Electronic Informed Consent for Research 2027: E-Signatures, IRB Approval and Part 11

Electronic informed consent for research (often shortened to eConsent or eIC) replaces the paper consent form with an electronic process: the participant reads the study information on a screen, may watch a video or answer comprehension questions, and signs electronically. The rules for what consent must contain and who approves it do not change when the paper goes away. What changes is how you prove that the right person read the right version, understood it, and signed it. This guide walks through the federal guidance, what your IRB will ask for, where 21 CFR Part 11 comes in, and what to check in the software you use.

Quick Answer

Electronic informed consent is allowed for research under both the Common Rule and FDA regulations, provided the consent contains every required element, the IRB approves the electronic materials and the process, and the site can verify the signer's identity. FDA and HHS's Office for Human Research Protections (OHRP) set out their expectations in a joint question-and-answer guidance on electronic informed consent. For FDA-regulated clinical investigations, the electronic records and signatures must also meet 21 CFR Part 11; for studies governed only by the Common Rule, federal and state e-signature law (ESIGN and UETA) and your IRB's requirements apply. In every case the participant must receive a copy, and any HIPAA authorization needed for the study must be obtained alongside the consent or waived by an IRB or Privacy Board.

Note: This guide is educational, not legal or regulatory advice. Confirm your consent process with your IRB, your institution's counsel and, for sponsored trials, the sponsor. For the broader question of using clinic data for studies, see using EHR data for research under HIPAA.

What Is Electronic Informed Consent?

Electronic informed consent is any consent process that uses electronic systems to give information to a prospective participant, check that they understand it, and record their agreement. It can be as simple as a PDF consent form signed on a tablet in the clinic, or as full as a multi-page module with embedded video, a glossary, knowledge-check questions and a remote signature from the participant's own phone.

The main federal reference is the joint FDA and OHRP guidance, Use of Electronic Informed Consent: Questions and Answers (December 2016), also published by OHRP. It makes three points that shape everything else. First, electronic consent must meet the same regulatory requirements as paper consent; the medium is not a shortcut. Second, the IRB must review and approve the electronic materials, including any videos, web pages or quizzes the participant will see, not only the text. Third, the process must let the participant ask questions and get answers from the study team before signing, whether that conversation happens in person, by phone or by video.

The guidance also accepts that eConsent can happen in the clinic or remotely. Remote consent is often the reason sites adopt it: a participant can review the material at home, take their time, and sign without a second trip. The trade-off is that the site has to work harder at identity verification and at making sure the discussion with the investigator actually took place.

What Must an Electronic Consent Contain?

The content requirements are the same as for paper. For research covered by the Common Rule, the elements are listed in 45 CFR 46.116. For FDA-regulated clinical investigations, they are in 21 CFR 50.25. The two lists overlap heavily. At a high level, a consent must explain:

• that the study is research, its purpose, how long participation lasts, and what the participant will be asked to do, identifying anything experimental;
• the reasonably foreseeable risks or discomforts, and any benefits to the participant or to others;
• appropriate alternatives to taking part, where there are any;
• how confidentiality of records will be maintained (FDA's version adds that the FDA may inspect the records);
• for studies with more than minimal risk, whether compensation or medical treatment is available if injury occurs;
• whom to contact with questions about the research, about participants' rights, and in the event of a research-related injury;
• that participation is voluntary, that refusing carries no penalty or loss of benefits, and that the participant may stop at any time.

The revised Common Rule (the 2018 requirements) added a structural rule as well: the consent must begin with a concise, focused presentation of the key information most likely to help a person decide whether to take part. Electronic consent makes this easier to get right, because the key-information summary can be the first screen the participant sees, with the full document behind it. There are also additional elements that apply when relevant, such as unforeseeable risks, circumstances under which participation may be ended by the investigator, and what happens to identifiable data or specimens. Your IRB's template will reflect its reading of these lists, so start from that template rather than writing the consent from scratch.

Clinical trials subject to FDA rules have one more item: consent documents for applicable clinical trials must include the specific statement that a description of the trial will be available on ClinicalTrials.gov. Check the exact wording against 21 CFR 50.25(c) or your sponsor's template.

How Does the IRB Approve an eConsent Process?

An IRB approves more than the words. Under the joint guidance, the board reviews the full set of materials the participant will see or hear, in the form they will be presented. That includes the consent text, any video or audio, hyperlinked pages, pop-up definitions, and the comprehension questions and how wrong answers are handled. If a participant can click through to a glossary, the glossary is part of the consent materials.

