Appendix
State Law Worksheet
- Edition
- Reference Edition 1.3
- Approx. pages
- 9
[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.
On this page
1. Purpose and how to use this worksheet
Federal rules set the floor for consent, privacy and records. State law decides several questions the SOPs cannot answer for every site: who may consent for an adult who lacks capacity, who counts as a child or guardian, how long medical records are kept, which state research laws and consent documents apply, controlled-substance and laboratory licensing, telehealth licensure, corporate practice of medicine, breach notification and mandatory reporting. The SOPs point here whenever the answer depends on the state.
Complete one worksheet for each state where [SITE NAME] has a location, and for each state where participants are seen remotely or receive home visits. Complete it with the site's counsel and confirm the research answers with the IRB of record. Central IRBs often publish a state-law summary; ask for it, but record the site's own answer and the source.
Rules for completing the worksheet:
- Write the answer in plain words in the State answer column. If the answer is "no state law; follow the IRB," write that.
- Cite the statute, regulation or IRB policy section in the Statute/source column. If counsel gave the answer without a citation, write "Counsel opinion" and the date.
- Initial and date each row in the Reviewed by/date column.
- Where the IRB's determination is stricter than state law, follow the IRB and say so in the answer.
- The Quality Lead reviews the worksheet at least [DEFAULT: annually], and sooner when the site adds a state, a law changes, or the IRB changes its state-law guidance. Record each review in section 4.
- The Quality Lead files the completed worksheet with the SOP master file (F-100-03) and gives a copy to everyone who obtains consent.
Section 5 gives examples for California, Maryland and New York. They show the level of detail expected. They are illustrative only. Verify before relying on any of them.
2. State identification
| Item | Entry |
|---|---|
| State | [STATE] |
| Site locations in this state | [ADDRESSES] |
| Remote or home visits into this state (Yes/No) | |
| IRB(s) of record | [CENTRAL IRB NAME] |
| IRB state-law guidance obtained (title and date) | |
| Counsel consulted (name and date) | [LEGAL COUNSEL] |
| Worksheet completed by | [QUALITY LEAD] |
| Date completed |
3. Worksheet
3.1 Age of majority
Most states set the age of majority at 18. Some set a different age for specific purposes. Under 21 CFR 50.3(o), a "child" for FDA-regulated research is a person who has not reached the legal age for consent to the treatments or procedures in the clinical investigation under the law of the place where the research is conducted. Record the general age and any exception.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Age of majority | |||
| Exceptions that change who is a "child" for study procedures |
3.2 Legally authorized representative (LAR) for research
An LAR is a person authorized under applicable law to consent on behalf of a prospective participant to participation in the research (21 CFR 50.3(l)). Federal rules do not say who that is; state law does. The answer for research is often different from the answer for treatment. List the people who may serve, in priority order, and say what to do when two people at the same level disagree.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Is there a statute naming who may consent to research for an adult who lacks capacity? | |||
| LAR priority order for research (list in order) | |||
| Conditions on surrogate research consent (for example study type, risk level, IRB approval) | |||
| Rule when surrogates at the same level disagree | |||
| Court-appointed guardian: authority to consent to research (any court approval needed?) | |||
| Health care agent under an advance directive: authority to consent to research | |||
| IRB of record's position on LARs in this state | |||
| Remote consent with the participant or LAR located in this state while the site is in another state: which state's law the IRB applies |
3.3 Surrogate or health care consent statute and research
Many states have a "family consent" or surrogate statute for treatment decisions. Some extend it to research; many are silent. If the statute is silent, the site does not assume it covers research. Record the IRB's and counsel's position.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Name and citation of the state surrogate or health care decisions statute | |||
| Does it expressly extend to research? (Yes / No / Silent) | |||
| If silent, does the IRB or counsel accept it for research? |
3.4 Minors who may consent for themselves
State "minor consent" laws (for example for pregnancy care, sexually transmitted infection, substance use or mental health treatment) apply to treatment. They do not, on their own, allow a minor to consent to research. A minor consents alone for research only when the IRB has approved it for that study under 21 CFR 50 Subpart D and state law. The usual answer here is "none, unless the IRB approves for a specific study."
