IRB Considerations for Decentralized and Digital Research

Decentralized clinical trials (DCTs) and digital health studies move some or all research activities outside a traditional clinic: consent by video, data collection through a wearable, telehealth visits, at-home biosampling, app-delivered interventions. The underlying human subjects protections are unchanged — respect for persons, beneficence, justice, informed consent — but the mechanisms for applying them are new. This guide walks through the IRB questions a decentralized or digital study must answer.

When "decentralized" triggers extra review

Remote methods do not automatically raise the review tier. A remote survey of adults is still minimal risk and often exempt. What raises scrutiny is the combination of remote delivery with one or more of:

A clinical intervention (drug, device, behavioral therapy) delivered without in-person contact
Continuous passive data collection (wearables, phone sensors)
At-home biospecimen collection
Vulnerable populations enrolled without a local clinical site
Cross-jurisdictional enrollment (multi-state or international)

Any of those typically routes a study to expedited or full board review.

Remote informed consent

FDA and OHRP both permit electronic informed consent (eConsent). The requirements at 45 CFR 46.116 and 21 CFR 50.25 still apply — every required element must be present, the consent must be in language understandable to the participant, and the participant must have an opportunity to ask questions.

Questions the IRB will ask:

How is the participant's identity verified before consent?
How does the consent platform confirm the participant read the document (scroll tracking, comprehension questions, minimum time on page)?
How can the participant ask questions in real time — chat, phone, video?
How is the signed consent stored, and how does the participant retain a copy?
If a signature is captured (click-through, typed name, drawn signature), does it meet 21 CFR Part 11 where applicable?
What is the process when capacity to consent is uncertain without in-person observation?

Waiver of documentation is not the same as waiver of consent

For minimal-risk remote studies, the IRB may waive documentation of consent under 45 CFR 46.117(c). The participant still receives all required consent elements — just not a signed form. Waiver of consent itself (46.116(f)) is rarer and requires different criteria.

Wearable, sensor, and passive data collection

Continuous streams from a wearable or phone create ethical questions that short questionnaires do not:

Data minimization. Every sensor on a modern device can be queried — accelerometer, GPS, microphone, heart rate, sleep, keystrokes. Collect only what the aims require, and document the decision.
Re-identifiability. Continuous GPS and accelerometer traces are high-dimensional fingerprints. De-identified location data often is not truly de-identified. Describe the re-identification risk and the mitigation in the protocol.
Bystander data. Microphone and camera capture people who did not consent. State whether and how bystander data is avoided or filtered.
Clinically actionable findings. If the wearable detects an arrhythmia, a fall, or suicidal ideation text, what is the plan? A pre-specified safety pathway is almost always required.
Device ownership and return. Is the wearable the participant's or study-provided? If study-provided, is it returned, wiped, or kept? Address reimbursement and disposal.

Telehealth visits

Video and phone study visits are permissible but require the IRB to assess:

Platform security and HIPAA compliance (Zoom for Healthcare, Doxy, Teams for Healthcare, etc., with BAAs in place)
Participant access to a private, appropriate space — and what the study team does if a visit occurs in an unsafe setting
How clinical assessments normally done in person (blood pressure, auscultation, neurologic exam) are adapted, substituted, or omitted
Licensure of study clinicians across the states where participants reside

At-home biospecimen collection

Mail-in kits for saliva, dried blood spot, or stool are increasingly common. The IRB will review:

Clear, plain-language instructions with illustrations
Risk disclosure (lancet use, handling, infection control)
Shipping procedures, including temperature control and biohazard labeling where required
What happens if a kit is lost or contaminated in transit
Return of clinically significant results — or documented decision not to return
Long-term storage, future use, and broad consent if biospecimens are banked (see 45 CFR 46.104(d)(7))

Multi-state and cross-border enrollment

A remote study can enroll participants in any state with internet. That creates obligations the protocol must address:

State licensure laws for any clinician interacting with a participant
State-specific consent elements (e.g., California, New York)
Mandatory reporting requirements (child abuse, elder abuse, intimate partner violence) that vary by state and trigger when a study clinician learns of harm
If international, whether the study is engaged in human subjects research in that country and what local ethics review is required

Equity and digital access

45 CFR 46.111(a)(3) requires equitable selection. A study that only enrolls people with reliable broadband, a smartphone, and tech literacy excludes substantial populations. IRBs increasingly expect protocols to address:

Whether the study provides devices or data plans to eligible participants
Whether consent and study materials are available in multiple languages and plain language
Whether participants can choose between digital and non-digital options for the same activity
How the recruitment strategy avoids reinforcing existing disparities in research participation

Protocol checklist for decentralized studies

Named platform(s) for eConsent, telehealth, and data collection — with security documentation
Identity verification procedure before consent and enrollment
Complete list of sensors or data streams with justification for each
Pre-specified safety response pathway for clinically actionable findings
State-by-state plan for clinician licensure and mandatory reporting
Data flow diagram: device → server → analysis → storage → destruction
Plan for participants who lose access to the study app or device mid-study
Equitable-access plan including device provision and language access

For the protocol narrative, see how to write your IRB protocol; for consent language specific to digital data, see writing informed consent forms; and for storage, transmission, and destruction of device data, see data management.