The IRB will also want to understand the process around the screens. Expect questions like these in the submission:

1. Where will consent happen? In the clinic with staff present, remotely, or both.
2. How is identity verified? Particularly for remote signing.
3. How does the participant ask questions? Who from the study team is available, and how the site documents that the discussion took place.
4. How is understanding checked? What the knowledge checks are and what happens if the participant gets one wrong.
5. How does the participant get a copy? And in what format.
6. How are versions controlled? How the site makes sure no one signs an outdated version after an amendment.
7. Who can see the signed records? And how they are protected and retained.

Plan to submit screenshots or a working test link, and to resubmit when you change anything a participant sees. A change to the software layout that alters the order or presentation of information may need IRB review even when the text is unchanged. Ask your IRB early which changes it treats as minor.

For studies that are not FDA-regulated, many IRBs also want to know whether a signature is required at all. Under the Common Rule an IRB can waive documentation of consent in certain circumstances (45 CFR 46.117(c)), for example in minimal-risk online surveys, in which case the site may provide an information sheet without collecting a signature. That is the IRB's decision, not the site's.

How Do You Verify a Participant's Identity?

The joint guidance expects the method of identity verification to be appropriate to the study and described to the IRB. It does not prescribe a single method. In practice, sites combine a few layers depending on risk:

• In-person consent: a member of the study team checks identification at the desk, the participant signs on a clinic device, and the staff member records that they confirmed identity.
• Remote consent with a known participant: the link goes to contact details already verified in the participant's record, and opening the document requires something only the participant has, such as an access code shared by phone or a one-time code sent by text.
• Remote consent with a new participant: a video call where the participant shows identification, combined with a code sent to the phone number they provided.

For FDA-regulated trials, Part 11 adds its own requirement: before an organization establishes or certifies a person's electronic signature, it must verify that person's identity (21 CFR 11.100). Whatever you choose, the record should show how identity was confirmed for each signature, not only that a signature exists. A certificate of completion that captures who signed, when and by what method is the practical way to keep that evidence with the document.

Legally authorized representatives add a layer. If a representative signs for a participant who cannot consent, the site needs to verify the representative's identity and document their authority under state law. Your IRB will set the rules for who may act as a representative in your jurisdiction.

How Do You Check That a Participant Understood?

Consent is a process, not a signature, and eConsent is well suited to checking understanding along the way. The joint guidance encourages methods such as questions at the end of a section, with feedback on wrong answers, so that the participant and the study team can see where more explanation is needed.

A few principles make comprehension checks useful rather than decorative:

• Ask about the things that matter most for the decision: that it is research, what the participant will do, the main risks, that they can stop at any time.
• Use plain questions with a clear right answer, not trick questions.
• Decide in advance what happens after a wrong answer. Most IRBs expect the participant to see the relevant section again and to discuss it with the study team, not to be locked out.
• Keep the results. A participant's answers to knowledge checks are part of the consent record and can show that the process worked.

A quiz does not replace the conversation with the investigator. The participant still needs a chance to ask questions and get answers before signing, and the site should record when that discussion happened and who took part.

When Do Participants Need to Re-Consent?

When a protocol amendment changes the risks, procedures or anything else that might affect a participant's willingness to continue, the IRB decides whether current participants must be told and whether they must sign a revised consent. The Common Rule and FDA regulations both require that significant new findings that may relate to willingness to continue be provided to participants.

Electronic consent helps here if the system does two things well. It must control versions, so that a new participant can only ever be sent the currently approved version and an old version cannot be signed by mistake. And it must let the site see who signed which version, so the team can find every active participant who needs the revised consent and track who has completed it. Keep every approved version and its IRB approval date, and keep each participant's signed copy of each version they signed.

How Do Participants Get a Copy?

Both sets of regulations require that the participant (or their representative) be given a copy of the consent document. The joint guidance says the copy may be electronic or paper, and that the participant should be able to get a paper copy on request. If the consent includes hyperlinks or videos, the copy should include the information the participant saw, not just a signature page.

In practice, send the signed document and its certificate to the participant by a channel they can open later, or make it available in a patient portal, and offer paper at the visit. Record that the copy was provided.

Where Does HIPAA Authorization Fit?

Informed consent and HIPAA authorization are different permissions. Consent is the participant's agreement to take part in the research under the Common Rule or FDA rules. HIPAA authorization, governed by 45 CFR 164.508, is the participant's permission for a covered entity, such as the clinic, to use or disclose their protected health information for the study.

When a clinic that is a HIPAA covered entity recruits its own patients into research, or shares their records with a sponsor or a university research team, it usually needs one of these: a signed authorization, a waiver or alteration of authorization approved by an IRB or Privacy Board, a limited data set released under a data use agreement, or properly de-identified data. HHS explains each path on its research guidance page.

