Ethical and Regulatory Considerations for Using Social Media Platforms to Locate and Track Research Participants

Abstract

As social media becomes increasingly popular, human subjects researchers are able to use these platforms to locate, track, and communicate with study participants, thereby increasing participant retention and the generalizability and validity of research. The use of social media; however, raises novel ethical and regulatory issues that have received limited attention in the literature and federal regulations. We review research ethics and regulations and outline the implications for maintaining participant privacy, respecting participant autonomy, and promoting researcher transparency when using social media to locate and track participants. We offer a rubric that can be used in future studies to determine ethical and regulation-consistent use of social media platforms and illustrate the rubric using our study team’s experience with Facebook. We also offer recommendations for both researchers and institutional review boards that emphasize the importance of well-described procedures for social media use as part of informed consent.

Introduction

Decreasing participant loss to follow-up is a vital element of longitudinal research study design. Participants who have limited access to resources, have transient lifestyles, or experience homelessness are often difficult to reach for follow-up interviews. They are lost at higher rates than more stable participants, resulting in attrition bias threatening both the internal and external validity of the research (Barry 2005). Historically, methods for locating and tracking research participants have emphasized the engagement of participants and collaterals (persons who may know how to contact or find the participant) through the use of telephone and postal or electronic mail (Scott 2004). Major technological and internet-based advances have led to increasing use of social media platforms, such as Facebook, for research purposes, including contacting and keeping in touch with participants over time.

To date, there is little regulatory guidance to help researchers and institutional review boards (IRBs) determine the most appropriate use of social media in their studies. To fill this gap, we first review the unique considerations for using social media to locate and track participants with in the context of research ethics and existing regulations. We then offer and illustrate the use of a rubric to help researchers identify ethical and regulation-consistent use of social media platforms and their functions developed from our experience using Facebook to locate and track participants in a national multisite clinical trial. We conclude with a set of recommendations for both researchers and IRBs as they develop and review study protocols for utilizing social media to locate and track participants. Given that each study will have idiosyncratic needs and intended uses of social media, our recommendations emphasize the importance of well-articulated informed consent procedures to ensure participants are able to weigh the potential risks associated with these uses in light of the study benefits and researchers’ plans to mitigate risks.

Using Social Media to Locate and Track Participants

Social media, defined as an internet-based platform for communication with other users, has become increasingly prevalent over the last decade. Sixty-nine percent of Americans use some form of social media and 99% of those who use social media are using Facebook (Pew Research Center 2017b). Social media allows users to create a profile through which they can post personal information, including contact information, and connect with friends, family, or other entities (e.g., businesses). Users have the option of posting personal information to be publicly viewable, or can limit access to a select group of fellow users. With the advent of smartphones, which can access both the internet and cellular services, social media users are able to access social media accounts wherever they go. Seventy-seven percent of Americans own smartphones, expanding the reach of social media and allowing users to access social media with greater frequency (Smith 2017).

An advantage of using social media to locate participants is that participant profiles, which are maintained over time by participants themselves, provide information about participant where abouts and additional means of contact, and can be used to contact participants directly. For example,Bolanos et al. (2012) used Facebook from 2009-2011 to find and re-contact participants eight years after enrollment in a study about methamphetamine use to invite them to participate in a second study. Nine percent of those participants who agreed to take part in the second study (N=551) were reached via Facebook and likely would not have been located by conventional methods. Mychasiuk and Benzies (2012) utilized Facebook to find low-income families enrolled in a study of a 6-week parenting program for a series of follow-up assessments conducted over several years. Researchers located participants on Facebook when other methods of contacting them failed and credited this method to finding an additional 16% of participants. Although social media is increasingly recognized as a helpful research tool (Kosinski et al. 2015, Arigo et al. 2018), there has been limited guidance on how to use social media within the guidelines of research ethics and regulations. We adopt the non exceptionalist approach promoted by Gelinas et al. (2017)in their recent article on considerations for using social media to recruit participants, which purports that social media can be evaluated using the same principles as traditional methods, while simultaneously recognizing that some aspects of social media are potentially novel and require additional consideration. Our discussion, therefore, similarly focuses on the unique considerations related to social media beyond those already outlined for traditional methods of finding and contacting participants for follow-up (Scott and White 2005).

Differences from traditional methods.

