IRB submission language for AI-assisted outreach

What is this template for?

Most sites already have an approved recruitment plan for coordinators who review charts and make calls. Adding AI changes two things the IRB will ask about: software now reads the records, and an automated assistant may make first contact. This template gives you draft language for both, plus the data handling and consent paragraphs that usually follow. For the rules behind it, read the guide to IRB and HIPAA rules for patient outreach.

FDA treats recruitment advertising as the start of the informed consent and subject selection process, and expects the IRB to review both what the material says and how it is communicated.^⁠[9] A call or text thread run by software is also a mode of communication, so expect the IRB to review its script like any other recruitment material.

How do you use this template?

1. 1

   Check which rules apply

   FDA-regulated studies follow 21 CFR 50 and 56. Federally funded research, and institutions that apply the Common Rule to all studies, follow 45 CFR 46. HIPAA governs the records whenever a covered entity, such as a hospital or medical practice, holds them. Keep the paragraphs that match your study and delete the rest.

2. 2

   Choose one HIPAA path for the records review

   Paragraph A.2 offers a review preparatory to research or a partial waiver of authorization. Your privacy officer or privacy board decides which fits, and what covers the first contact with each patient.

3. 3

   Replace every bracket

   Fill in site, study, vendor and contact details. Where the template offers choices separated by a slash, keep one and delete the others.

4. 4

   Attach the scripts

   Submit the full voice script and every text message as recruitment materials, with version numbers. The paragraphs describe the process. The scripts are what patients hear and read. The pre-screening call script and SMS templates are starting points.

5. 5

   Match your IRB's form

   Most IRBs use a fixed protocol template or an electronic form. Paste each paragraph into the matching field instead of submitting this page as a separate document.

What language describes AI-assisted EHR pre-screening?

A.1 Identification of potential participants

Potential participants will be identified by review of electronic health records (EHR) at [site name]. [Vendor name], acting as a business associate of [covered entity] under a business associate agreement, will use software that includes large language models to compare structured data (such as diagnoses, medications and laboratory results) and clinical notes against the inclusion and exclusion criteria in [protocol section]. For each patient, the software lists the criteria it assessed and the record evidence it relied on. The software does not decide eligibility. [Role, e.g., the study coordinator], listed as study staff on this protocol, reviews each flagged record and decides whether the patient may be contacted. The review is limited to patients [seen at (clinics) between (date) and (date) / with (diagnosis or visit criteria)], and only the data elements needed to assess the study criteria will be used.

A.2 HIPAA basis for the records review

Option 1, review preparatory to research. The review will be conducted under 45 CFR 164.512(i)(1)(ii). The investigator represents that use of protected health information (PHI) is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research (here, identifying potential participants); that no PHI will be removed from [covered entity] in the course of the review; and that the PHI reviewed is necessary for the research purposes.^⁠[1] [Vendor name] processes the records on behalf of [covered entity] under its business associate agreement. [Confirm with your privacy officer that this arrangement meets the no-removal representation. This provision covers the review itself, so describe separately what basis covers contacting patients.]

Option 2, partial waiver of authorization. We request a partial waiver of HIPAA authorization under 45 CFR 164.512(i)(1)(i), limited to identifying potential participants and using their name and contact information to contact them about this study. Authorization for study participation will be obtained together with informed consent, as 45 CFR 164.508(b)(3) permits.^⁠[2] The waiver meets the criteria in 45 CFR 164.512(i)(2)(ii).^⁠[1] (1) The use involves no more than minimal risk to privacy: identifiers are held in access-controlled systems, used only by study staff and [vendor name] under a business associate agreement, and destroyed [timepoint], and PHI will not be reused or disclosed to any other person or entity except as required by law, for authorized oversight of this research, or for other research for which the Privacy Rule would permit the use or disclosure. (2) The research could not practicably be conducted without the waiver, because [asking each patient for authorization before knowing whether they may be eligible is not practicable]. (3) The research could not practicably be conducted without access to the PHI, because [eligibility depends on diagnoses, medications and results that exist only in the medical record].

