Remote eConsent for research sites: what compliance requires beyond the electronic signature

Electronic informed consent, often shortened to eConsent, is now standard at many research sites in the United States. The label is misleading. Regulators do not treat the electronic signature as the consent. They treat it as one step inside a longer process the investigator is responsible for from start to finish. For a research site running remote or hybrid visits, that distinction is what separates a defensible study from an inspection finding.

The electronic signature is only one step in the consent process

Informed consent is a participant's voluntary, informed agreement to take part in research after understanding the risks, benefits, and alternatives. The U.S. Food and Drug Administration (FDA) and the Office for Human Research Protections (OHRP) have stated plainly that the signature is often mistakenly treated as the consent itself. The consent is the process. The signature only documents it.

eConsent means using electronic media to present study information, capture the participant's decision, and document it. That can include text, video, graphics, questions to check understanding, and an audit trail (a computer-generated log of every action and who took it). A compliant remote eConsent process weaves all of these together. It cannot be reduced to a signature screen.

The investigator, meaning the physician or qualified researcher listed on the study, remains responsible for the process even when it happens over video. Delegated staff can conduct the discussion, but the responsibility does not transfer to the software vendor or the platform. Sites that have already worked through their readiness for ICH E6(R3) will recognize this as one of the guideline's core principles.

What U.S. regulators require for remote consent in 2026

Several instruments govern remote eConsent for U.S. research sites, and while the modernizing framework is well underway, the core requirements have not changed.

The 2016 FDA and OHRP joint question-and-answer document on the use of electronic informed consent is still the operative U.S. guidance. It sets expectations for presentation of information, opportunity to ask questions, comprehension, e-signatures, identity verification, pediatric assent, and Institutional Review Board (IRB) review. An IRB is the independent ethics committee that must approve every consent screen, video, quiz, and translation before use.

For FDA-regulated studies, an electronic signature must meet 21 CFR Part 11, the regulation covering electronic records and electronic signatures. Part 11 requires validation of the system, controlled access, an audit trail, and a signature that is uniquely linked to the record it applies to. In October 2024 the FDA finalized a revised question-and-answer document on electronic records and systems in clinical investigations that clarifies acceptable identity verification methods and confirms that a signature drawn with a finger or stylus is treated as a handwritten signature executed to an electronic record.

Two more recent instruments shape the current picture. The FDA's September 2024 guidance on conducting clinical trials with decentralized elements confirms that consent may be obtained remotely and states that obtaining consent is not an appropriate activity for a local healthcare provider (someone near the participant who is not part of the study team). The FDA's September 2025 adoption of ICH E6(R3), the international good clinical practice guideline, allows remote consent explicitly and requires the investigator to confirm the identity of the participant.

Two updates remain pending in the United States: the FDA's version of ICH E6(R3) Annex 2, which covers decentralized and pragmatic trial elements, and the joint FDA and OHRP draft guidance on key information in informed consent. Sites should monitor both. Sponsors running global studies may already apply Annex 2, because it is in effect across several other regions.

The Health Insurance Portability and Accountability Act (HIPAA) applies whenever the consent process authorizes access to protected health information. Electronic authorizations are permitted, participants must receive a copy, and video discussions should happen in a private setting. Sites often pair the process with participant-facing resources that explain how participants read a consent form, which strengthens the later comprehension check.

Building the remote eConsent workflow at the site

A remote eConsent process that satisfies the framework above rests on seven building blocks the site controls.

The first is a pre-specified process. Before any participant is approached, the protocol or a site standard operating procedure should state how consent will happen remotely, how identity will be verified, and how the discussion will be documented. The IRB reviews and approves this in advance.

The second is identity verification. When consent is not personally witnessed by study staff, the electronic system must include a method to confirm that the person signing is actually the participant or their legally authorized representative (a person authorized under state law to consent on someone else's behalf). Acceptable methods include a photo identification check over live video, knowledge-based questions, or a strong login with multi-factor authentication. The method should be pre-specified and documented for every consent, not chosen on the fly.

The third is understandable information. Materials should be plain, layered, and paced. The system should let participants move back and forth, pause, and resume. Where helpful, video and graphics can support the text. Participants should be told how long the process will take and how to reach the study team with questions.

The fourth is a real opportunity to ask questions. Self-guided review of materials does not by itself equal the consent discussion. A live conversation with a qualified, delegated staff member, by video or phone, should be the default. Participants should be able to reach the team both before signing and after.

The fifth is a comprehension check. Short quizzes, teach-back (where the participant explains the study in their own words), or targeted follow-up questions help confirm the participant understood the key elements. A wrong answer should trigger re-explanation rather than a hard pass-or-fail gate, unless the IRB has approved that specific design.