For research, the authorization may be combined with the informed consent document, or kept as a separate form. Many institutions prefer a separate form so the HIPAA elements (what information, who may use it, for what purpose, the expiration or "none" for research, and the right to revoke) are easy to find. Either way, the authorization has its own required elements, and the participant must receive a copy. Ask your IRB or Privacy Board which format your institution uses. See our guide to using EHR data for research under HIPAA for the waiver, limited data set and de-identification routes in more detail.

ESIGN, UETA or 21 CFR Part 11: Which Rules Apply?

This is the question that confuses most sites. There are two layers of e-signature law, and which one governs depends on who regulates the study.

ESIGN and UETA apply broadly. The federal ESIGN Act (15 U.S.C. 7001) and state laws based on the Uniform Electronic Transactions Act say that a signature or record cannot be denied legal effect solely because it is electronic. For research governed only by the Common Rule, such as a federally funded observational study or a behavioral survey, these laws plus your IRB's requirements are generally the framework. Our guide to digital intake forms with e-signature covers ESIGN and UETA for everyday clinic forms in more detail. The joint guidance notes that OHRP permits electronic signatures where they are legally valid in the jurisdiction where the research is conducted.

Part 11 applies when FDA regulations require the record. 21 CFR Part 11 governs electronic records and electronic signatures that are created, modified, maintained or submitted under FDA's requirements. A consent form in a clinical investigation of a drug, biologic or device is required by 21 CFR 50, so when that consent is electronic, Part 11 applies. Part 11 expects, among other things:

• electronic signatures that are unique to one person and not reused or reassigned;
• signed records that show the printed name of the signer, the date and time, and the meaning of the signature;
• signatures linked to their records so they cannot be removed, copied or transferred to falsify a record;
• secure, computer-generated, time-stamped audit trails recording when records are created, changed or deleted, without obscuring earlier entries;
• controls over who can access the system, and documentation that the system does what it is supposed to do.

That last point is why sponsors ask for validation documentation. FDA's guidance on Part 11 scope and application describes a risk-based approach, and a sponsor will usually want evidence that the eConsent system has been assessed for its intended use. A software vendor can support that assessment, but the site and sponsor remain responsible for how the system is used in their study.

If your study is not FDA-regulated, you do not need to meet Part 11, but many of its practices are still good practice: an audit trail, unique user accounts, and a record of the meaning of each signature make any consent easier to defend.

What Audit Trail and Records Retention Do You Need?

An audit trail answers the questions a monitor, auditor or inspector will ask about each consent: which version was sent, when it was opened, when each signature was applied, by whom, how identity was confirmed, and whether anything changed afterwards. The certificate of completion attached to a signed document is the participant-facing summary of that trail; the system's audit log is the fuller record.

Retention periods come from several places, and the longest applies:

• FDA-regulated drug studies: investigators keep records for two years after a marketing application is approved, or two years after the investigation is discontinued and FDA is notified (21 CFR 312.62); device studies have a parallel rule in 21 CFR 812.140.
• IRB records under the Common Rule are kept for at least three years after the research is completed (45 CFR 46.115).
• HIPAA documentation, including signed authorizations, is kept for six years from creation or the date it was last in effect (45 CFR 164.530(j)).
• Sponsor contracts and institutional policies often require longer, and state law governs medical records.

Keep signed consents where they cannot be edited, where access is logged, and where you can still produce them, readable, years later.

eConsent Checklist: What the IRB and FDA Expect

Use this table when you prepare an IRB submission or evaluate software. The middle column summarizes the expectation; the right column is what to confirm in a demo.

A Step-by-Step eConsent Workflow

Here is a practical sequence for a site setting up electronic consent for a new study. Adjust it to your IRB's requirements.

1. Start from the IRB-approved consent template. Build the key-information summary as the first section and follow the approved order.
2. Add comprehension questions for the points that matter most, with the explanation you will show after a wrong answer.
3. Prepare the HIPAA authorization as a separate form or combined section, as your institution requires.
4. Submit the full electronic package to the IRB. Include screenshots or a test link, your identity verification method and your copy process.
5. Lock the approved version. Record the IRB approval date against it and make sure only that version can be sent.
6. Confirm eligibility and contact details in the participant's record before sending anything.
7. Send the consent, or open it on a clinic device for in-person signing. Protect remote links with an access code or a code by text.
8. Hold the consent discussion. The investigator or delegated staff answers questions and records when the discussion took place.
9. Collect signatures in order: participant or representative first, then the person obtaining consent and any witness the protocol requires.
10. Give the participant a copy of the signed document and its certificate, and offer paper.
11. File the signed consent on the participant's record, where it is access-controlled and retained.
12. Re-consent when the IRB says so. Find every active participant on the old version, send the revised version, and track completion.