Scott (2004) delineated the gold standard approach to locating and tracking participants known to be at-risk for loss to follow-up in longitudinal studies. Detailed information about how to contact participants and locate them once initial contact has been lost would be collected on a “locator form” during enrollment. The locator information collected included phone numbers and addresses as well as nicknames, social security number, driver’s license number, employer information, spouse or other family contact information, and patient demographic information. This information would be promptly verified by the research team, and frequently updated throughout the study follow-up period to maintain its accuracy. Scott’s approach was developed prior to the popularity of the internet when communication relied upon phone call, postal mail, and going to participant homes or establishments participants were known to frequent (e.g., homeless shelter).

The methods delineated by Scott (2004) differ from those for using social media in that researchers can obtain highly personal information about a participant’s day-to-day activities and life events by searching public social media websites. Under Scott’s approach, researchers relied on participant cooperation to fill out locator forms; however, through social media, the information is publically available for the researcher to discover independently. Second, traditional public records searches to augment locator information result in circumscribed or limited information, such as a last known addresses or phone number, and whether participants have been or are incarcerated. In contrast, social media users may publicly post detailed information, such as activities, interests, and experiences. Researchers may also have access to similarly detailed personal information about other people in the participant’s life, including identified collaterals, either because these sites are connected to the participant’s or because collaterals are posting on the participant’s social media site. A third major distinction is that researchers can use social media websites to directly communicate with participants and not solely rely on social media to obtain updated contact information. The high degree of personal information available for participants and collaterals, as well as the ability to communicate directly with participants through social media, raise several ethical and regulatory issues discussed below.

Ethical and Regulatory Considerations

Human Subjects Research Ethical Principles

There are a series of important documents that guide human subjects research, including the Belmont Report, Nuremberg Code, the Declaration of Helsinki, the U.S. Common Rule federal regulations, the Guideline for Good Clinical Practice, and the National Bioethics Advisory Commission’s report on research protections for the mentally ill (Fischer 2006). The Belmont Report encapsulates the fundamental ethical principles underlying U.S. federal regulations for conducting research. In the present article, we use these principles to explore the ethical use of social media to locate and track participants enrolled in research studies.

The Belmont Report was originally written by the National Commission for the Protection of Human Services of Biomedical and Behavioral Research in response to human subjects violations. It describes three principles including justice, respect for persons, and beneficence, which have specific implications for participant recruitment and retention, the informed consent process, and the assessment of risks and benefits of research. Justice informs the selection of study participants and requires that research findings not disproportionately advantage or burden one demographic. Respect for persons requires that participants be treated as autonomous agents and that vulnerable populations with reduced autonomy (e.g., minors, incarcerated persons, fetuses) have additional protections. Beneficence refers to the obligation to minimize harm and maximize benefits to participants.

Human Subjects Research Regulations

Regulations for conducting ethical human subjects research in the U.S. are determined by the U.S. Department of Health and Human Services (HHS) and articulated in the Code of Federal Regulations Title 45, Public Welfare, Department of Health and Human Services, Part 46, Protection of Human Subjects (45 CFR 46). These regulations require all human subjects research that is either directly or indirectly supported by the federal government to be reviewed and monitored by an IRB. The Office of Human Research Protections (OHRP) of HHS provides the oversight for compliance with 45 CFR 46, including oversight of IRBs, and offers guidelines and recommendations to support research compliance with the regulations. Researchers must also adhere to regulations or policies set forth by other HHS agencies, such as the Food and Drug Administration (FDA), Title 21, Food and Drugs, Part 50, Protection of Human Subjects, and 56, Institutional Review Boards, which relates to the conduct of clinical research with drugs or devices, or the National Institutes of Health (NIH), the agency primarily responsible for biomedical and public health research in the U.S. Another federal regulation with relevance to human subjects research, particularly in the healthcare context, is the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule which protects the privacy of patient health information. Finally, the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use (ICH) Guideline for Good Clinical Practice (ICH E6) are international ethical and scientific standards for the conduct of clinical research, which researchers are encouraged to follow and may be required by a funding agency, study sponsor, or IRB.

Although no regulations speak directly to the use of the internet or social media in research, to help guide researchers and oversight bodies, the Secretary’s Advisory Committee on Human Research Protections (SACHRP), which provides expert advisement on human subjects protections to OHRP, detailed considerations and recommendations for internet research in 2013. Consistent with the nonexceptionalist approach promoted by Gelinas et al. (2017), SACHRP recommends that internet research not be held to stricter standards than traditional methods. SACHRP recommends researchers and IRBs be mindful of the unique issues with regards to privacy, confidentiality, and ability to confirm participant identities that internet research presents. We discuss these unique issues below.

Unique Ethical and Regulatory Considerations for Using Social Media to Locate and Track Participants

Participant retention.

