Some clinical research protocols require investigators to stay in contact with participants for years, or in the case of certain gene therapy trials, for as long as fifteen years after treatment. Over that span, participants move, change phone numbers and email addresses, marry and change names, or otherwise become unreachable through the contact information collected at enrollment. When a site’s own outreach — repeat calls, letters, emails, and contact with the participant’s listed emergency contacts — fails to re-establish contact, sponsors and sites sometimes turn to third-party person-locating (or “skip-tracing”) services: commercial vendors who use public records, credit-header data, the U.S. Postal Service’s National Change of Address (NCOA) database, and similar sources to generate an updated address or phone number for a named individual.
This guide covers when that practice comes up in long-term follow-up (LTFU), the regulatory and privacy considerations it raises under the Common Rule, FDA regulations, and HIPAA, and the practical steps a study team and IRB typically need to work through before a locating vendor is engaged.
Why LTFU Creates a Locating Problem That Ordinary Trial Follow-Up Doesn’t
Most interventional trials run for months to a few years, with participants actively engaged and returning for scheduled visits. LTFU is different: it exists specifically to capture delayed adverse events — effects that may not appear until long after the participant’s active involvement in the parent study has ended, and often after they’ve stopped thinking of themselves as a research participant at all. The longer the follow-up window, the more participant contact information degrades through ordinary life events: relocation, remarriage, a new employer’s email domain, a disconnected phone number, or death (which itself is safety-relevant data the study needs to capture, not just an end to follow-up).
Gene and cell therapy is the clearest driver of this problem because FDA’s own LTFU expectations for that product class are unusually long. FDA’s final guidance, Long Term Follow-Up After Administration of Human Gene Therapy Products (January 2020, superseding a 2006 guidance on observing subjects for delayed adverse events), sets out a risk-based framework rather than one fixed duration. Follow-up length is tied to the vector’s biological behavior: products using vectors capable of integrating into the host genome — retroviral and lentiviral vectors, and gene-editing products — carry a risk of insertional mutagenesis and delayed oncogenic effects, and FDA’s framework points sponsors toward LTFU periods of up to 15 years. Non-integrating vectors, such as most adeno-associated virus (AAV) vector products, carry lower theoretical risk and are typically associated with LTFU periods of up to five years. See CASRAI’s guide to the gene therapy BLA, CBER, and RMAT pathway for how this LTFU expectation fits into the broader gene therapy regulatory picture.
A 15-year (or even 5-year) commitment routinely outlasts a participant’s relationship with the treating institution, the study’s original funding cycle, and sometimes the sponsor’s original name if there’s been an acquisition. Retention planning has to assume some fraction of the enrolled cohort will become unreachable through ordinary means well before the follow-up period ends — which is the gap third-party locating services are used to close.
What a Person-Locating Service Actually Does
These are commercial data-aggregation vendors, distinct from clinical trial recruitment or patient-registry vendors (see CASRAI’s guide to clinical trial recruitment companies for that adjacent but different vendor category). Given a name plus one or more identifiers — a last known address, phone number, date of birth, or the last four digits of a Social Security number — a locating vendor searches public and semi-public records (property records, court records, utility connections, credit-header data, NCOA change-of-address filings, and similar sources) and returns candidate current contact information. Some also offer a batch “identity verification” step to confirm a match before a study team re-initiates contact.
The service itself does not contact the participant. It returns updated contact information to the study team or sponsor, who then re-attempts outreach using the site’s own consented communication channels and script, typically under the same IRB-approved contact procedures used for routine follow-up.
IRB and Consent Considerations
Because using a third-party locating vendor means disclosing identifiable information about a research participant to an outside party, it is a use of identifiable information under the Common Rule (45 CFR 46) and typically needs to be addressed explicitly, not assumed as an implied extension of routine follow-up:
- Informed consent language. The consent form participants sign at enrollment should disclose, in advance, that the study team may use a third-party service to locate them if contact is lost during the follow-up period — not introduce this after the fact. IRBs reviewing LTFU protocols for integrating-vector or long-duration gene therapy products increasingly expect this disclosure as a standard element, given how routine loss-to-follow-up becomes over a 15-year window. See CASRAI’s informed consent entry for the general elements a consent form needs to cover.
- Protocol and IRB submission detail. The protocol (and any amendment, if the practice is added after initial approval) should name the category of vendor being used, the categories of data sent to it, the data sent back, and how long any locating-vendor-derived data is retained if the participant is never successfully re-contacted. An IRB will generally want to see this as an explicit protocol section rather than infer it from a generic “we will make reasonable efforts to maintain contact” statement.