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Minors who may consent to research without a parent (usually none without IRB approval) | |||
| Treatment consent exceptions for minors (for reference only) | |||
| Who may give parental permission (parent, guardian, other) and whether one or both parents are needed | |||
| Who counts as a guardian: a person authorized under state or local law to consent on behalf of a child to general medical care (21 CFR 50.3(s)) | |||
| Children who are wards of the state or an agency: who may give permission and any court or agency approval needed (21 CFR 50.56) |
3.5 Emancipated and mature minors
Emancipation rules differ by state: by court order, by marriage, by military service, or by statute for specific purposes. Record how an emancipated minor is treated for consent to the study procedures, and what proof staff must see and file.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| How a minor becomes emancipated | |||
| Emancipated minor may consent to study procedures as an adult? | |||
| Proof required (for example court order, marriage certificate) | |||
| Mature minor doctrine recognized? |
3.6 State research-specific laws
A few states have their own human research statutes. They may add consent documents (California's Experimental Subject's Bill of Rights), apply the Common Rule to research that federal law does not cover (Maryland), or cover research not subject to federal regulation (New York). Record each law, what it requires of the site, and whether the IRB applies it.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| State human research statute (name and citation) | |||
| Does it apply to FDA-regulated industry trials at this site? | |||
| Extra documents or consent elements required | |||
| Does the IRB of record apply it in its review? |
3.7 Genetic testing and genetic privacy
Some states require specific written consent for genetic tests, limit further testing of samples, or require samples to be destroyed. Record any rule that changes the consent form, specimen retention, or return of results.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Specific consent required for genetic testing in research? | |||
| Limits on retention or further use of samples | |||
| Limits on disclosure of genetic results | |||
| Genetic anti-discrimination law to mention in consent (if the IRB requires) |
3.8 Medical record retention
Research records are kept for the longest of: the sponsor's requirement in the CTA, FDA (21 CFR 312.62(c) and 812.140(d)), HIPAA documentation rules (45 CFR 164.530(j)), and state medical record law. Study source documents that are also medical records follow the state rule if it is longer. Record adult and minor periods. SOP-402 Record Retention, Archiving and Destruction uses these answers.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Adult medical records: minimum retention | |||
| Minor medical records: minimum retention | |||
| Does the rule depend on license type (physician office, clinic, hospital)? | |||
| Notice required before destruction? | |||
| Duties when the practice closes | |||
| State rule specific to research records, if any |
3.9 Telehealth and licensure
A clinician who sees a participant by video or phone generally must be licensed in the state where the participant is located at the time of the visit. Check whether the state belongs to a licensure compact, allows a telehealth registration, or has its own rules on telehealth prescribing. SOP-313 Decentralized Trial Elements uses these answers.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| License required for clinicians treating participants located in this state | |||
| Licensure compacts or telehealth registration available | |||
| Telehealth consent or documentation rules | |||
| Prescribing limits by telehealth (including controlled substances) | |||
| Rules for home health or mobile nursing providers | |||
| License or certification for phlebotomists, medical assistants and other technicians who do study tasks (SOP-904 5.4.1) |
3.10 Controlled substance registration
DEA registration (21 CFR 1301) is needed to handle controlled substances. Many states require a separate state registration or license, and some require a separate research registration even when the investigator already prescribes. SOP-304 Investigational Product Management uses these answers.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| State controlled substance registration required? | |||
| Separate research registration or license required? | |||
| Prescription drug monitoring program registration or checks required | |||
| State storage, record or reporting rules beyond DEA |
3.11 Data breach notification