Participants lost to follow-up are often those with higher rates of cell-phone instability, homelessness, incarceration, and social and financial impairments(Soderstrom et al. 2007, Sommers et al. 2006). Attrition of these participants from research skews findings towards economically and socially stable participants, violating the principle of justice underlying all human subjects research. Fortunately, for vulnerable populations at-risk of loss to follow-up, such as racial minorities, older adults, rural residents, and those with lower levels of income or education, rates of social media use are between 60% and 70% (Pew Research Center 2017b). Populations who may be less likely to have broadband internet service are often able to access the internet and use social media through smartphones (Pew Research Center 2017a). In our team’s ongoing national clinical trial with trauma survivors, for one participating trauma center with both rural and urban-residing participants, at least 64% of participants in rural areas had a Facebook profile.

Privacy & confidentiality.

Per federal regulations, private information is defined as “Information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record)” (U.S. Code of Federal Regulations 2009). SACHRP recommendations indicate that “If an activity (textual, visual, auditory) is legally available to any Internet user without specific permission or authorization from the individual being observed, or from the entity controlling access to the information, the activity should be considered ‘public behavior’ (Secretary’s Advisory Committee on Human Research Protections 2013). Therefore, social media posts made publically viewable would be considered public behavior. SACHRP recommendations note, however, that research using public information in an identifiable way (i.e., the participant’s identifying information is associated with the data), should be reviewed by an IRB. Using social media to locate and track participants falls within the domain of gathering identifiable information, indicating that an IRB would need to review these procedures.

Respect for persons requires that participants have the right to determine what happens with their information. Although social media posts may be considered public information, there is debate about whether this information should be treated as public (Hibbin, Samuel, and Derrick 2018, Samuel 2017), whether users fully understand the privacy implications of their social media posts, and whether people intend for their posts to be accessible by the public for all purposes (Olmstead and Smith 2017, Swirsky, Hoop, and Labott 2014). It is well-documented that social media users consent to the user’s terms of service without reading them or comprehending possible repercussions, but exhibit concern regarding use of their personal information for other purposes (Olmstead and Smith 2017, Swirsky, Hoop, and Labott 2014, Taddicken 2014).

When the New York Times revealed that a voter profiling company, Cambridge Analytica, had collected over 50 million Facebook user profiles under the guise of academic purposes (Rosenberg, Confessore, and Cadwalladr 2018), Facebook faced public outrage, scrutiny from lawmakers in the U.S. and the United Kingdom, a congressional hearing, and, as a result, enacted dramatic changes to the terms of service. Data breaches like the Cambridge Analytica scandal and distrust of social media are widespread; 51% of Americans surveyed do not trust social media sites to protect their data, and 64% of Americans reported personally experiencing a major data breach (Olmstead and Smith 2017, Rainie 2018). Therefore, extra care to communicate with participants about how their information will be used and kept private as well as the limits to confidentiality is critical due to public distrust of these networks. Explicitly addressing limits to confidentiality inherent in social media is the ethical responsibility of researchers in order to build researcher-participant trust.

With regard to ethical considerations, respect for persons and beneficence requires maintaining confidentiality and establishing sufficient safeguards to ensure researchers are only communicating study information to the participant and that research information is not publically posted or viewable. Biomedical researchers are also legally subject to abide by HIPAA regulations requiring protection of participants’ health information. A major function of social media is to create networks among profiles, which can make people’s connections to the study and to each other visible. Researchers must ensure that they are not inadvertently creating networks without permission to do so from participants and that the study profile does not contain information that divulges personal information about any participants who are connected to it. This may mean the study profile should not contain information about the nature of study procedures or purposes. Use of social media in research also presents unique challenges in confirming participant identity: social media users do not have to prove their identity to create a profile and as a result, users are susceptible to identity theft. Another complicating factor is that many users can and do create multiple accounts. Researchers and IRBs need to specify procedures that make an effort to confirm potential participant identities prior to contacting participants (e.g., matching names, birthdates, and addresses/locations provided by participants during study enrollment).

Safety monitoring.

Social media posts by study participants that are viewed by researchers may require the study team to acknowledge and address a potential safety issue, adverse event, or unanticipated problem. As a result, addressing such an issue may require a breach of participant confidentiality. For example, if a participant posts that they are having suicidal thoughts, it may require the research team to contact the participant to help connect the individual with suicide prevention resources. Additionally, these types of incidents or other discovered adverse events documented on social media may be subject to reporting requirements by IRBs, OHRP, and other HHS agencies (e.g., FDA) as adverse events or unanticipated problems. OHRP defines unanticipated problems as incidents/experiences/outcomes that are unexpected, related or possibly related to the research, and suggest that the research places the participant at greater risk of harm (e.g., physical, psychological, economic, social). HHS regulations stipulate that IRBs review and monitor incidents that may indicate study participants are being placed at an increased level of risk than was previously known or communicated to participants through informed consent procedures. Consequently, if researchers have IRB approval and participant consent to view social media posts, institutions will also need procedures in place to appropriately document, intervene, and/or report relevant incidents to all regulatory oversight bodies.

