Informed Consent for Research Using Digital Health Technologies

INFORMED CONSENT FOR RESEARCH

USING DIGITAL HEALTH TECHNOLOGIES:

POINTS TO CONSIDER & SAMPLE LANGUAGE

May 2024

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

Informed Consent for Research Using Digital Health Technologies:

Points to Consider & Sample Language

KEY POINTS

• This resource provides points to consider and sample language for informed consent of research

studies which plan to use digital health technologies. The use of this resource is completely

voluntary.

• The considerations and sample language provided in this resource may not apply to all studies or

cover all potential contexts of use. Users of this resource should apply relevant

considerations/sample language as applicable to their study. Points to consider and sample

language below are included in the most relevant sections, although they may be relevant to

multiple sections.

• This resource does not take the place of an informed consent document. The considerations and

sample language included in this resource are specific to the inclusion of digital health technologies

in a study; other general and population-specific informed consent considerations and language still

apply. The sample language provided in this resource should be tailored for individual studies and

may need further revision or clarification when used in an informed consent.

• The sample language provided in this resource does not alone satisfy the regulatory requirements

for informed consent as described in the 2018 revised Common Rule at 45 CFR46.116 or the FDA's

regulations governing the protection of human participants (i.e., 21 CFR parts 50 and 56).

• Within this resource, the term digital health technology refers to wearable devices, sensor

technologies, and mobile software applications (“apps”) most often used with tablets, watches, or

phones. The resource does not address considerations for implantable devices, artificial intelligence,

or other types of digital health technologies.

• This consent resource does not address future use of data collected from digital health technologies,

which may have additional considerations when developing or reviewing informed consent.

I. Introduction:

Digital health technologies, such as wearable devices, sensor technologies, and apps, have increasingly

been deployed in biomedical and behavioral research, leading to enhanced scientific discovery and

improved health outcomes. The individualized information collected from research participants via

digital health technologies may enable greater personal insights into health and wellness, and the

volume of data that can be collected across studies can provide broader insights to enhance the health

of the nation. Bringing research to participants through use of these technologies also enables new

clinical trial modalities (e.g., decentralized trials) and can enhance clinical trial diversity by increasing

reach and accessibility to participants who do not live near or can’t travel to an academic research

center.

Incorporating digital health technologies into traditional research frameworks may pose new

considerations for potential study participants as third-party “ownership” and control of data (including

by commercial companies) may limit participant control over how their data are used. Research

institutions, funders, and researchers themselves have a shared responsibility to ensure that the

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

potential benefits, cost(s), and risks from use of digital health technologies in research are effectively

communicated and understood by participants so they can make an informed choice regarding whether

to take part in a research study. As a steward of biomedical and behavioral research, NIH is committed

to ensuring the appropriate use of digital health technologies as part of the research enterprise.

As part of this commitment, NIH sought input

from invested parties to identify best practices to obtain

effective consent from prospective research participants in studies that will collect data using a digital

health technology. The following resource was developed with substantial input from across the

research community. As new digital health technologies emerge or existing technologies are used in

novel ways, this document may be updated, or new resources may be developed to address unique

considerations related to the use of these technologies in research.

II. Instructions for Use:

This resource presents general points to consider, instructions for use, and optional sample language for

the research community. The intended use of this resource is to inform research teams and Institutional

Review Board (IRB) members who are planning, reviewing, or conducting research that studies or uses

digital health technologies, with the goal of increasing transparency and understanding for potential

participants who are considering joining studies using or investigating digital health technologies. The

sample language component sections below outline a variety of considerations and provide optional

sample language designed to be modified and incorporated into an informed consent for a study where

original data collection will occur. The provided sample language does not directly address all

considerations presented, but rather the considerations and sample language are designed to be

assessed together.