HIPAA breach notification (45 CFR 164.400 to 164.414) applies to covered entities. State breach laws may add notice to the state attorney general or another regulator, shorter deadlines, or cover data HIPAA does not. SOP-400 and F-400-01 Privacy Incident Report use these answers.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| State breach notification statute | |||
| Who must be notified (individuals, attorney general, other agency) | |||
| Deadline | |||
| Does compliance with HIPAA satisfy the state law? | |||
| Other state health privacy law (for example a state medical confidentiality act) | |||
| Extra protection for specific information (HIV status, mental health, reproductive health, substance use, minors' records) | |||
| State consumer health data law covering entities HIPAA does not cover |
3.12 Mandatory reporting
Research staff may learn of abuse, neglect, threats of harm, or reportable diseases during a study. State law names who must report, to whom and how fast. The consent form should tell participants about any reporting duty the IRB requires to be disclosed.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Child abuse and neglect: who must report and to whom | |||
| Elder or vulnerable adult abuse: who must report and to whom | |||
| Duty to warn or report threats of harm | |||
| Reportable communicable diseases | |||
| Other (for example domestic violence, gunshot wounds) |
3.13 Laboratory testing
CLIA (42 CFR 493) is the federal floor for testing done on site. Some states license laboratories or testing personnel separately, or have exempt status under CLIA. SOP-312 Equipment Calibration and Maintenance; Local Laboratory Requirements uses these answers.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| State laboratory license or registration required for on-site testing (including waived tests)? | |||
| State licensure or qualification rules for testing personnel | |||
| CLIA-exempt state program (state runs its own approved program)? |
3.14 Investigational product shipment and pharmacy law
Shipping or dispensing IP to participants in this state, or from this state to another, may engage state pharmacy, wholesale distribution or nonresident pharmacy law. SOP-313 Decentralized Trial Elements uses these answers.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| License needed to ship or dispense IP directly to participants located in this state | |||
| Rules on investigational drug storage or dispensing at the site beyond federal law | |||
| License or permit for a central or network location that prepares or dispenses IP for other locations or sites (SOP-304 5.1 Network note; SOP-904) | |||
| Nonresident pharmacy license or permit for a location that ships IP into this state (SOP-313) |
3.15 Corporate practice of medicine
Some states bar a lay corporation from employing physicians or controlling medical judgment, so physician services must sit in a professional corporation owned by licensed physicians, often under a management services arrangement. The answer affects how a network employs or contracts PIs and Sub-Is, which entity signs CTAs, and whether a member site is the network entity itself or a separate entity (SOP-900 5.2.1.1). [LEGAL COUNSEL] completes this section; the site does not answer it on its own.
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Does the state prohibit or restrict the corporate practice of medicine? | |||
| Must physicians (PI, Sub-I) be employed by, or contract through, a professional corporation owned by licensed physicians? | |||
| Limits on a management services organization's control over clinical decisions, staffing, fees or fee splitting | |||
| Effect on network staffing, contracting and CTA signature for this site (counsel's conclusion) |
3.16 Other state rules
Use this table for anything else counsel or the IRB flags (for example state rules on participant payments, advertising, specimen export, or HIV test consent).
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| State all-payer anti-kickback, self-referral or fee-splitting law: does it apply to payments for referrals or enrollment, recruitment vendor fees, network service fees or management fees even where no federal health care program business is involved? (SOP-300 5.6 and 5.7; SOP-104; SOP-902) [LEGAL COUNSEL] completes this row. |
4. Review and sign-off
| Review date | Reviewed by (name and role) | Counsel consulted (Y/N) | IRB guidance checked (Y/N) | Changes made | Signature |
|---|
5. Illustrative examples (verify before relying)
The entries below were checked against the sources named on 23 October 2026. They are examples of how to fill in the worksheet, not legal advice. Laws change, and courts and IRBs interpret them. Verify before relying: confirm each answer with counsel and the IRB, then record it in the site's own worksheet.