Professional boundaries.

Scott and White (2005) noted that efforts to engage patients in longitudinal follow-up studies risk blurring professional boundaries between the study team and participants. For example, participants may feel an invasion of privacy or coercion to participate or engage with the researcher, become overly reliant on the researcher or team for help and support (who may be unable to provide adequate assistance), or be vulnerable to exploitation.

Because social media profiles contain a reservoir of easily accessible personal information, the use of social media in research heightens the risk of blurred boundaries and may allow investigators to view and gather more information about participants’ lives than what is self-reported or what participants may be comfortable sharing with researchers. This problem has gained attention in the medical services literature with a practice known as “patient-targeted Googling” (Clinton, Silverman, and Brendel 2010). Patient-targeted Googling is when healthcare professionals use social media or publicly available search engines to view and obtain patient information online (Chester et al. 2017, Clinton, Silverman, and Brendel 2010). While patient-targeted Googling has proven beneficial as a source of collateral information in cases where patients are unconscious and/or in critical condition, or to provide information for patients with suspected suicidal intent (Clinton, Silverman, and Brendel 2010, Neimark, Hurford, and DiGiacomo 2006), this practice may seem invasive to patients, and without explicit permission could be perceived as loss of autonomy over personal information resulting in harm to the patient-researcher relationship.

Exposure to intimate details of participants’ lives, likes and dislikes, and subjective indicators of personality may also impair researcher objectivity and create biases. Interviewer bias is the difference in how information is solicited, recorded, or interpreted during data collection (Buring 1987). Outcome assessor bias is well-documented in clinical trial studies when interviewers are not blind to the experimental condition in which participants belong and generally favors the experimental condition (Wood et al. 2008). We are not aware of any studies on the topic, but it is worth considering that, among blinded interviewers, a bias in favor of or against a participant could potentially develop based on information an interviewer may observe through viewing participant social media posts. For example, this bias may extend to the amount of effort interviewers put into finding participants, potentially investing more time and resources to find participants that researchers feel an affinity toward. One way to protect against outcome assessor bias is for study teams to divide the work so that researchers who view social media posts to find contact information are not also responsible for completing outcome assessments with participants.

Informed consent & research transparency.

Informed consent is a cornerstone of ethical research practices. Federal regulations and Good Clinical Practice guidelines (International Council For Harmonisation Of Technical Requirements For Pharmaceuticals For Human Use 2016, U.S. Code of Federal Regulations 2009) require participants to be informed of the research procedures, risks, and protections of confidentiality. Thorough, transparent, and ongoing informed consent procedures demonstrate researchers’ respect for participant autonomy and are an opportunity to emphasize researcher efforts to maximize benefits, minimize risks, and build trust between researchers and participants (Gelinas et al. 2017). As previously noted, social media users are often not aware of platform terms of service or potential privacy and confidentiality issues related to platform functionality. It is the responsibility of the researchers to acknowledge that participants may not understand these issues especially as it relates to the specific needs of one particular research study. Therefore, researchers must clearly explain how the social media sites will be used, the intended purpose and use of information gleaned from the social media sites, the potential risks to participants and how they will be mitigated, and the outcome of data collected during participant involvement in the study. Given that the risks to participants will vary depending on which platform functions researchers opt to use, and how they intend to use them, we offer a rubric for thinking through the risks versus benefits of each platform function that may have utility for the study needs.