The sample language provided in the resource does not take the place of an informed consent, but

rather is intended to be incorporated into consents (both written and oral) as appropriate. The

considerations and sample consent language provided are meant to help investigators best describe

digital health technologies and how they will be used in the study. The sample consent language

provided should be tailored to institutional and study-specific requirements. It is the responsibility of

investigators and IRBs to determine the appropriate use of the sample language including which

components, if any, are relevant to a study. The organization of this resource is consistent with sections

of a standard informed consent document. Points to consider and sample language are included in the

most relevant sections, although they may be relevant to multiple sections.

The sample language provided in this resource does not alone satisfy the regulatory requirements for

informed consent as described in the 2018 revised Common Rule at 45 CFR46.116 or the FDA's

regulations governing the protection of human participants (21 CFR parts 50 and 56). The use of the

sample language in this document by itself does not address Federal, state, local, Tribal, or international

requirements that may apply to the research study. Investigators are strongly encouraged to seek

consultation with the appropriate local or Tribal contacts to understand cultural norms or preferences of

the intended study population.

Use of this resource is voluntary and there are no requirements or expectations that any portion of the

sample language be used during the informed consent process for NIH-supported or -conducted studies.

Individuals who find this resource helpful may also be interested in the Secretary’s Advisory Committee

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

on Human Research Protections (SACHRP) recommendations to the Health and Human Services (HHS)

Secretary on End-User License Agreements and Terms of Service.

The sample consent language below includes embedded instructions to fill in specific information

pertaining to the research study. These embedded instructions are identified using [bold italicized text]

and will need to be removed and replaced with study-specific information.

III. General Points to Consider:

• The sample language in this resource was designed to ensure readability and comprehension (with

an overall goal of not exceeding an 8th grade reading level) with language that conveys the

necessary information to research participants. Those writing and approving informed consent

documents are encouraged to write in plain language not exceeding an 8th grade reading level, use

clear headers and short sentences, include definitions for technical terms, and use plenty of white

space. There are several resources that help with creating understandable consent language,

including the National Cancer Institute (NCI) guide to evaluating readability

. Researchers may also

consider using supplemental strategies to assist with comprehension (e.g., interactive videos).

• Many NIH-federally funded studies are required to develop a data management and sharing plan as

a requirement for funding. Investigators should ensure alignment of data management and sharing

plans with informed consent language.

• The sample language below does not address all scenarios. Several different digital health

technologies may be used within a study (e.g., a device and an app), each with unique

considerations that should be addressed as part of a consent.

• This resource does not address future use of data collected from digital health devices. If

considering inclusion of informed consent language related to this issue, the NIH resource

informed consent for secondary research with data and biospecimens may be helpful.

IV. Sample Language Components

Introduction

Considerations: The introduction component should provide prospective participants with a description

of the digital health technologies used in the study and the purpose of their inclusion. Include a clear

statement about how the technology is being used to address the study aims, if the technology has been

approved by FDA for its intended use, and if the efficacy of the technology is being studied.

• Indicate if use of the digital health technology is mandatory for participation in the study. Indicate

the technological capability(ies) needed for successful participation, including but not limited to

WiFi, Bluetooth, smartphone model, data plans, or access to other devices and if these technological

capabilities will be provided by the study.

• Specify which digital health technology will be used and whether it is proprietary to the research

team or an outside entity, such as a commercial company (e.g., manufacturers and/or software

developers). The software model used can have significant implications for privacy and security, may

determine who owns, has access, or rights to distribute the data, and potentially affects the integrity

of and confidence in the data associated with the technology.

• IRBs should consider whether it is important to disclose to potential research participants any

relationship (e.g., financial, board position, advisor) between investigators and the company that

owns the digital health technology used in a study.

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

Sample Language:

Instructions: Adjust language as needed. Include “[If the …]” text if it pertains to your study. Replace

embedded instructions identified in [bold italicized text] with specific information pertaining to the

study. Remember to remove the “[If the …]” information identified in [bold italicized text].

The [insert digital health technology name/type] will collect [describe, in plain language, the function

of the digital health technology and the types of data it will collect]. This information will help the

study team better understand [insert general study goal].