The sixth is signature and version control. The system should offer only the current IRB-approved consent version for new participants, block retired versions, and record signatures with a time stamp linked to that specific document. Sites overseeing amendments to already-enrolled participants should also plan carefully for how re-consent works when a protocol change requires it.

The seventh is documentation of the process, sometimes called the consent note. A defensible consent note captures the version and IRB approval date, how identity was verified, who conducted the discussion and by what method, that questions were invited and answered, the outcome of any comprehension check, that consent was obtained before any study procedure, and how the participant received a copy of the signed document.

Where remote eConsent processes commonly fall short

The FDA's inspection metrics consistently list consent problems among the most frequent findings for clinical investigators. In remote settings, a small set of failures accounts for most of them.

Consent obtained after a screening test or study procedure has already occurred is one. The consent time stamp must precede every study-specific activity. Reconciling consent dates against the first-procedure dates in the electronic data capture system, the platform that stores study data, is a simple check that catches this early.

The wrong or outdated consent version being signed is another. When a protocol amends and the IRB approves a new version, the site must retire the old one in the system immediately and re-consent participants where required. A tracker that links every enrolled participant to a version and re-consent status prevents this drift.

Failure to document an opportunity for questions appears often on inspection reports. The system may show a signature and a time stamp, but the file lacks any record of the conversation. A short structured consent note fixes this without adding much time to the visit.

Weak identity verification is a growing concern in remote settings. The method must be pre-specified and applied every time consent is not witnessed in person by study staff.

Missing copy delivery to the participant, whether electronic or paper, is a straightforward failure with a simple fix. The system should confirm and log delivery.

Finally, consent obtained by staff who are not delegated on the study, or by a local healthcare provider near the participant, is not compliant. Delegation logs and training records need to keep pace with remote workflows.

Sites that already treat their essential document archive as a live, inspection-ready system will find that many of these fixes reinforce work they are doing on audit-proofing the eTMF. The trial master file (eTMF) is the collection of essential documents that show a trial was conducted properly.

Where DecenTrialz fits in the site's consent workflow

Consent is the research site's responsibility, and no recruitment platform changes that. DecenTrialz supports the stage before consent by using AI-assisted participant matching and registered nurse-led pre-screening to deliver qualified, informed referrals to the study team. Participants arrive at the site already familiar with the study concept and their potential fit, which gives the coordinator running the consent discussion a stronger starting point.

Final eligibility determination, informed consent, the study walk-through, and enrollment remain with the authorized research site and study team.

That division of labor matters during monitoring visits and inspections, when the site is expected to demonstrate that everything downstream of the referral, including consent, was documented and defensible. Sites that align their consent chain with their broader approach to source data verification under risk-based monitoring tend to make monitors' jobs, and their own, easier. Site teams interested in strengthening the pre-consent pipeline without loading more work onto coordinators can learn more at decentrialz.com.

Frequently asked questions

Is a finger-drawn or stylus signature acceptable?

Yes, for FDA-regulated trials. The FDA's October 2024 question-and-answer document treats a signature drawn with a finger or an electronic stylus as a handwritten signature executed to an electronic record. The signature still must be linked to the specific document version and time-stamped.

Does identity have to be verified for every remote consent?

For FDA-regulated trials, whenever the signing is not personally witnessed by study staff, yes. The system must include a method to confirm the signer is the participant or the legally authorized representative. The method should be pre-specified in the protocol or standard operating procedure and documented each time it is applied.

Can a nurse or physician near the participant obtain consent instead of the study team?

This is not permitted. FDA guidance on decentralized trials states that obtaining consent is not an appropriate activity for a local healthcare provider. The person conducting the consent discussion must be delegated on the study and trained on it.

What must be submitted to the IRB for a remote eConsent process?

Every screen, every video, every quiz, every hyperlinked resource, the process description, the identity verification method, and any translated versions. Any later change requires a new submission and IRB approval before use.

What happens when a participant cannot use the technology?

A paper option, a telephone discussion with mailed materials, or an in-clinic consent should always be available. Both FDA and international guidelines require a non-electronic path so participants without smartphones, reliable internet, or comfort with digital tools are not excluded from studies.

Building a remote consent process the site can defend

A compliant remote eConsent process is not primarily a technology decision. It is a workflow decision, supported by technology, and owned by the investigator. Sites that treat every consent as a documented conversation, backed by identity verification, comprehension confirmation, version control, and a proper consent note, tend to pass inspections cleanly regardless of which platform they use.

The prerequisite to a good consent discussion is a well-prepared participant. DecenTrialz delivers referrals that have already been screened by a registered nurse against protocol criteria and prepared with study context, so the site's coordinator can focus on the substantive consent discussion. Site teams can explore how this fits into their operations at decentrialz.com.