Clinical Research eConsent Retention Policy Requirements: What to Keep and How Long

Record Retention Timeframes

Key U.S. baselines you should plan around

• FDA-regulated drug and biologic studies (under an Investigational New Drug (IND)): retain investigator records, including signed consent and re-consent, for at least two years after the marketing application is approved for the studied indication; if no application is filed or approved, keep for at least two years after study discontinuation and notification to FDA.
• FDA-regulated device studies: retain for at least two years after the later of study completion/termination or when records are no longer needed to support a marketing submission.
• Common Rule/IRB: Institutional Review Board (IRB) records are retained for at least three years after study completion; many institutions extend this to investigator-held consent records.
• HIPAA authorizations: retain the signed HIPAA research authorization (often combined with consent) and any revocation for at least six years from the date last in effect because they involve Protected Health Information (PHI).
• State medical-record retention: Medical-Record Retention Laws often require 7–10+ years for adult records, and for minors until the age of majority plus a specified period. If eConsent is filed in the EHR, these laws generally apply.
• Contracts and sponsor policies: master agreements may require 10–15 years or “until further notice.” When in doubt, keep the longest applicable period.

Defining when the retention clock starts

Document the trigger that starts each clock at the site level. Common triggers include last subject last visit, database lock, IRB closure, site closeout, or regulatory approval/withdrawal milestones. For multi-site trials, each site typically has its own trigger and timeline.

What you must keep for eConsent

• Certified copies of each signed eConsent and HIPAA authorization (all versions), including date/time stamps and signature manifests.
• Version history with IRB approvals, including any short forms, translations, and re-consent notices.
• Audit trails showing presentation, comprehension steps, edits, and signatory actions.
• Identity/authentication evidence (e.g., knowledge-based checks, two-factor events) when used.
• Associated multimedia presented to participants (videos, graphics) or a durable reference proving equivalence.
• System validation evidence for the eConsent platform and relevant SOPs that demonstrate Data Integrity.

HIPAA Compliance for eConsent

Authorization vs. consent—why both matter

In many studies, the informed consent and HIPAA authorization are combined, but they serve different purposes. You must retain the authorization documentation related to PHI for at least six years and preserve any revocations. Keep the eConsent record itself for the longest applicable research-retention period.

Security Rule controls for PHI in eConsent

• Access management: unique user IDs, role-based permissions, and timely deprovisioning.
• Auditability: immutable logs for view, edit, export, and signature events, retained for the full period.
• Integrity and confidentiality: encryption in transit and at rest, key management, and verified backups.
• Risk management: documented risk analysis, breach response workflows, and periodic technical evaluations.
• Vendor oversight: Business Associate Agreements (BAAs) with eConsent providers handling PHI.

Participant rights you must operationalize

• Provide participants with copies of what they signed and note how they can revoke the HIPAA authorization for future use/disclosure of Protected Health Information (PHI).
• Log and retain revocations; stop new PHI collection upon revocation unless another legal basis applies, but keep previously collected data to preserve research integrity and required records.

FDA-Regulated Study Requirements

Retention clocks under drug and device regulations

• Drugs/biologics (IND): at least two years after approval for the studied indication, or two years after shipment for investigational use is discontinued when no application is filed/approved.
• Devices: at least two years after the later of study termination/completion or when no longer needed for a marketing submission.

If sponsor or institutional policies require longer, follow the longest period. Document the specific trigger events in your site file.

Validated Electronic Records and Part 11 expectations

• Validation: maintain user requirements, risk-based validation (IQ/OQ/PQ), and change control for the eConsent system.
• Electronic signatures: signatures must be uniquely linked to individuals and to the specific consent record, with controls to prevent repudiation.
• Data Integrity (ALCOA+): records must remain attributable, legible, contemporaneous, original, accurate—plus complete, consistent, enduring, and available for inspection.
• Durability: store certified copies in formats suitable for long-term readability (e.g., PDF/A), alongside machine-readable source data where applicable.

Inspection readiness

• Be able to retrieve any signed consent quickly by participant ID, version, and date/time.
• Show the exact content presented to the participant, including multimedia and comprehension steps.
• Produce the full audit trail and the validation package without vendor dependence.