How ClinikEHR Handles Research Consent

ClinikForms, the forms and e-signature module in ClinikEHR, covers the consent and authorization steps above. For research, ClinikEHR supports research informed consent and HIPAA authorization through ClinikForms, with an e-signature, a certificate of completion, and the signed document stored on the participant's record. It also supports participant and cohort tracking and de-identified data export. ClinikEHR supports 21 CFR Part 11 requirements for audit trails and electronic signatures; ask us for validation documentation.

From the ClinikForms feature page, the parts most relevant to eConsent are:

• Certificate of completion on every finished document, showing who signed, when and how.
• Identity checks: protect a document with an access code, and have a staff member confirm the identity of someone signing at the desk. Signing codes by text are included on Essential (50 a month) and Team (500 a month).
• Several signers, each with their own fields, in the order you set, by email or in person on a clinic device.
• Upload the consent you already use as a PDF or Word document and place the fields, so the IRB-approved text stays as approved.
• Version history and a printable blank copy, useful for IRB submissions and re-consent.
• Marked quizzes in the form builder, which you can use for knowledge checks.
• Signed copy and certificate to download, and responses you can export to CSV or Excel on every plan.

On plans: signature questions inside forms are available on every plan, including Free. Sending an uploaded document for signature (an eSignature envelope) starts on Essential, with 100 envelopes a month; Team includes 500 and Enterprise is unlimited. The audit trail is listed from Essential on the pricing page. The Clinic plan trial is 30 days of Essential for $29.90 with a card.

ClinikEHR is an EHR, not an electronic data capture (EDC) or clinical trial management system (CTMS). Case report forms, randomization, monitoring visits, safety reporting and IRB submission belong in a dedicated EDC or CTMS. ClinikEHR sits alongside it as the clinical record and the place where consent and authorization are collected and kept. For how to choose the rest of the stack, see best EHR and research data software for clinical research sites.

Frequently Asked Questions

Is electronic informed consent allowed for FDA-regulated clinical trials?

Yes. FDA and OHRP guidance permits electronic informed consent when it meets the same requirements as paper consent, the IRB approves the materials and process, and the electronic records and signatures meet 21 CFR Part 11.

Does 21 CFR Part 11 apply to every research study?

No. Part 11 applies to records required by FDA regulations, such as consent in clinical investigations of drugs, biologics and devices. Studies governed only by the Common Rule rely on ESIGN, UETA and your IRB's requirements.

Can the HIPAA authorization be part of the consent form?

It can. HIPAA allows a research authorization to be combined with the informed consent document, as long as it contains the required authorization elements. Many institutions keep it separate, so ask your IRB or Privacy Board.

How should a site verify identity for remote eConsent?

Use a method suited to the study and described to the IRB, such as sending the link to verified contact details and requiring an access code or a one-time code by text, or checking identification on a video call.

Do participants have to receive a copy of an electronic consent?

Yes. The participant or their representative must receive a copy. It can be electronic, and the participant should be able to get a paper copy on request.

Does ClinikEHR support 21 CFR Part 11?

ClinikEHR supports 21 CFR Part 11 requirements for audit trails and electronic signatures; ask us for validation documentation. The site and sponsor remain responsible for assessing the system for their study.

Conclusion

Electronic informed consent does not lower the bar for consent; it gives you better tools to clear it. The elements, the IRB's approval and the participant's right to ask questions and to stop are the same as on paper. What eConsent adds is a record: which version was signed, how identity was checked, what the participant understood, and when each signature was applied. Get the IRB involved early, decide whether Part 11 applies before you choose software, and treat the HIPAA authorization as its own permission.

Key takeaways:

• Build from your IRB's template and submit everything participants will see.
• Match identity checks to the study, and record how each signer was verified.
• Part 11 applies to FDA-regulated investigations; ESIGN and UETA cover the rest.
• Keep every approved version, every signed copy and the audit trail for the longest retention period that applies.

Related Articles

• Can You Use EHR Data for Research? HIPAA Authorization, De-identification and IRB (2027)
• Best EHR and Research Data Software for Clinical Research Sites (2027)
• EHR for University Research and Teaching Clinics 2027: Supervision, FERPA and Research Data
• Digital Intake Forms With E-Signature: A HIPAA Guide for Clinics (2027)
• 7 Best HIPAA-Compliant E-Signature Software for Clinics (2027)
• Is DocuSign HIPAA Compliant? E-Signatures for Clinics (2027)
• Top Consent and Intake Forms Templates for Private Practice 2026
• How to Automate Sending and Tracking Patient Intake and Consent Forms