IRB and HIPAA rules for patient outreach

Who is allowed to contact a patient about a study?

The shortest path runs through the patient's own clinician. HIPAA lets a covered entity use protected health information (PHI) for treatment without authorization under 45 CFR 164.506.^⁠[3] Treatment communications, including recommending alternative treatments, are not marketing unless a third party pays the covered entity to make them.^⁠[4] A treating physician who raises a trial with their own patients works inside that relationship.

A non-treating research team is in a different position. HIPAA defines research as a systematic investigation designed to develop or contribute to generalizable knowledge,^⁠[4] and recruiting for a specific study is generally treated as research, not care. That needs a valid authorization or another Privacy Rule permission, usually a research path in 45 CFR 164.512(i).^⁠[2],[1]

Where you can, route first contact through the treating clinician, even when the research team handles follow-up.

Which HIPAA provisions let a research team find and contact patients?

Most outreach plans combine two or more of these four provisions.

• Reviews preparatory to research, 45 CFR 164.512(i)(1)(ii). The researcher represents that the review is solely to prepare a protocol or for similar purposes, that no PHI will leave the covered entity, and that the PHI is necessary.^⁠[1] It supports chart review for feasibility and pre-screening, not an outside party taking a patient list off-site to start calling. See preparatory to research.
• Waiver of authorization, in whole or in part, 45 CFR 164.512(i)(1)(i). An IRB or privacy board can waive authorization for a defined step, such as identifying and contacting candidates. It must document no more than minimal privacy risk, plans to protect and destroy identifiers, and that the research would be impracticable both without the waiver and without the PHI.^⁠[1] Request this partial waiver when the research team, not the treating clinician, makes first contact.
• Authorization, 45 CFR 164.508. The patient's signed permission. For research it can be combined with the study's consent form.^⁠[2]
• Business associate agreement, 45 CFR 160.103 and 164.502(e). A vendor that screens records or contacts patients for the site is a business associate and needs a written agreement before it receives PHI.^⁠[6],[5] Minimum necessary limits still apply.^⁠[5]

What does the IRB need to review before outreach starts?

FDA treats advertising for study subjects as the start of the informed consent and subject selection process, and expects the IRB to review both recruitment content and its mode of communication.^⁠[9] ICH E6(R3) says the investigator should hold documented IRB approval of recruitment procedures before the trial starts.^⁠[11] If Bond sets up Meta or Google ads for a study, the ad copy and landing page need IRB review like any other recruitment material.^⁠[9],[31]

The IRB must also find that subject selection is equitable and, where appropriate, that privacy is protected (21 CFR 56.111). Which patients an algorithm flags for contact is an equitable-selection question.^⁠[10] NIH's Office of Human Subjects Research Protections says pre-screening must be described in the protocol and screening tools reviewed by the IRB.^⁠[12]

What to put in the submission

• Every script and message, by channel and version: call, voice agent, voicemail, SMS, email, portal and letter.
• Which records and criteria identify candidates, and who sees the list.
• The HIPAA basis for each step, with a waiver request wherever the research team makes first contact.
• Pre-screening questions limited to eligibility, and how sensitive answers are handled. FDA says a bare promise of confidentiality is not enough.^⁠[9]
• What happens to screen-out data. NIH's human subjects office says identifiable data collected before consent cannot be kept; other IRBs allow a screen-failure log only with authorization or a waiver.^⁠[12],[13]
• AI disclosure wording, how a patient reaches a human, and how opt-outs are honored.
• No safety or effectiveness claims, no "new treatment" without saying it is investigational, and no emphasis on payment.^⁠[9]

The IRB submission language for AI outreach template drafts the partial waiver request, AI disclosure and opt-out paragraphs.

Can a study team cold-call or text patients?

HIPAA and the IRB decide whether contact is allowed; the TCPA and carrier rules govern automated calls and texts.

• AI voices count as artificial voices. The FCC ruled so in February 2024.^⁠[14] The rule turns on method, not topic: an autodialed or artificial-voice call to a mobile number needs prior express consent even when it is not marketing.^⁠[15]
• The healthcare exemption does not list recruitment. Without prior consent, providers may call or text a patient's mobile number only for listed purposes such as appointment reminders and lab results, at most one message a day and three a week, each with an opt-out.^⁠[15]
• Opt-outs are broad and fast. Patients can revoke consent by any reasonable means, and callers must honor revocation within 10 business days.^⁠[16],[15] As of September 2026, the FCC has delayed to January 31, 2027 the rule that treats one opt-out as revoking consent for all unrelated automated messages.^⁠[17]
• Calling hours. Telephone solicitations are barred before 8 a.m. and after 9 p.m. at the patient's location.^⁠[15] Recruitment calls are generally not solicitations, but the window is a sensible default. In one three-health-system trial, opt-outs appeared higher for calls placed from 7 to 9 p.m.^⁠[21]
• Texting has carrier rules too. Carriers expect opt-in and a STOP opt-out, with plain-language opt-outs honored.^⁠[19] Texts from a 10-digit number need 10DLC brand and campaign registration.^⁠[20]
• Federal AI disclosure is still a proposal. The FCC proposed it in August 2024.^⁠[18] As of September 2026, no such requirement appears in 47 CFR 64.1200.^⁠[15]

Which state AI disclosure laws apply to voice and text agents?

Each law defines whom it covers, such as health facilities, licensed professionals or AI operators. Whether a recruitment call is in scope is a question for counsel.

Write one disclosure to the strictest rule: open every call and message by saying an automated assistant is working for the site, offer a person, and repeat it at the end of calls. Avoid agent names or titles that suggest a nurse or physician. The patient outreach SMS templates include a first text that discloses AI use.

Which rule applies in each outreach scenario?

For where pre-screening ends and consent begins, see pre-screening vs screening.

What should the study file show, and how do you measure it?

If a monitor or IRB asks how a patient was contacted, the file should answer in one place.

• IRB approvals for every recruitment document and script version.
• Waiver documentation with the findings required by 45 CFR 164.512(i)(2), or the preparatory-to-research representations.^⁠[1]
• A BAA with every vendor that touches PHI.
• A contact log: who, when, which channel, which script version, and the outcome.
• An opt-out log with the date each request arrived and was honored.
• Pre-screening and screening logs, which ICH E6(R3) counts among essential records.^⁠[11]
• Evidence that screen-out data was destroyed or kept under an approved basis.^⁠[12],[13]

What to measure each month

• Share of contacts with a documented HIPAA basis and approved script (target: every one).
• Business days from each opt-out request to suppression, against the 10 business day limit.^⁠[16]
• Opt-out rate by channel and hour of contact.
• Complaints, and any contact outside approved hours, scripts or channels.

Bond includes an audit trail and a dashboard that reports patients contacted and pre-screened; security describes how that data is protected.^⁠[30]

What should I do this week?

1. 1

   List every outreach channel

   For each active study, note who contacts patients, how, and on which HIPAA basis.

2. 2

   Compare scripts with approvals

   Compare live texts, calls and voicemail word for word with the IRB-approved versions.

3. 3

   Check consent for calls and texts

   Confirm whether intake-form consent covers research calls and texts; ask counsel if unclear.

4. 4

   Add AI disclosure and a human option

   Every automated script should say it is automated, name the site, and offer a person.

5. 5

   Start the opt-out clock

   Log each opt-out with its date and suppress the number well inside the 10 business day limit.^⁠[16]