- Minimum necessary information. Only the identifiers actually needed to run the search should be sent to the vendor — not the participant’s full study record, diagnosis, or treatment history. Locating a person and following up on their clinical status are two separate data flows and should be kept that way in the vendor relationship.
- What happens if the vendor can’t find them. Protocols should specify how a documented, exhausted locating attempt is recorded (a ‘lost to follow-up’ determination) and, where the FDA guidance framework applies, how that’s reflected in the LTFU safety reporting to the sponsor and FDA, rather than left as an open loop.
HIPAA and Privacy Considerations
Where the entity running the study is a HIPAA covered entity (or the data involved is protected health information handled on a covered entity’s behalf), engaging a locating vendor raises a separate privacy question from the Common Rule consent question above. Sending identifiable participant information to an outside vendor to obtain updated contact details is a disclosure of information about the individual, and the relationship needs to be structured correctly under the HIPAA Privacy Rule:
- If the vendor is acting on the covered entity’s behalf and handling protected health information (PHI) to perform the locating service, that relationship generally needs to be governed by a Business Associate Agreement (BAA) under HIPAA, the same as any other vendor that touches PHI on a covered entity’s behalf.
- Many locating services are structured to work from a minimal, de-identified-where-possible data set — name plus non-clinical identifiers — specifically to avoid transmitting clinical information the vendor doesn’t need to do its job. Study teams should confirm what the vendor actually requires as input before sending more than that.
- See CASRAI’s HIPAA in clinical research entry and HIPAA Privacy Rule entry for how research use and disclosure of PHI is authorized more broadly.
Practical Steps for a Study Team Setting Up an LTFU Locating Process
- Build the disclosure into consent from the start. Adding locating-vendor language after enrollment means an amendment and re-consent process for the whole active cohort; it is far simpler to include it in the original informed consent document for any protocol with a multi-year LTFU commitment.
- Set an internal escalation ladder before reaching for a vendor. Most sites exhaust their own outreach — documented calls, emails, letters, and contact with the participant’s designated alternate contacts — before engaging a locating service, and IRBs generally expect to see that sequence, not a vendor used as the first step.
- Define the data-sharing boundary in the vendor contract, not just informally. Specify exactly which identifiers go to the vendor, what comes back, retention/destruction timelines for any data the vendor holds, and (where applicable) the BAA terms.
- Document every attempt, successful or not. A defensible ‘lost to follow-up’ determination for LTFU safety reporting depends on a documented record of what was tried and when — site-level outreach and vendor-assisted outreach alike.
- Coordinate with the sponsor’s safety and regulatory teams early. For gene therapy LTFU specifically, the sponsor is the one accountable for FDA reporting on the study’s overall follow-up completeness, so a site’s locating practices and documentation standards should be agreed with the sponsor up front, not developed independently at each site.
Frequently Asked Questions
Is using a third-party locating service for research participants legal?
There is no blanket regulatory prohibition on using a commercial locating service to re-establish contact with a research participant, but it is not a use that can be assumed to be covered by generic consent language. It needs to be disclosed to participants in the consent process, reviewed and approved by the IRB as part of the protocol, and, where PHI is involved, structured correctly under HIPAA (typically via a Business Associate Agreement with the vendor).
Why does gene therapy follow-up specifically drive the need for locating services?
Because FDA’s long-term follow-up guidance for human gene therapy products sets risk-based follow-up periods of up to five years for non-integrating vectors and up to fifteen years for integrating vectors and gene-editing products — spans long enough that a meaningful share of any enrolled cohort will change address, phone number, or name before follow-up ends, well beyond what site-level outreach alone can reliably track.
What information should be sent to a locating vendor?
Only what the vendor needs to run the search — typically name plus one or two non-clinical identifiers such as last known address or date of birth — not the participant’s clinical or study record. Locating a person and collecting their follow-up clinical data are separate steps and should involve separate, appropriately scoped data flows.
Does using a locating vendor require an IRB amendment for an already-approved protocol?
If the original protocol and consent form didn’t disclose the possibility of using a third-party locating service, adding the practice generally requires an IRB amendment, and may require re-consenting participants already enrolled, depending on the IRB’s determination. This is one reason experienced LTFU protocol authors build the disclosure in from the start rather than adding it later.