A.3 Consent for pre-screening

Common Rule studies. We ask the IRB to approve obtaining information for screening, recruiting or determining eligibility without informed consent under 45 CFR 46.116(g). Study staff, and [vendor name] acting for [covered entity] as described in A.1 and Part B, will access existing records and communicate with prospective participants [by phone and text message] for these purposes only.^⁠[5]

FDA-regulated studies. The records review captures only the information needed to judge potential eligibility and to contact the patient. FDA guidance treats this kind of preliminary records review as preparation for a clinical investigation that does not require informed consent under FDA regulations.^⁠[11] The pre-screening questions in Appendix [X] ask only for information that is not in the record and is needed to judge potential eligibility, such as [examples]. [Describe how agreement or consent is obtained before these questions are asked, as your IRB requires. FDA guidance says consent may be required before collecting information the record does not contain.]^⁠[11] Any procedure performed solely to determine eligibility, including medication washout, will take place only after informed consent.^⁠[10]

Equitable selection. The criteria configured in the software are taken from [protocol section] and were reviewed by [PI name] before use. The study team will review [a sample of records the software did not flag / reasons patients screened out] [frequency] to check that the software is not systematically excluding eligible patients. Changes to the configured criteria will be submitted to the IRB [as an amendment / as IRB policy requires].^⁠[7]

What language describes AI voice and SMS outreach?

B.1 Who makes contact and how

Potential participants approved for contact by the study team will be contacted by [phone call / text message / both] from [site name]. Contact will be made by an automated assistant that uses artificial intelligence (AI) to hold a spoken or text conversation, operated by [vendor name] on behalf of [site name]. Required statements (the AI disclosure, the study description, the voluntariness statement, the recording notice and the opt-out instructions) are delivered as written in the IRB-approved script in Appendix [X]. The assistant asks only the pre-screening questions listed in that script and answers logistics questions only from the IRB-approved study information sheet. Questions about medical care, risks, or whether to take part are referred to study staff. [If a letter or portal message from the treating clinician comes first, describe it here and attach it.]

B.2 Disclosure that the caller is AI

At the start of every call and every text message, the assistant states that it is an automated assistant using AI, calling or writing on behalf of [site name] and [PI name]'s research team, and explains how to reach a staff member. Voice calls repeat the disclosure at the end. Before giving any study details on a call, the assistant confirms it is speaking with the intended person [by (verification method)]. Voicemails give only the patient's first name, the site name, the AI disclosure and a callback number, and texts do not name a sensitive condition. The assistant does not claim to be a person and does not describe itself as a nurse, doctor or other licensed professional.

Appendix [X]: required statements, sample wording

B.3 Escalation to study staff

The assistant hands the conversation to study staff, or books a staff callback, when the person asks for a human, asks a question outside the approved script, reports a medical problem, seems distressed, or gives an answer the protocol flags for staff review. If a person describes an emergency, the assistant tells them to call 911 [or the local emergency number] and alerts [role] at once. Study staff review each escalation [timeframe] during business hours and record the outcome.

B.4 Opting out and contact limits

Every text message explains how to opt out by replying STOP. A person may also opt out by any reasonable means, including saying so on a call, replying to a text in their own words, or telling any staff member. Opt-out requests are recorded and honored within [timeframe, not to exceed ten business days], and the person is not contacted again about this study [or about other studies, if site policy requires].^⁠[14] A person will be contacted no more than [number] times by [channel] over [period], and only between [start time] and [end time] in their local time zone.

B.5 Recording and transcripts

[Choose one.] Calls are recorded and transcribed. / Calls are transcribed but not recorded. / Calls are not recorded, and only the answers to the pre-screening questions are stored. [If recorded or transcribed:] The person is told at the start of the call. Recordings and transcripts are stored in [system], can be accessed only by [roles], and are deleted [timepoint]. They are used only to document the pre-screening conversation, to review escalations and to check the assistant's performance.

B.6 Content of messages

Scripts and messages state that the study is research, name the condition under study, summarize the main eligibility criteria and the time commitment, and give contact details. They do not state or imply that the study drug or device is safe or effective, do not call it a new treatment without saying it is investigational, and do not emphasize payment.^⁠[9]

What language describes data security and pre-screening data?

