A waiver of informed consent is a formal Institutional Review Board (IRB) determination that a study may enroll subjects, or use their identifiable private information or identifiable biospecimens, without obtaining informed consent at all. It is a distinct regulatory action from a waiver of documentation of informed consent, which only excuses the signed-form requirement while consent itself is still sought — this guide covers the full waiver of the consent process, the mechanism most often invoked for retrospective chart-review studies, registry research, and other secondary-data analyses where re-contacting every prior subject is not practicable. For the operational definition and regulatory text, see the dictionary entry on Waiver of Informed Consent (45 CFR 46.116(f)); this guide focuses on how the waiver actually gets requested, evaluated, and documented, including a 2024 FDA rule change that most existing explanations of this topic do not cover.
The five-part test under 45 CFR 46.116(f) (Common Rule)
For research subject to the Common Rule (45 CFR 46, Subpart A), an IRB may only approve a full waiver or alteration of consent after finding — and documenting in the protocol record — that all five of the following are satisfied:
- Minimal risk. The research involves no more than minimal risk to subjects, using the Common Rule’s definition at 45 CFR 46.102(j): risk not greater than that ordinarily encountered in daily life or during routine physical or psychological examinations.
- Not practicable without the waiver. The research could not practicably be carried out without the waiver or alteration — IRBs generally will not accept investigator convenience or cost savings alone as satisfying this criterion.
- Not practicable without identifiable data, if used. If the research involves identifiable private information or identifiable biospecimens, it could not practicably be carried out without using that information in an identifiable format.
- No adverse effect on rights and welfare. The waiver will not adversely affect the rights and welfare of the subjects.
- Debriefing where appropriate. Whenever appropriate, subjects or their legally authorized representatives will be provided with additional pertinent information after participation.
A study that fails even one criterion — most often criterion one, because the research is more than minimal risk, or criterion two, because prospective consent is genuinely practicable — cannot rely on this pathway and must instead pursue standard informed consent, a documentation waiver under 46.117(c) (consent process required, signature excused), or broad consent obtained in advance for future research use.
FDA-regulated research: the new minimal-risk waiver at 21 CFR 50.22
For decades, research regulated by FDA under 21 CFR Parts 50 and 56 (INDs, IDEs, and other FDA-regulated clinical investigations) had no general equivalent to the Common Rule’s 46.116(f) waiver. FDA’s regulations permitted the IRB to waive only the documentation of consent (21 CFR 56.109(c)(1)) or to apply the narrow emergency-research exception (21 CFR 50.24, discussed below) — there was no provision letting an IRB waive the consent process itself for an ordinary minimal-risk FDA-regulated study, even when an equivalent Common Rule study at the same institution could use 46.116(f).
That gap closed on January 22, 2024, when a new FDA final rule implementing Section 3024 of the 21st Century Cures Act took effect, adding 21 CFR 50.22, “Exception from informed consent requirements for minimal risk clinical investigations.” The new provision requires an IRB to find and document essentially the same five elements as 46.116(f) — minimal risk (using the same definition FDA and HHS have shared since 1991), no adverse effect on subjects’ rights and welfare, necessity of identifiable data or biospecimens where used, impracticability without the waiver, and debriefing where appropriate — and the rule was deliberately drafted to track the Common Rule’s language so the two frameworks now operate on largely parallel logic. The rule also made conforming amendments to 21 CFR 50.20, 312.60, and 812.2. For a multi-site or multi-regulatory study that is both federally funded and FDA-regulated (for example, an NIH-funded IND study), an investigator generally now needs to satisfy both 45 CFR 46.116(f) and 21 CFR 50.22 rather than assuming a Common Rule finding automatically covers the FDA-regulated portion — the two are separately codified and an IRB should document findings under both if both apply.
The narrower FDA emergency exception (21 CFR 50.24 / EFIC)
21 CFR 50.22 should not be confused with the FDA’s much older and much more demanding Exception From Informed Consent (EFIC) provision at 21 CFR 50.24, which exists precisely because a study does not qualify as minimal risk. EFIC applies to prospective, interventional emergency research (for example, testing an experimental drug or device during a life-threatening event where no legally authorized representative can be reached in time) and requires additional safeguards that neither 46.116(f) nor 50.22 impose: community consultation, public disclosure before and after the study, an independent data and safety monitoring board, and FDA concurrence. If a study is more than minimal risk, EFIC — not a general waiver of consent — is the only available pathway to proceed without prospective individual consent, and only in the narrow emergency-research fact pattern the provision was built for.
Waiver of consent vs. related consent mechanisms
This waiver is frequently confused with several adjacent mechanisms that solve different problems. The table below distinguishes them:
| Mechanism | Regulatory basis | What it actually does |
|---|---|---|
| Waiver of informed consent (this guide) | 45 CFR 46.116(f); 21 CFR 50.22 (FDA-regulated, since Jan. 2024) | No consent process at all — the IRB finds consent unnecessary given minimal risk and impracticability. |
| Waiver of documentation of consent | 45 CFR 46.117(c); 21 CFR 56.109(c)(1) | Consent is still obtained (often orally); only the signed-form requirement is excused. |
| Broad consent | 45 CFR 46.116(d) | A single advance consent covering future, unspecified secondary research use of stored identifiable data/biospecimens — it is a form of consent, not a waiver. |
| Exception From Informed Consent (EFIC) | 21 CFR 50.24 | Permits enrollment without consent in life-threatening emergency research that is more than minimal risk, subject to community consultation and other added safeguards. |
| HIPAA waiver of authorization | 45 CFR 164.512(i) | A separate Privacy Rule determination allowing use/disclosure of protected health information without individual authorization — runs alongside, not instead of, the Common Rule/FDA consent analysis. |
The HIPAA row matters in practice more often than researchers expect: a study can have a valid 46.116(f) or 50.22 waiver of consent and still need a separate HIPAA waiver of authorization before accessing protected health information, because the two regulations are independent legal regimes with differently worded criteria. See HIPAA and Retrospective Research and 45 CFR 164.512(i) for how that second analysis works.