Rubric for Exploring Ethical and Regulatory Considerations: Example of Facebook

Using the social medial platform Facebook as an example, we provide a rubric for thinking through the ethical and regulatory considerations for locating and tracking participants based on the specific functionalities of a social media platform (see Table 1). The development of this rubric is based on our research team’s experience in an ongoing NIH-funded multi-site trial of posttraumatic stress disorder screening and intervention for injured trauma survivors (Zatzick, Russo, et al. 2015). Patients are recruited during their hospitalization at one of 25 level 1 U.S. trauma centers and randomized to obtain usual care versus a collaborative care intervention. Patients within the collaborative care intervention group receive care coordination over 6 months post-injury, as well as interventions and referrals to address symptoms of posttraumatic stress disorder, depression, substance misuse, and suicidality. Researchers located in Washington State conduct three study-related follow-up assessments to collect patient-reported outcomes over 12 months post-injury. Not only is the patient population known to be difficult-to-follow over time due to instability in housing and contact with identified collaterals (Rajotte, Fuchs, and Zatzick 2003), but the added challenge of needing to track patients remotely across 17 states led us to incorporate Facebook as a method for locating and tracking patients in the study. Although demographic data is not yet available for the study population, patients are expected to be similar to a previously-conducted clinical trial of PTSD screening and intervention at Washington State’s level 1 trauma center, Harborview Medical Center. In this trial, patients were racially/ethnically diverse (45% White), majority male (64.5%), uninsured or publically insured (84.3%), and unemployed (62.8%) (Zatzick, O’Connor, et al. 2015).

Table 1.

Human Subjects Ethical and Regulatory Considerations and Recommendations for using Facebook to Locate and Track Participants