[If use of the digital health technology is essential to the study and not optional]:

As part of this study, you will be asked to use [insert digital health technology name/type]. If you do not

want to use [insert digital health technology name/type], you should not agree to be in this study.

[If one or more digital health technologies used in the study are optional]:

As part of this study, you will be asked to use [insert digital health technology name/type]. Use of

[insert digital health technology name/type] is optional. You can still take part in this study, even if you

do not want to use the [insert digital health technology name/type].

Procedures

Considerations: The procedures component should provide prospective participants with a description

of how, when, and under what conditions the digital health technologies will be used in the study.

• Participants should be provided with a clear description of how the digital health technology will be

used including the types of data collected and the frequency it will be shared with the study team.

The study team should clearly state under what conditions and how frequently participants will be

asked to use or interact with the digital health technology for study purposes (e.g., turn on, use,

enter data), whether data will be collected without purposeful participation (i.e., passive data types

such as location data, steps, heart rate), and how the technology may impact their daily activities.

Expectations about what participants should not do (e.g., move a device, turn it off) should also be

clearly communicated.

• Participants should be made aware of whether any interactions with the digital health technology

will involve notifications or communications from computer generated sources and at what

frequency.

• Participants should be made aware of the device(s) being used in the study and that they will need

to agree to the standard terms and conditions for the use of the device(s) and instructed use. Clear

instructions should be provided on how to install, configure, and use the study-related digital health

technology.

• Indicate whether the study team will provide the digital health technology, if the participant will be

asked to connect hardware or install software on a personal digital device, the expected duration of

the use of the digital health technology, and when and if the participant must return study-provided

devices or discontinue any subscription services (e.g., if the participant withdraws from the study, or

at the study’s conclusion). Indicate what happens if a device is not returned per instructions.

• When participants are familiar with the technology outside the study context, state any key

differences between use of the technology for the purposes of the study compared to use in the

general population.

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

• The study team should provide participants with the names of all third parties that may have access

to participant data, including the frequency of their access and level of detail they may have.

• The study team should inform participants if their personal health care providers will receive

information collected by the digital health technology (including atypical readings or alarms from

the digital health technology), whether providers will receive this information (e.g., real-time,

specific intervals), and if data will be integrated with a participant’s electronic health record (EHR).

Also, the study team should indicate under what circumstances clinically actionable data will be

shared and with whom it will be shared. Participants should be informed if they will have direct

access to their collected digital health technology data, how often they will be able to directly access

this data, and how this can be done.

• Participants should be alerted to the steps to stop the collection and/or sharing of their data with

the study team, which may include discontinuing use of wearables, removing sharing permissions,

and/or uninstalling software application(s).

• Include language clarifying whether any portion of a study incentive is dependent on participant use

of the device or application.

Sample Language

Instructions: Adjust language as needed. Include “[If the …]” text if it pertains to your study. Replace

embedded instructions identified in [bold italicized text] with specific information pertaining to the

study. Remember to remove the “[If the …]” information identified in [bold italicized text].

Taking part in this study means that you will need to set up [insert digital health technology

name/type]. This means that you will need to [describe how the participant must set up, place, install,

configure, or activate the digital health technology]. If you have questions about setting up this device,

please contact [insert contact name, email and/or phone number for study team member that can

assist with tech-related questions]. You will be asked to use [insert digital health technology

name/type] for about [insert approximate amount of time (e.g., hours/day)] over the course of

[specific number of days/weeks/months].

You will be asked to share [insert types of data] via [insert digital health technology name/type] [insert

frequency (e.g., at random intervals throughout the day, daily, weekly)]. This data will be shared with

the study team [insert frequency with which the data will be shared (e.g., in real-time, every 24 hours,

weekly)]. The [insert digital health technology name/type] will continue to collect [insert types of data]

until the [insert digital health technology name/type] is [insert is removed/uninstalled/or no longer

used].

The data you share with the study team [will/will not] be monitored [if applicable, by whom (e.g., study

team, healthcare provider)] [frequency]. If you have any questions about your health during this study,

you should reach out directly to your health care provider(s).

