/2008, 11/2/2015 6