What do ethics boards and privacy reviewers ask about story-based studies?

By ·

Short answer: Mostly what they ask of any study involving people, applied to open-ended stories: how consent is sought and recorded, whether participants can be identified from what they write, where data is stored and for how long, who can see it, and whether automated tools, including AI, touch the responses [S1][S2][S3]. Answering these at design time shortens review.

1. Consent has to cover what stories may reveal

Story-based studies invite people to describe experiences in their own words. That is their strength, and it is also why consent needs particular care: participants may share more than either they or the researcher expected.

Canada's TCPS 2 sets out what prospective participants should generally be told, including the purpose of the research in plain language, the reasonably foreseeable risks, that they can withdraw at any time, their right to request withdrawal of their data and any limits on that, what information will be collected and for what purposes, who will have access to it, and how confidentiality will be protected [S1, Art. 3.2]. It also treats consent as ongoing: researchers have a continuing duty to tell participants about changes that may affect their decision to stay in the study [S1, Art. 3.3].

In the United States, the revised Common Rule requires that informed consent begin with "a concise and focused presentation of the key information" most likely to help a person decide whether to take part [S3, §46.116(a)(5)(i)]. Where identifiable private information is collected, consent must also say whether identifiers might be removed and the information used for future research without further consent, or that it will not be [S3, §46.116(b)(9)].

For story-based work, reviewers commonly look for:

  • A plain statement of what participants are asked to share, and a reminder not to include names or details of other people unless they want to.
  • What happens to stories that reveal risk of harm, and any duty to disclose that may apply.
  • Whether and how participants can withdraw a story after submitting it, and up to what point that remains possible.
  • How consent is recorded, especially for anonymous online or phone collection where a signed form isn't practical. Both frameworks allow alternatives: TCPS 2 asks researchers to explain how consent will be sought and documented, and recognises oral consent, consent logs and completed questionnaires as forms of evidence [S7, Art. 10.2]; the Common Rule lets an IRB waive a signed form in defined circumstances, for example minimal-risk research [S3, §46.117(c)].

2. Open text can identify people even in an "anonymous" study

Removing names from a form doesn't make stories anonymous. A participant who mentions their job, their town and a specific event may be identifiable to anyone who knows them.

TCPS 2 distinguishes five categories of information: directly identifying, indirectly identifying, coded, anonymized and anonymous [S2]. Indirectly identifying information is information that "can reasonably be expected to identify an individual through a combination of indirect identifiers," such as date of birth, place of residence or a unique personal characteristic [S2]. The policy also notes that re-identification risk is higher when a dataset covers a small geographic area or people with unusual characteristics [S2]. Open-ended stories often contain exactly those details.

Reviewers will want to know, before data collection begins:

  • Which anonymity setting the study uses: anonymous (no identifiers collected), pseudonymous (a code links responses to a person, held separately) or identified.
  • How stories will be screened and redacted before anyone outside the core team sees them, and before quotes appear in reports.
  • Whether small groups will be reported separately, and what minimum group size the team will use to avoid singling people out.
  • How quotations will be chosen and edited for publication.

3. Reviewers want to know where data lives and when it is deleted

TCPS 2 asks researchers to describe how they will safeguard information across its whole life cycle: "its collection, use, dissemination, retention and/or disposal" [S2, Art. 5.3]. The Common Rule asks IRBs to confirm, when appropriate, that there are "adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data" [S3, §46.111(a)(7)].

In practice, that means stating plainly in the application:

  • Where the data is hosted, including the country or region, and whether that matches institutional or funder requirements.
  • How long each kind of data is kept: raw stories, interpretation answers, contact details, exports and backups.
  • How data is exported and deleted at the end of the study, and who confirms deletion.
  • Which third parties process the data, such as hosting providers or transcription services.

If you are using an external platform, get these answers in writing from the provider before you submit. Vague answers are a common reason for a board to send an application back.

4. University IT will ask for a vendor assessment

At many institutions, the research ethics board is not the only reviewer. Information security and privacy offices assess any external software that will hold research data.

Many higher-education institutions in North America use the Higher Education Community Vendor Assessment Toolkit (HECVAT), a community-developed questionnaire maintained through EDUCAUSE [S4]. HECVAT 4 brought the previous full, lite and on-premises versions into one file, added privacy questions developed by a chief privacy officers' community group, and added a set of AI-specific questions to help institutions assess AI components in the tools they use [S5]. Providers are meant to complete it once a year and share the same version with any institution [S5].

For researchers, the practical step is to ask the provider for a completed HECVAT early and pass it to your IT or privacy office alongside your ethics application, rather than after approval.

5. AI use should be disclosed and bounded

Reviewers increasingly ask whether any automated or AI tools will process participants' responses, for what purpose, and with what human oversight. The US National Institute of Standards and Technology's AI Risk Management Framework organises AI risk management into four functions, Govern, Map, Measure and Manage, and is a useful reference for describing how AI use is scoped and overseen [S6].

For a story-based study, a clear disclosure answers four questions: which tasks AI performs, whether it changes or replaces anything participants wrote or chose, whether it can be turned off, and how its outputs are labelled for the research team. One provider's statement, as an example of that structure:

"Participants interpret their own stories, and that interpretation is never replaced or changed by AI. Spryng uses AI only for supporting tasks: transcription, translation, and redaction of submitted responses. AI-assisted features are optional; we turn them off for your organization on request. The optional AI Pattern Synthesis add-on suggests groupings of stories for your team to review; it is clearly labelled and works alongside, not instead of, participants' own interpretation."

Whatever tools you use, describe them in the consent material in plain language, and say whether participants' responses are used to train any model.

6. Qualitative studies raise questions of power and ongoing consent

TCPS 2 chapter 10 asks reviewers to consider the power relationship that may exist between researchers and participants, and whether waiving a signed consent form could affect participants' welfare [S7, Art. 10.2]. Story-based studies in public services often involve people who depend on the organisation running the study for benefits, care or a decision. Reviewers will want to see that participation is voluntary in practice, not only on paper, and that declining has no effect on the service people receive.

The same chapter recognises emergent design, where questions evolve as a study proceeds. Researchers should give the board the available information up front, including draft prompts or sample questions, and consult the board when a change to data collection would alter the risks to participants [S7, Art. 10.5]. For story-based studies, that typically covers changes to the prompt, to the interpretation questions, or to who can see the stories.

7. A pre-submission checklist

Before you submit, make sure your application answers each of these:

  1. Consent text: key information first; what participants are asked to share; withdrawal of a story; how consent is recorded.
  2. Anonymity setting: anonymous, pseudonymous or identified, and why.
  3. Redaction plan: who screens stories, when, and the rules for quotations and small groups.
  4. Hosting region and retention: where data is stored, for how long, including backups.
  5. Access: who can see raw stories, interpretation answers and contact details.
  6. AI on or off: which tasks, if any, use AI; whether it can be switched off; how outputs are labelled.
  7. Export and deletion: how data leaves the platform at the end and who confirms deletion.
  8. Vendor assessment: a completed HECVAT or equivalent, shared with your IT or privacy office.

Compliance with TCPS 2, the Common Rule or institutional policy is a responsibility of the research team and the institution. A clear application makes that responsibility easier to meet and easier for reviewers to confirm.

Sources