C.1 Data handling

[Vendor name] is a business associate of [covered entity] and handles PHI only under a signed business associate agreement.^⁠[4] Data is encrypted in transit and at rest [standard, e.g., AES-256]. Access is limited by role to [roles] and requires [single sign-on / multi-factor authentication]. The system keeps an audit log of who viewed or changed each record. Staff and software use and request only the minimum PHI needed for each step.^⁠[3]

AI model processing. [Describe where the AI models run, whether PHI leaves (vendor name)'s environment, and whether any model provider may retain or train on the data. Ask your vendor for this in writing before you submit.]

C.2 Pre-screening data

Answers to pre-screening questions are stored in [system] and used only to decide whether to invite the person to a screening visit. For people who do not qualify or who decline, identifiable pre-screening information is [destroyed (timeframe) / kept in a screening log limited to (data elements) under (HIPAA authorization / the waiver approved for this study)]. Counts of people contacted, pre-screened and referred, without identifiers, are kept for recruitment reporting.

C.3 Oversight of delegated recruitment

The investigator remains responsible for recruitment activities delegated to [vendor name].^⁠[13] Before use, the configured eligibility criteria are tested on a sample of records and reviewed by [PI or coordinator]. The script, and any change to it, is approved by the IRB before use. [Vendor name] provides a contact log showing each contact, its date, channel, script version and outcome, which the study team reviews [frequency].

What language describes AI support during informed consent?

D.1 Role of the AI assistant in consent

After a person agrees to learn more, they may use an AI assistant to read a plain-language explanation of the IRB-approved consent form and ask questions about it. The assistant answers only from the approved consent form and [study information sheet]. It does not obtain consent and does not advise the person whether to take part. It refers any question it cannot answer from those documents, and any question about the person's own medical care, to study staff. Informed consent is obtained by the investigator or study staff delegated by the investigator, who review the form with the person, answer remaining questions and document consent as described in [protocol section].^⁠[13]

D.2 Voluntariness

Using the assistant is optional. The person may stop at any time and talk with staff instead, and using it does not shorten the time the person has to consider the study. Consent is sought only under circumstances that give the person enough time to decide and that minimize the possibility of coercion or undue influence, in language the person can understand.^⁠[8]

What needs IRB approval before outreach starts?

Under 21 CFR 56.109, the IRB reviews the research activities it covers and can approve them, require changes or disapprove them.^⁠[6] ICH E6(R3) says the investigator should hold documented IRB approval of participant recruitment procedures, such as advertisements, before a trial starts.^⁠[13] FDA also expects the IRB to check that phone screening procedures protect the people being screened and handle sensitive information appropriately, and says a general promise that confidentiality will be maintained is not enough.^⁠[9]

• The recruitment plan paragraphs from Parts A to D, edited for your study
• The full voice script, including the disclosure, escalation and closing statements, with a version number
• Every text message, word for word, including the reply to STOP, and the voicemail message
• The HIPAA basis for the records review and for first contact, with the waiver request if you chose Option 2
• The pre-screening questions, and what happens to answers from people who screen out
• The consent support description and its source documents, if Part D applies
• Translated versions of any script, reviewed like the English one
• The vendor's security summary or BAA reference, if your IRB or privacy office asks for it

How does Bond relate to this template?

Bond Health's software handles the activities this template describes. Identify screens EHR records against a study's inclusion and exclusion criteria and shows the record evidence for each criterion. Engage runs voice and SMS outreach and pre-screening. Consent supports the consent conversation with plain-language explanations and patient Q&A. Patients are told that AI assistance is used and can reach a person at any time through a live transfer to a coordinator or a human callback, whichever the site prefers, scripts are configured for each site and study, and conversations escalate to coordinators.^⁠[19],[20]

For C.1, Bond is HIPAA compliant and SOC 2 Type I compliant, and its SOC 2 Type II and ISO 27001 audits are underway.^⁠[20] Bond signs BAAs, encrypts data at rest and in transit, supports role-based access and SSO, and keeps an audit log. The security page has the details. Ask for the AI model processing details in writing, as you would from any vendor. Bond does not hold IRB approval for any study and does not obtain consent: your IRB reviews your submission, and your investigator or delegated staff obtain consent.^⁠[19]