		Ethical & Regulatory Considerations
Facebook Function	Purpose	Respect for Persons (Participant Right to Privacy & Autonomy)	Beneficence (Potential Risks to Participant)	Regulations & Guidelines	Recommendation(s)
“Friend” a participant via Facebook	Locating: No utility for locating participants. Tracking: Connecting the study site with the participant’s site may allow research staff to see more of the participant’s posts. Research staff can send a private message without needing participant to accept the message invitation.	Friends may be viewable to each other on the study site, identifying the participants to each other. Friends may be viewable to each other on the participant’s site, making their participation known to the their social network. Participants may feel obligated (coerced) to accept a friend request from the study.	There is a risk to participant confidentiality regarding publicizing their participation in the research study.	45 CFR §46, 21 CFR 50, ICH E6 R2 GCP: Participants should be informed of the procedures, risks, and protections of confidentiality. HIPAA Privacy Rule: Participant protected health information (which may include study purpose if related to a health conditiona) cannot be disclosed without permission. ICH E6 R2 GCP: The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s). SACHRP – May 2013 Attachment B: Investigators and IRBs should be aware that identity verification is a major issue in Internet research.	Study team members should confirm the participant’s identity before accepting friend requests. If accepting friend requests, ensure that the study Facebook site privacy setting restricts friends from viewing each other. Consider not approving or initiating friend requests to minimize risk of breaching participant confidentiality. Consent form should clarify if the study team intends to initiate or accept friend requests and steps that are taken to protect participant privacy.
View public participant information in the “About” section on participant Facebook Profile	Locating: See Location, employment, places lived, birthdate, contact information in order to confirm participant identity. Participants may list telephone numbers, emails, or other means of contacting them. Tracking: Participants may update their contact information over time.	Participants may be unaware that their information is available publicly in the “About” section if they are unfamiliar with utilization of privacy settings. They may experience use of their “About” contact information as intrusive.	Information posted in the “About” section may not be current. Using this information may result in contacting people who are not the participant and divulging private health information.	45 CFR §46, 21 CFR 50, ICH E6 R2 GCP: Participants should be informed of the procedures, risks, and protections of confidentiality. HIPAA Privacy Rule: Participant protected health information cannot be disclosed without permission, which is a risk when contacting participants using information obtained indirectly or not directly from the participant. ICH E6 R2 GCP: The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s). SACHRP – May 2013 Attachment B: Participants’ posts on the internet may be considered public; however, procedures for collecting, storing, and using individually identifiable data collection from a public website should be reviewed by an IRB.	Consent form should clarify that the study team intends to use publicly available information in the “About” section to contact and find the participant. Study team members should confirm the participant’s identity before discussing the study when contacting participants using information gathered from the “About” section.
View photos of the participant in “Photos” section on participant Facebook Profile.	Locating: Confirm participant identity using photos of the participant. Tracking: No utility for tracking participants.	Participants may be unaware that their photos are available publicly in the “Photos” section if they are unfamiliar with utilization of privacy settings.	Viewing photos of the participant may influence research staff’s perception of or relationship to participants. This may result in differential treatment of participants based on their photos.	45 CFR §46, 21 CFR 50, ICH E6 R2 GCP: Participants should be informed of the procedures, risks, and protections of confidentiality. ICH E6 R2 GCP: The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s). SACHRP – May 2013 Attachment B: Participants’ posts on the internet may be considered public; however, procedures for collecting, storing, and using individually identifiable data collection from a public website should be reviewed by an IRB.	Study team should only use Photos section to confirm participant identity. Once confirmed, there is no need to browse them. Study team members should not download or store participant Photos.
View and search participant’s Facebook friends in the “Friends” section on participant Facebook Profile	Locating: Confirm participant identity through friendship with collaterals. Can direct message collaterals to ask about participant location and contact information. Tracking: View collateral’s public Facebook profile, including contact information.	Collaterals do not expect the research team to view their public information, may experience being contacted via Facebook or use of their “About” contact information as intrusive.	Collaterals do not consent to use of Facebook information for the research study. Information about the nature of the study and the participant’s participation should not be shared with collaterals unless given explicit permission by the participants.	45 CFR §46, 21 CFR 50, ICH E6 R2 GCP: Participants should be informed of the procedures, risks, and protections of confidentiality. HIPAA Privacy Rule: Participant protected health information cannot be disclosed without permission, which is a risk when contacting participants using information obtained indirectly or not directly from the participant. ICH E6 R2 GCP: The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s).	Consider not contacting collaterals through Facebook messenger, and instead obtaining updated collateral contact information from the public information in the “About” section. If applicable, the consent form should clarify that public “Friends” sections may be used to confirm participant identity and that collaterals may be messaged.
View public posts on Facebook Timeline as soon as you navigate to participant’s Facebook Profile	Locating: Participants may post telephone numbers or other means of contacting them. Other collaterals may post on their walls with updated contact information Tracking: Information about participant’s incarceration status may be available, interviewers can see when patients are active on Facebook to target communication.	Participants may have chosen to publicly post information about themselves, including contact information on Facebook, without realizing that it is visible to the public if they are unfamiliar with Facebook’s privacy settings. They may not expect that the research study will read these public posts, and post information and statements that they would prefer not to share with the research team.	Research staff may form preconceptions of participants through reading their public posts that bias their participant interactions. Participants may post about reportable events such as suicidality and homicidality. Study team has a duty to protect participants from harm. Potential harm to interviewers as absorbing more information about participant lives may result in vicarious trauma, being impacted by adverse events when they occur.	45 CFR §46, 21 CFR 50, ICH E6 R2 GCP: Participants should be informed of the procedures, risks, and protections of confidentiality. This would include limits to confidentiality and the need to protect patients or others from harm. 45 CFR §46, 21 CFR 56: Posts observed may contain information that amount to events that need to be reported to IRBs, OHRP, and/or FDA. HIPAA Privacy Rule: Participant protected health information cannot be disclosed without permission, which is a risk when contacting participants using information obtained indirectly or not directly from the participant. ICH E6 R2 GCP: The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s). SACHRP – May 2013 Attachment B: Participants’ posts on the internet may be considered public; however, procedures for collecting, storing, and using individually identifiable data collection from a public website should be reviewed by an IRB.	Study team members avoid browsing or searching through public posts. Consent form should include a disclaimer that public information posted to Facebook profiles may be viewed in the process of using Facebook to contact participants. Protocol for reporting patient safety concerns and adverse events in place.
Send private message to participant over Facebook Messenger	Locating: Messenger can be used to get in touch with study participants. Tracking: Research staff can check in with participants over the course of the study to update contact information.	Participants may not realize that the study team is contacting them over Facebook, and they may prefer to not receive Facebook messages.	Per Facebook’s privacy policy, Facebook Messenger data is stored until the deletion of the Facebook account. Researchers may send private messages with protected health information or other private content and are not in control of managing the security of that data or what Facebook may do with it.	45 CFR §46, 21 CFR 50, ICH E6 R2 GCP: Participants should be informed of the procedures, risks, and protections of confidentiality. This would include limits to confidentiality and the need to protect patients or others from harm. HIPAA Privacy Rule: Participant protected health information cannot be disclosed without permission, which is a risk if participant identity not correctly confirmed. ICH E6 R2 GCP: The confidentiality of records that could identify subjects should be protected, respecting the privacy and confidentiality rules in accordance with the applicable regulatory requirement(s). SACHRP – May 2013 Attachment B: Researchers should be aware of potential complications with confirming participant identity over the internet.	Research staff to use identifiers to confirm participant identity before messaging. Communicate these to the participant during the recruitment and consent process. Consider asking participants to provide their Facebook profiles address during the recruitment process. Participants consent to each form of contact used to reach them, consent to Facebook specifically. Refrain from sending protected health information or other private information about the participant over Facebook. Use the platform primarily to communicate logistics (scheduling, updating contact information).