5.1 California (illustrative only, verify before relying)
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Age of majority | 18 | Family Code 6500 | Not reviewed. Verify before relying. |
| LAR for research | Surrogate consent is allowed only for medical experiments relating to the cognitive impairment, lack of capacity, or serious or life-threatening diseases and conditions of participants. Non-emergency priority: agent under an advance health care directive; conservator or guardian with health care authority; spouse; registered domestic partner; adult child; custodial parent; adult sibling; adult grandchild; closest available adult relative. In an emergency room setting only the first seven may consent. Disagreement at the same level means no consent. A higher-priority refusal cannot be overridden by a lower-priority consent. Surrogates may not be paid. | Health and Safety Code 24178 | Not reviewed. Verify before relying. |
| Surrogate statute extends to research | Yes, through the research-specific statute above | Health and Safety Code 24178 | Not reviewed. Verify before relying. |
| Minors consenting for themselves | None for research without IRB approval. Treatment consent exceptions do not apply to research. | 21 CFR 50 Subpart D; IRB policy | Not reviewed. Verify before relying. |
| Emancipated minors | Emancipated by marriage, active military duty, or court declaration. An emancipated minor is treated as an adult for consent to medical care. | Family Code 7002, 7050 | Not reviewed. Verify before relying. |
| State research law | Protection of Human Subjects in Medical Experimentation Act. A participant in a medical experiment must receive the Experimental Subject's Bill of Rights (ten listed rights) in a language they understand. Check with the IRB which provisions it applies to FDA-regulated studies. | Health and Safety Code 24170 to 24179.5; Bill of Rights at 24172 | Not reviewed. Verify before relying. |
| Genetic testing and privacy | The Genetic Information Privacy Act applies mainly to direct-to-consumer genetic testing companies. Medical information is protected by the Confidentiality of Medical Information Act. | Civil Code 56.18 to 56.186; Civil Code 56 and following | Not reviewed. Verify before relying. |
| Medical record retention | No general retention statute for physician offices found. Hospitals: 7 years after discharge, and for minors at least 1 year after age 18 and not less than 7 years. Confirm the rule for the site's license type. | 22 CCR 70751(c) (hospitals) | Not reviewed. Verify before relying. |
| Controlled substances | No separate state practitioner registration found. DEA registrants who prescribe must register with CURES (the state prescription drug monitoring program). | Health and Safety Code 11165.1 | Not reviewed. Verify before relying. |
| Data breach notification | State breach statute applies. Licensed clinics and health facilities have a separate reporting duty to the California Department of Public Health. | Civil Code 1798.82; Health and Safety Code 1280.15 | Not reviewed. Verify before relying. |
| Mandatory reporting | Child abuse (health practitioners are mandated reporters). Elder and dependent adult abuse. | Penal Code 11165.7, 11166; Welfare and Institutions Code 15630 | Not reviewed. Verify before relying. |
5.2 Maryland (illustrative only, verify before relying)
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Age of majority | 18 | General Provisions 1-401 | Not reviewed. Verify before relying. |
| LAR for research | No research-specific LAR priority statute found. At least one Maryland IRB limits consent for research to the competent adult, the parent of a minor, or an appointed legal guardian. Confirm the IRB of record's position before using any other surrogate. | IRB policy; counsel | Not reviewed. Verify before relying. |
| Surrogate statute extends to research | Health Care Decisions Act surrogate list governs treatment decisions. It does not expressly address research. | Health-General 5-605; IRB policy | Not reviewed. Verify before relying. |
| Minors consenting for themselves | None for research without IRB approval. Treatment exceptions (for example pregnancy, contraception, sexually transmitted infection, substance use; mental health counseling from age 16) do not apply to research. | Health-General 20-102, 20-104 (treatment only) | Not reviewed. Verify before relying. |
| Emancipated minors | No general emancipation statute found. A minor who is married or a parent has adult capacity to consent to medical treatment. | Health-General 20-102 | Not reviewed. Verify before relying. |