[If the digital health technology sends automated notifications and/or computer-generated

communications]:

While you are in this study, the [insert digital health technology name/type] may send auto-

notifications. You should not take these notifications as medical advice. The feedback may not be

reviewed by the study team or your healthcare provider(s). If you have concerns about your health while

you are in this study, or about the notifications you might be getting, reach out to your healthcare

provider(s).

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

[If the study team will be monitoring participant data and sending messages to participants about

their health]:

You may receive messages from the study team with information we think you should know about your

health. If you have questions or concerns about your health information shared in the message, reach

out to [insert “the study team” OR “your healthcare provider(s)”].

[If the participant will need to create a user account]:

You will be required to create an account with [insert digital health technology name/type] to

participate in this study. Creating an account with [insert digital health technology name/type] requires

providing personal information. If you do not want to do this, you should not agree to be in this study.

When you are no longer taking part in the study or choose to stop using the [insert digital health

technology name/type], your account will remain open unless you contact [insert study team or

company contact] to close the account.

[If one or more digital health technologies has components the user can voluntarily disable]:

[Insert digital health technology name/type] has parts that can be turned off by the user including: ([list

all components that the user can control]). You can turn these parts on or off at any given time during

the study.

Data Sharing and Ownership

Considerations: This component should provide prospective participants with a clear understanding of

data ownership and how participant data is collected, stored, and shared.

• Participants should be informed whether the data collected by digital health technologies contains

confidential or identifiable information or is associated with possible stigma.

• Indicate whether the data collected by the digital health technology is owned by the company and

whether the data may be sold or shared to third parties without explicit participant consent. Provide

awareness of end user agreements, terms and conditions, and terms of service that participants will

need to accept, including hyperlinks to these documents. Educate participants about the

implications on the use of their data as part of these agreements. .

• As capabilities evolve to enable linkages between digital health data and disparate data sources,

consider the risk of re-identification and its implications on participant’s privacy and confidentiality.

Consider how the informed consent language informs participants of this potential risk including

mitigation steps and how participants will be notified.

• Consider including language on where and how the study team or others involved in the research

store and manage participant data and how to contact the digital health technology company (e.g.,

their website) for questions about how it stores data. Explain what security protections will be put in

place by the study team, who has access to the data, and the controls to prevent unauthorized data

access, noting that data held by a digital health technology company may not be protected in the

same way.

• Participants should be informed about the length of time their data will be retained for the study,

purposes for which data could be used during and after the study (i.e., repositories or future

studies) and if additional consent will be required for any further activities.

• Address if the digital health technology may store, collect, and/or display additional information as

part of the technology’s normal functioning that is beyond the scope of the research study.

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

Sample Language

Instructions: Include relevant text below. Replace embedded instructions identified in [bold italicized

text] with specific information pertaining to the study.

Information from your [insert digital health technology name/type] will be stored by the study team

[insert location where the data will be stored]. We plan to store your data for [insert duration data will

be stored as indicated in the protocol]. We may share your information with [insert with whom

information will be shared, including data repositories as applicable], but we will not share information

that directly identifies you. [If data is shared with a repository, insert basic summary information about

the repository and how they may use or share the data]. We will do our best to protect your privacy

during this study. When you are no longer taking part in the study or choose to stop using the [insert

digital health technology name/type], [insert the future use of the study team’s access to the account

and previously collected data as it pertains to the study guidelines]

[If the study is using a commercial digital health technology]:

[Insert company] will have access to, and [will retain a copy/will not retain a copy] of any data

collected by [insert digital health technology name/type]. When using [insert digital health technology

name/type] you agree to the Terms and Conditions set out by the company. We do not have control

over how [insert company] will protect your data and privacy.

Potential Risks

Considerations: The potential risks component is meant to provide prospective participants with a clear

understanding of reasonably foreseeable risks and/or discomforts related to the use of digital health

technologies in research other than those described in the Data Sharing and Ownership section.