Note: The ethical principle of Justice is not represented in the table as it provides the impetus for deciding to use social media/Facebook to locate and track participants. HIPAA = Health Insurance Portability and Accountability Act. ICH E6 = International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use, Guideline for Good Clinical Practice. SACHRP = Secretary’s Advisory Committee on Human Research.

^aFor example, the name of our research study, Trauma Survivors Outcomes and Support study, communicates that participants have suffered a trauma. We, therefore used only the acronym TSOS to identify our profile.

Facebook is used worldwide by more than one billion people for social networking functions including sharing photos, posts, and life updates (Facebook 2018a). Using Facebook to locate and track study participants requires interaction with a personal social media profile curated by study participants.Privacy Settings operated by the owners of the social media profile control the degree to which information is visible to the public, user networks, and Facebook friends.Direct Messagingcan be used to send a private message to the user regarding participation in the study, relevant study information, and/or follow-up and tracking inquiries. Researchers may also view participant contact information posted in the About section such as date of birth, and current residence location. Accordingly, comments posted on the participant’sTimelinemay also have updated contact information or otherwise be helpful in locating participants (e.g., posts noting participant incarceration). Facebook provides users with the option to Friend another user, which—once accepted by the other party—connects the two user profiles and allows users the ability to access information on the social media page which the user can set to be visible to Facebook friends (the highest degree of access). Facebook’s Settings also control whether these Friends are visible to each other through one social media profile. According to the Facebook terms of service, Facebook collects and stores information about page views, Direct Messaging, comments, and likes made by any user (Facebook 2018b). Content of messages, therefore, become Facebook’s data, and, at that point, security and privacy of patient data collected by Facebook is likely beyond researchers’ control.

The rubric in Table 1 presents six Facebook functions that may be helpful in locating and tracking participants. Each function has corresponding ethical concerns, existing regulatory guidelines, and recommendations for best-practice use of Facebook to minimize risks to participants.

Recommendations for Researchers and IRBs

Social media can be a powerful tool to communicate with hard-to-reach populations. While there is potential benefit to taking advantage of social media’s unique capabilities, researchers and reviewers must also take into account specific ethical and regulatory issues that have not been encountered when using traditional follow-up methods. As with the collection and use of any potentially sensitive research data, researchers are obliged not to access and collect more data from participants than is needed to carry out the research. However, the very nature of social media platforms makes it possible for researchers to inadvertently be exposed to participant information beyond the intended purpose (e.g., photos posted in the same place as contact information) and what is considered necessary to carry out the research will vary by study. Therefore, it is imperative for research teams to consider the risks versus benefits of utilizing each function provided by a social media platform. Specific recommendations for using Facebook to communicate with participants are summarized in Table 1. Beyond this specific use of Facebook, we also provide general considerations and recommendations for investigators and reviewers regarding social media use to locate and track participants and recommendations regarding disclosure of potential social media contact during informed consent procedures.

Recommendations for Investigators Considering Social Media Use to Locate and Track Research Participants:

Research protocol development:

The research team should develop a study protocol that accounts for social media follow-up methods and convey the procedure to all regulatory review bodies that may apply. All aspects of the social media website’s functionality should be considered in line with applicable federal and state laws and other regulations and ethical principles of respect for persons, beneficence, and justice.

1. The researcher should determine whether the study will or will not utilize each specific function (see Table 1 for an example). For each function, researchers should specify how and when that function will be used, what, if any, participant information will be retained, and who will have access to this information.

2. Confirm the planned research is compliant with the website’s terms of use.

3. Determine appropriate safeguards to ensure confirmation of a participant’s identity to avoid contacting false profiles or other users (e.g., confirmation of two or more identifiers based on information provided by the subject or navigation to the site by the subject and study retention of the URL).

4. Create a safety monitoring plan for any issues that arise due to a message from a participant or a viewed public post. Even if the researcher does not intend to view public posts, the safety monitoring plan should recognize that due to many social media displays, researchers may incidentally view posts when looking for contact information, such as through the About section on Facebook.

5. Consider if the research may require using social media to view, locate, contact, or monitor participants’ collaterals (e.g., Friends). If so, additional procedures will need to be established and participants’ collaterals may need to be given the opportunity to consent.

6. Develop and maintain standard operating procedures for locating and tracking participants via social media and ensure all researchers are trained in appropriate procedures and are adherent to them. For example, this could include internal guidance regarding communication to ensure data and/or protected health information is not communicated over messaging systems that may or may not be secure per the social media website terms of use and policies.

7. Recognize that social media may change, particularly over the course of a study, and that procedures may need to be reviewed and updated accordingly.