| State research law | A person may not conduct research using a human subject unless it is conducted under the federal regulations on the protection of human subjects, and this applies to all research regardless of funding source. In practice the Common Rule applies to FDA-only industry trials in Maryland. The law also gives public access to IRB minutes (with confidential information removed) and lets the Attorney General enforce it. | Health-General 13-2001 to 13-2004 | Not reviewed. Verify before relying. |
| Genetic testing and privacy | No research-specific genetic consent statute identified. Ask counsel. | Counsel | Not reviewed. Verify before relying. |
| Medical record retention | Adults: 7 years after the record is made, unless the patient is notified. Minors: until age of majority plus 7 years, unless the parent or guardian (or the minor, for care the minor consented to) is notified. Notice rules apply before destruction. | Health-General 4-403 (2026 statute text) | Not reviewed. Verify before relying. |
| Controlled substances | State Controlled Dangerous Substance registration with the Office of Controlled Substances Administration is required in addition to DEA. Practitioners must register with the prescription drug monitoring program before obtaining or renewing registration. | Maryland Department of Health, OCSA | Not reviewed. Verify before relying. |
| Data breach notification | State breach statute applies. Businesses that maintain data for another owner must notify the owner within 10 days of discovery. | Commercial Law 14-3504 | Not reviewed. Verify before relying. |
| Mandatory reporting | Child abuse and neglect (health practitioners). Vulnerable adult abuse. Duty of mental health providers regarding threats of violence. | Family Law 5-704, 14-302; Courts and Judicial Proceedings 5-609 | Not reviewed. Verify before relying. |
5.3 New York (illustrative only, verify before relying)
| Topic | State answer | Statute/source | Reviewed by/date |
|---|---|---|---|
| Age of majority | 18 | CPLR 105(j); Public Health Law 2504 (consent to treatment) | Not reviewed. Verify before relying. |
| LAR for research | No research-specific LAR priority statute found. Many IRBs look to the Family Health Care Decisions Act hierarchy (guardian, spouse or domestic partner, adult child, parent, adult sibling, close friend), sometimes limiting which classes may consent to research. Confirm the IRB of record's position. | Public Health Law Article 29-CC (treatment); IRB policy | Not reviewed. Verify before relying. |
| Surrogate statute extends to research | The Family Health Care Decisions Act addresses treatment decisions. It does not expressly address research. | Public Health Law Article 29-CC; IRB policy | Not reviewed. Verify before relying. |
| Minors consenting for themselves | None for research without IRB approval. | 21 CFR 50 Subpart D; IRB policy | Not reviewed. Verify before relying. |
| Emancipated minors | No general emancipation statute found. A person who is 18 or older, married, or a parent may consent to their own medical treatment. | Public Health Law 2504 | Not reviewed. Verify before relying. |
| State research law | Article 24-A protects human research subjects but does not apply to research that is subject to, and complies with, federal human subject regulations. FDA-regulated industry trials are usually outside it. | Public Health Law 2440 to 2446 (applicability at 2445) | Not reviewed. Verify before relying. |
| Genetic testing and privacy | Prior written informed consent is required for genetic tests. Samples must be destroyed within 60 days unless the person consents to longer retention. IRB-approved research may keep samples longer with written consent. | Civil Rights Law 79-l | Not reviewed. Verify before relying. |
| Medical record retention | Physicians: at least 6 years. Records of minors: contested; confirm with counsel. Education Law 6530(32) is read as at least 6 years and until one year after the minor reaches 18. Secondary sources (for example the 2006 trial court decision Pullman v Gormley) read 8 NYCRR 29.2(a)(3) as until one year after the minor reaches 21. Until counsel confirms, keep the longer period (section 3.8). Other licensed professions under the Board of Regents rules may differ. | Education Law 6530(32); 8 NYCRR 29.2(a)(3); counsel | Not reviewed. Contested. Verify before relying. |
| Controlled substances | Researchers using controlled substances need a license from the Bureau of Narcotic Enforcement (NYS Department of Health) in addition to DEA registration. Check whether a practitioner's existing authority covers clinical trial IP. | Bureau of Narcotic Enforcement licensing (form DOH-4330) | Not reviewed. Verify before relying. |
| Data breach notification | State breach statute applies (as amended by the SHIELD Act). | General Business Law 899-aa | Not reviewed. Verify before relying. |
| Mandatory reporting | Child abuse and maltreatment (physicians and other listed professionals). | Social Services Law 413 | Not reviewed. Verify before relying. |
Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.