Common research scenarios where a full waiver applies
- Retrospective chart review. The exposure, treatment, or outcome under study already occurred; nothing about the subject’s past care changes based on consent obtained now, and requiring prospective consent from every prior patient in a large cohort is frequently impracticable and would bias the sample toward patients who can still be located.
- Secondary analysis of an existing registry, claims database, or biobank collection. Where specimens or records were collected for another purpose (clinical care, a prior study with its own consent) and the new analysis is minimal risk.
- Certain minimal-risk pragmatic or cluster-randomized trials comparing already-accepted standard-of-care interventions at the level of a clinic, unit, or system, where individual consent is impracticable given the study design.
- Behavioral or social-science research involving incomplete disclosure or deception, where full advance disclosure would invalidate the research question — this is one of the more common contexts where the debriefing criterion becomes central to the IRB’s approval.
A waiver is generally not available for research that is more than minimal risk simply because obtaining consent would be logistically difficult or expensive — see Quality Improvement vs. Human Subjects Research for the separate, upstream question of whether a chart-review-style activity is human subjects research requiring IRB review at all.
Building the waiver request: what an IRB actually needs to see
Investigators requesting a waiver under 46.116(f) or 50.22 typically need to address each of the following directly in the protocol or a dedicated waiver-request form, not simply assert that the waiver applies:
- The minimal-risk basis. Explain specifically why the study’s procedures — not just the underlying disease or population — present no more than minimal risk, addressing both physical and informational/privacy risk.
- The impracticability argument. State concretely why consent cannot practicably be obtained: cohort size, the age of the records, an inability to locate or contact a meaningful fraction of subjects, or a study design (e.g., a cluster-randomized comparison of standard practices) that structurally cannot accommodate individual consent. Cost and investigator convenience alone are not sufficient.
- Why identifiable data or biospecimens are necessary, if used — for example, the need to link records across visits, providers, or time, which a de-identified or coded dataset could not support.
- The privacy and confidentiality safeguards that substitute for the protections consent would otherwise provide (data security, access restrictions, a data use agreement where applicable).
- A debriefing plan, or a documented rationale for why none is appropriate — particularly for deception-involving behavioral research, and less often necessary for records-only retrospective studies where there is no ongoing subject contact.
- The corresponding HIPAA analysis, addressed separately, if protected health information is involved.
The IRB’s approval documentation (minutes or approval letter) should record its finding on each of the five statutory criteria individually, not just a general statement that “the waiver is granted” — this is what supports the determination during an audit or OHRP/FDA compliance review.
Why IRBs reject waiver requests
- The research is more than minimal risk given the specific procedures or population involved, even if the underlying data source (e.g., existing records) seems low-risk in isolation.
- The impracticability argument is framed around cost, staff time, or investigator convenience rather than a genuine inability to obtain consent.
- A less burdensome alternative that still involves some form of consent — an opt-out notification, a broad-consent mechanism already in place at the institution, or documentation-only waiver — would work and is not clearly ruled out.
- The request does not separately address the HIPAA waiver-of-authorization criteria where protected health information is involved, leaving a gap between the Common Rule/FDA finding and the Privacy Rule requirement.
- No debriefing plan is offered for research (typically involving deception or incomplete disclosure) where one would ordinarily be appropriate.
Frequently asked questions
Who decides whether a waiver of consent applies — the PI, the sponsor, or the IRB?
Only the IRB (or, for FDA-regulated research, the reviewing IRB applying 21 CFR 50.22/50.24) can make and document the waiver determination. A principal investigator or sponsor can request it and must supply the supporting justification, but cannot self-certify a waiver.
Does a waiver of consent apply to biospecimens as well as data?
Yes. 45 CFR 46.116(f) and 21 CFR 50.22 both cover the use of identifiable biospecimens on the same five-criteria basis as identifiable private information — a study using stored, identifiable tissue samples for a new minimal-risk analysis can qualify on the same terms as a records-only study.
Can a full waiver of consent be used for an interventional clinical trial?
Rarely, and only where the intervention itself is genuinely minimal risk, such as a pragmatic comparison of already-standard-of-care practices. Most interventional drug or device trials involve more than minimal risk and cannot use 46.116(f) or 50.22; a trial that is both interventional and more than minimal risk can only proceed without prospective consent under the much narrower emergency-research exception (21 CFR 50.24/45 CFR 46.101(i)), and only in a genuine life-threatening emergency fact pattern.
Does the waiver need to be renewed?
The IRB’s waiver finding is part of the study’s approved protocol and stays in effect for that approved scope of research; if the study undergoes continuing or periodic review, or a protocol amendment changes the population, data elements, or risk profile, the IRB should reaffirm that all five criteria still hold under the revised protocol.
Is a waiver of consent the same as a research activity being exempt from IRB review?
No. A waiver of consent is a determination made during IRB review of a study that otherwise requires it; an exemption is a separate, upstream determination that a category of minimal-risk research is not subject to the Common Rule’s full review requirements at all. Some exempt-category determinations do not require consent by definition, but “exempt” and “consent waived” are not interchangeable terms and get used loosely in practice.
For related consent-process content, see Informed Consent in Research: What It Requires and How It Works, The Components of Informed Consent, and When Should Informed Consent Be Obtained?. For the broader compliance landscape this sits within, see the Integrity & Compliance pillar.