Informed consent procedures:

The research team should develop an informed consent process and document that provides all relevant study information, including items required by 45 CFR 46 (U.S. Code of Federal Regulations 2009). According to these federal regulations, “The prospective subject or the legally authorized representative must be provided with the information that a reasonable person would want to have in order to make an informed decision about whether to participate, and an opportunity to discuss that information” (45 CFR 46.116). The amount and complexity of information needed for participants to be able to make an informed decision about whether to allow the use of social media to locate and track them during a study depends on the nature of the platform as well as the number and type of functions the researchers intend to use. It behooves researchers, therefore, to be parsimonious in their use of social media functions and thoughtful about whether the study design and population truly require their use.

The informed consent process and consent form should describe the specific use of social media, including:

1. Any potential risk to participants and efforts to mitigate those risks, such as any risk of loss of confidentiality and the ability of the researcher to protect and ensure the confidentiality of communication over social media. To make this potentially complex information more digestible to participants, researchers may find it helpful to insert a table in the consent form that presents the risks to participants associated with each function researchers plan to use alongside what will be done to mitigate these risks.

2. How participant identities will be confirmed (e.g., multiple identifiers matched to participant information or social media website provided by participant).

3. Whether messages sent to the participant will contain sensitive information, and what this information will be.

4. Whether researchers will attempt to link or accept invitations to link with participants through the platform.

5. Whether researchers will view public posts on a routine basis and for what purpose (e.g., to confirm identity only versus monitor participant whereabouts).

6. What researchers will do if they discover information regarding participant safety concerns and outline what qualifies as reportable (e.g., participant mentions suicidal ideation or behavior, indications of child or elder abuse, and other legal or ethical reporting requirements).

7. What information will be viewed only versus will be collected and maintained by researchers from public posts, if any.

8. How any data collected and maintained will be stored by the research team to protect confidentiality.

9. What information the researchers will transmit and how that information will be transmitted (e.g., direct, private messages for scheduling for phone calls or appointments only) and whether any protected health information will be conveyed by the researchers.

10. Any limits to the researchers’ ability to protect confidentiality (e.g., social media websites may, per the terms of use and site policies, be able to access and read and retain all messages once they are sent).

11. A reminder that even if the study team will not convey protected health information over social media, if the participant chooses to transmit any of this information the researchers cannot ensure its confidentiality.

12. Whether participation in the research is contingent upon allowing researchers to locate and track them via social media. Researchers may want to make the use of social media or one or more of the functions optional for study participation, particularly if there are confidentiality concerns based on the social media terms of use or the sensitivity of study data.

Recommendations for IRBs Reviewing Research with Social Media Use to Locate and Track Research Participants:

1. Develop or have access to the expertise and familiarity with social media so as to be prepared to provide adequate review and critical analysis of proposed research procedures involving social media in the context of legal, regulatory, and ethical principles and requirements.

2. Confirm that the research is in compliance with the social media website’s terms of use and policies and institutional policies.

3. Ensure that all proposed social media procedures are described adequately in the consent form as suggested above in the recommendations for researchers, including any risk and confidentiality information, or other required elements as outlined in 45 CFR 46 (U.S. Code of Federal Regulations 2009).

4. Check that the researchers have procedures in place to handle any safety or legal concerns that may arise through involvement in social media (e.g., child or elder abuse, reporting of unanticipated problems or adverse events) and that potential event reporting discovered due to social media is described in both the study protocol and informed consent form.

5. Recognize that social media may change, particularly over the course of a study, and that procedures may need to be reviewed and updated accordingly.

Conclusion and Future Directions

Social media has incredible utility for locating and tracking participants enrolled in longitudinal research studies or other studies where re-contacting participants is essential, especially for traditionally underserved populations and those considered hard-to-reach (e.g., substance use treatment participants; homeless individuals). Navigating the ethical and regulatory implications of using social media in research presents challenges for researchers and IRBs that current regulations do not address. We have identified unique issues that social media raises versus traditional methods (e.g., telephone calls, postal mail, and public records searches for last known address), and emphasized the importance of maintaining participant privacy, respecting participant autonomy, and promoting researcher transparency, particularly during the informed consent process. There are myriad ways in which researchers may harness the opportunities afforded by social media (Kosinski et al. 2015, Arigo et al. 2018), such as recruiting, collecting data, and monitoring adherence to study procedures. We anticipate the proposed rubric may be useful in guiding researchers through considerations for other uses of social media; however, papers that unpack the unique ethical and regulatory issues for other uses (e.g., Gelinas et al., 2017) are needed to help researchers navigate this nascent terrain and limit risks to participants.