• Investigators using digital health technologies are expected to assess and identify the reasonably

foreseeable risks and/or discomforts that may be associated with digital health technologies being

used in the study. This includes possible privacy and security risks (e.g., location data), along with

physical or psychosocial discomforts (e.g., skin irritation, allergic reaction, broken skin, anxiety).

• Investigators will need to be aware of any changes that might alter the risks of the study and

consider these with the IRB for the purposes of notification to participants.

• The research team should prioritize selecting technologies capable of the study measures needed

while presenting the least amount of risk to participants.

• Address the potential risk of continued data collection after the study ends should the digital health

technology remain on a participant’s device or continue to be used by the participant.

• Inform participants if there could be updates to software, privacy policies, or terms of service

agreements during the study period and the potential risks these updates may pose. This includes

informing participants that companies deploying a commercial digital health technology may not be

required to follow the same study privacy rules as the research team and the company’s rules can

change at any time without notice. The study team should include language explaining whether the

privacy policies for the digital health technology used in the study can or cannot be changed by the

research team.

• Inform participants how linking or using multiple technologies might impact who has access to the

participant’s data and how much data they might have access to. If the participant has a digital

health technology that can be accessed by others (e.g., shared devices or accounts with family

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

members, relatives, neighbors), they need to be informed that this might result in less privacy and

an inability to maintain confidentiality.

• Study teams and their institutions are expected to provide participants with a clear understanding of

how their study data is being protected, who might have access to it, and the steps being taken to

minimize possible privacy risks that could arise.

• The study team should consider including language to help participants understand the role they

can play in protecting their confidentiality and private information when using digital health

technologies (e.g., creating a secure password).

• Address the potential risks for breaches of participant study data.

• When the digital health technology used in the study could collect information on other individuals,

especially when those individuals may not know their data is being collected (e.g., participant’s

social networks, or home and other surroundings), language should be added to inform participants

of the possible risks (e.g., security risks) for non-participants and whether/how these risks can be

mitigated by the study team and/or participant.

• Address any potential risks that arise from adding the digital health component to a participant’s

existing technology, including the potential for interference with another technology the participant

currently uses.

Sample Language

Instructions: Adjust language as needed. Include “[If the study…]” text if it pertains to your study.

Replace embedded instructions identified in [bold italicized text] with specific information pertaining

to the study. Remember to remove the “[If the study…]” information identified in [bold italicized

text].

If you join this study, there is a potential risk that data you share may be accessed by someone without

your permission or that someone may be able to identify you. These people may misuse the data you

share with us in a way that leads to personal harm (e.g., discrimination). There may also be other risks

that are not currently known. While we will do our best to protect your data, we cannot remove all risks.

In general, there is no additional risk to using [insert digital health technology name/type] in this study

beyond the risk you take when using [insert digital health technology name/type] in your daily life.

Using [insert digital health technology name/type] requires that you agree to [insert company]’s

“Terms of Service” and privacy policy. We do not control these terms and policies, which can change at

any time. You should read the Terms of Service and the privacy policies before using [insert digital health

technology name/type]. You should also review your privacy settings often. If any changes are made to

[insert company] privacy policies, the research team [insert will or will not] notify you.

[Insert company] may also collect, store, and sell information you provide through [insert digital health

technology name/type]. This may include personal information, location data, video, audio, and photos.

We do not control whether [insert company] will store or sell your data. We cannot control if they collect

more data than the study requires, or how [insert company] will protect your privacy. We will continue

to protect the data we collect. However, [insert company] may share or disclose information per their

terms and conditions. We have no control over the data they collect or own. Please know that [insert

company] may continue to have access to your data even after you stop being part of the study.

By using [insert digital health technology name/type] there is a risk you may be identified as a study

participant. This may occur if the [insert digital health technology name/type] is lost, misplaced, or

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

stolen. It may also occur if your identity and information recorded in the [insert digital health

technology name/type] is otherwise accessed by another person.

