Section XI:

Informed Consent

WPP #: XI-4

Title 4:

Consideration of Research Involving Third Parties as Human Subjects

Effective Date:


Revision History:


Policy Statement

The IRB ascertains the presence of third party research and considers whether informed consent, or waiver from informed consent, is appropriate.

Description and Procedures

The term 'third party research' refers to the obtaining of private, identifiable information from an enrolled research participant about another person(s) who is not enrolled in the study. As a general rule, obtaining such information is not permitted without obtaining informed consent or waiver of informed consent for the third party. The investigator and IRB should consider whether the research involves third (3rd) party research which includes collection of both identifiable AND private information. If it does, consider whether the research can be modified to exclude third parties as human subjects, and if not, consider the type of information being collected about the third parties. Keep in mind that if built in data protections render the primary subject unidentifiable, there should be no identifiable third party.


  • Third (3rd) party: Anyone other than the enrolled research subject who meets the definition of a 'human subject' in the regulations may be considered a third party.
    As per 45 CFR 46.102(f), a human subject is:
    A living individual about whom an investigator…conducting research obtains …identifiable private information.
  • Identifiable information is information about individuals whose identities are readily known. Information obtained that references 'mother, father, brother, etc' describes familial relationships and is usually not considered identifiable, especially if the subject's data is maintained in an unidentifiable fashion. Obtaining a family member's name and/or contact information makes the information explicitly identifiable and subject to third party research consideration.
  • Private information is information a person can reasonably expect will not be made public, including being shared with researchers without one's informed consent. Private information should generally be viewed as 'sensitive,' which refers to information that may place subjects at risk or harm should the information be breached.
  • Sensitive information may include information about substance abuse, criminal behavior, stigmatized diseases, etc., or that which could be personally embarrassing if revealed. There is no specific definition about what is 'sensitive.' Investigators may offer an opinion concerning whether requested information is sensitive or not. Collection of sensitive data requires rigorous protections by the investigator. The IRB makes the determination on a case by case basis, and considers risk as it relates to the data being collected.
  • Readily identifiable is the criterion used in the Common Rule, and should be distinguished from "possibly" or "potentially" identifiable information, which is significantly different in degree. For example, information about familial or social relationships identified only by that association, i.e., spouse, father, mother, sister, friend, social contact, etc., should not usually be considered readily identifiable information. [NIH – Protection of Third Parties in Research, 2001]
consideration of third party research diagram


Protection of Third Party Information in Research: Recommendations of the National Institutes of Health to the Office for Human Research Protections, 1, December 7, 2001
National Human Research Protections Advisory Committee (NHRPAC) Clarification of the Status of Third Parties When Referenced by Human Subjects in Research