Electronic Records Management

Build an archive that lasts

• Retention-aware architecture: ensure data, metadata, and audit trails persist as a single, verifiable package for the full period.
• Format strategies: pair human-readable files (PDF/A) with structured exports (e.g., CSV/XML/JSON) and hash manifests to prove integrity.
• Time accuracy: synchronize system clocks and record time zones to avoid ambiguity in signature timing.
• Backups and disaster recovery: test restoration, geo-redundancy, and document Recovery Time/Point Objectives that meet regulatory needs.
• Migrations and decommissioning: plan for vendor changes with validated export/import and preservation of signature validity and context.

Operational controls you should document

• Access models for investigators, IRB, sponsor, and monitors, with read-only archives post-closeout.
• Retention schedules mapped to each applicable law, regulation, and contract, with “longest-of” logic.
• Periodic checks to confirm records are readable, complete, and retrievable within defined SLAs.

Institutional Retention Policies

Align sponsor, site, and IRB requirements

Most institutions set minimums that meet IRB obligations (often three years) and internal risk thresholds (commonly 6–10 years). If eConsent is filed in the EHR, institutional Medical-Record Retention Laws typically govern, which may exceed research-specific rules. Always reconcile sponsor requirements, IRB policy, and state law, then document the single longest retention rule in the protocol and site SOPs.

Practical steps

• Confirm in writing whether eConsent resides in the eISF, EHR, or both, and which retention regime applies.
• Capture the approved consent version list from the IRB record and link it to each signed instance.
• Train staff on when to re-consent, how to archive superseded versions, and how to respond to records requests.

Data Retention After Subject Withdrawal

What you keep and what you stop

• Retain all data and eConsent records collected up to the point of withdrawal to protect study integrity and meet regulatory duties.
• Stop collecting new data and PHI for research once consent and/or HIPAA authorization is withdrawn, unless another lawful basis applies (e.g., safety follow-up required by the protocol or law).
• Record the withdrawal date, the participant’s preferences (e.g., contact for safety), and any HIPAA revocation separately.

Operational checklist

• Update participant status, disable future data pulls, and remove from contact lists where applicable.
• Retain proof of withdrawal and revocation for at least the same period as the corresponding consent/authorization.

Retention for Pediatric Research

Longer clocks and special documents

• Retain pediatric consent records until the child reaches the age of majority in the jurisdiction, plus the additional years required by research, HIPAA, and institutional policies—apply the longest applicable period.
• Keep parental permission and child assent documents, including re-consents if the participant continues after reaching majority.
• Account for long-term follow-up and Biospecimen Storage commitments that may extend retention or require ongoing contact details.

Documentation tips

• Record the jurisdictional age of majority used and the projected retention end date for each participant.
• If your eConsent is in the EHR, verify pediatric record rules under state Medical-Record Retention Laws and align accordingly.

Conclusion

The safest, simplest approach is to inventory what to keep (signed eConsent packages, authorizations, audit trails, approvals, and validation evidence) and then apply the “longest-of” retention rule across FDA requirements, IRB/Common Rule, HIPAA, state medical-record laws, and contracts. Define clear start triggers, ensure Validated Electronic Records with strong Data Integrity controls, and document everything so you can retrieve it quickly years after closeout.

FAQs.

How long must eConsent forms be retained in clinical research?

Plan for the longest applicable period among FDA rules (often at least two years post-approval or discontinuation), IRB/Common Rule minimums (often three years post-completion), HIPAA authorization retention (six years for PHI documentation), state medical-record laws (commonly 7–10+ years), and any sponsor or institutional requirements.

What are the HIPAA requirements for eConsent retention?

You must retain the HIPAA research authorization (and any revocation) for at least six years from the date it was last in effect. Treat the eConsent record that contains PHI under the same or longer retention if other regulations or policies require it.

Are electronic eConsent records subject to validation standards?

Yes. The eConsent system should be validated, maintain immutable audit trails, and ensure electronic signatures are uniquely linked to signers and records. Records must remain accurate, complete, and readable for the full retention period.

Can data from withdrawn subjects be removed from study records?

Generally no. You retain and may use data collected up to the point of withdrawal to preserve research integrity and meet regulatory obligations. After withdrawal of consent and/or HIPAA authorization, you halt new data collection unless another lawful basis applies.

What retention policies apply to pediatric clinical research records?

Keep pediatric consent, assent, and related records until the participant reaches the age of majority plus any additional years required by FDA, IRB/Common Rule, HIPAA, state medical-record laws, and sponsor policies. Always follow the longest applicable timeframe.