Potential Benefits

Considerations: The potential benefits component informs prospective participants about any

anticipated direct benefits related to their use of digital health technologies during the research study.

Sample Language

Instructions: Adjust language as needed. Include “[If there are…]” text if it pertains to your study.

Replace embedded instructions identified in [bold italicized text] with specific information pertaining

to the study. Remember to remove the “[If there are…]” information identified in [bold italicized text].

[If there are no known benefits from using the digital health technology]:

There are no known benefits from using [insert digital health technology name/type] as part of this

study. In the future, other people might benefit because of what we learn from your use of the [insert

digital health technology name/type].

[If there are known benefits from using the digital health technology]:

You may benefit from using [insert digital health technology name/type] in the study. [Fill in any

DIRECT benefits from using the digital health technology IN THE STUDY. Do not include indirect or

ancillary benefits.]

Cost

Considerations: The cost component should inform prospective participants of any potential costs to

them related to use of digital health technologies in the study. Consent forms should clearly state who

will be responsible for which costs related to the use of the digital health technology, whether study-

provided or a personal device.

• If the participant will be using their own device and/or needs a cellular service/ internet connection

to transmit data, clearly outline who is expected to cover the cost of the required cellular

service/internet connection (i.e., any reimbursement provided to cover or offset the costs).

• If the study provides paid access/subscription to a digital technology, clearly specify how long the

participant will have access to the application and whether they will have to pay for the service after

the study ends should they wish to continue use.

• There may be situations where the device breaks, is lost or stolen, is faulty, or needs maintenance

(e.g., replacement parts including batteries). Specify what to do in such situations and under what

circumstances the participant or the study will be responsible for paying for the maintenance or

replacement of the device.

• Consider commercial technologies that may offer in-app paid features. If using these tools,

researchers should clearly describe who is responsible for those costs and explicitly state what will

be provided as part of the study.

Sample Language

Instructions: Adjust language as needed. Include “[If there are…]” text if it pertains to your study.

Replace embedded instructions identified in [bold italicized text] with specific information pertaining

to the study. Remember to remove the “[If there are…]” information identified in [bold italicized text].

Informed Consent for Research Using Digital Health Technologies: Points To Consider & Sample Language

NIH Office of Science Policy

May 2024

[If there are subscription or service costs from using the digital health technology]:

[Insert types of subscriptions or services] costs from using the [insert digital health technology

name/type] will be paid by the study team while you participate in the study. Upon study completion or

your withdrawal, you will be responsible for these costs if you wish to continue to their use.

[If the device must be returned after completing the study]:

The [insert digital health technology name/type] must be returned at the end of the study or you will be

required to pay [insert amount] for the cost of the [insert digital health technology name/type].

[If the study requires a BYOD (bring your own device)]:

The study requires participants to BYOD (bring your own device). The device required is [insert digital

health technology name/type]. [Insert any data costs, such as WIFI or data roaming, that the

participant will incur as a result of the BYOD study policy].

Withdrawal

Considerations: The withdrawal component should clearly address the limitations of data removal

when a participant withdraws from a study using digital health technologies and specify any collection of

data beyond the withdrawal point or study conclusion. For studies using personal devices, clarify if

software must be uninstalled when leaving or ending participation in the study.

• Inform participants whether the study team and/or the digital health technology company may be

able to keep and use participant data after the study ends or a participant withdraws from the

study.

• Inform participants if their study data cannot be removed even upon withdrawing from the study.

• Inform participants if the digital health technology will continue to collect data until the device

and/or the software application have been removed, uninstalled, or the associated account is

deactivated or closed.

• Establish and clearly communicate a protocol for addressing participant use of the technology as

outlined in the study, defining specific criteria and time frames for non-adherence (e.g., 30 days of

no interaction), using multiple methods (emails, calls, letters) for attempts to re-establish contact,

and ensuring ethical considerations are met before formally withdrawing participants who do not

explicitly request to drop out but show complete lack of adherence to required study activities.