Connecting forms for digital consent signing in Nettskjema

Requirements for consent in Nettskjema

• Consent should only be obtained if you are going to collect personal data.
• It must be possible to link a response to a consent. You can do this by linking the consent form to the questionnaire and Reference ID.
• Consent must be a standalone form.
• The form must only ask for what is necessary to
  • confirm consent
  • clarify any merging with, or reuse of, data in other contexts
• The consent is designed as a contract and must contain all the information the respondent needs about the project’s handling of data and contact information for possible withdrawal of consent.
• The consent questions cannot be designed in a way that locks the submission of responses.
  • When the consent form is to be reused via the consent portal in TSD, the respondent must also be able to submit responses to the form where consent is not given. The consent must be answerable several times by the same person. This is set in the settings.
  • The specific questions that confirm consent should be designed as mandatory yes/no questions with radio button.
  • If consent questions must or are desired to be designed with checkboxes, these cannot be mandatory, and you should add an extra mandatory question to get confirmation from the respondents that the completion and submission are complete and that the contract is understood.

Link forms together for anonymization

If you link several forms in a chain, you can avoid direct identifiable information being stored together with your dataset. The first form can be a consent form. Remember to collect all personal data together with the consent, so that your dataset becomes fully anonymized.

A consent form requires login and signing with ID-porten, so if you want to combine this with invitation by email/SMS, you must create a form for this prior to the consent form.

Creating a consent form

To create a consent form that delivers to TSD, you can use the predefined template in Nettskjema. You can find the templates by choosing Get form from template when creating a form.

1. Go to Nettskjema.
2. Click Create form. Enter the title of the form.
3. Select Get form from template under Form type.
4. Select Consent form and create the form.

The template is only a starting point and should be updated with information that is relevant for the respondent.

Link consent and questionnaire

This guide helps you set up Nettskjema so that respondents are forwarded to a new questionnaire after giving consent.

1. If the respondent consents, they can be forwarded to the questionnaire using forwarding.
   • Click the gear icon for the question that asks the respondent to consent or not.
   • Check the option Forward the respondent to a new form.
   • Enter the questionnaire under Form ID for forwarding for the response option Yes
     
2. Insert the question field Reference ID in the questionnaire(s) to which the respondents are forwarded. This field is hidden for the person answering the form but enables the data processor to link questionnaire responses to the correct consent.
3. Test that it works as expected.

How to select signing

1. First link both forms to TSD.
   See instructions on how to link a form to TSD here.
2. Select signing level on the consent form.
   • Use Signing with ID-porten level 4 if the person consents to retrieval of registry data (data from the National Population Register).
   • Otherwise, use Signing with ID-porten level 3.
3. Select login with the same level as the consent form, but without signing, on the next form. Do not ask for the national identification number in the questionnaire.
   • Only the consent form should have a question about the national identification number, where the question field Person ID will be pre-filled for users logged in with ID-porten.
4. Test that this works as expected.

Signing level

You can choose between signing with ID-porten level 3 and ID-porten level 4. Multiple persons can sign with level 3. We therefore recommend this level, unless the respondent is to sign for retrieval of registry data. If the consent is to be signed for retrieval of registry data, we recommend level 4. The background for this is, among other things, that HelseNorge uses level 4 for retrieval of health information.

In signing level 3, the respondent is sent directly to signing with ID-porten, whereas in signing level 4 they must open a signing document before they can sign. We recommend that you test yourself with a test form if you are unsure how this affects the respondents. Signing level 3 uses authenticated eSignature, which means that DigDir via Posten is responsible for the signing key, while level 4 uses advanced eSignature, where BankID is responsible for the signing key.

How the consent is collected

Data is only stored in TSD and the respondent’s digital mailbox, but not in Nettskjema or locally on the respondent’s machine.

1. The respondent goes to the form and logs in with ID-porten.
2. Nettskjema automatically fills in any fields in the form, such as the national identification number.
3. The respondent clicks Go to signing.
   • Data is delivered to TSD.
4. Nettskjema creates a PDF of the content of the consent and the respondent reviews and signs.
5. A copy is sent to the respondent’s digital mailbox, while a copy is sent and stored in TSD.

Note that the respondent must authenticate once more when the consent is to be signed. This is a necessary security mechanism for valid electronic consent.

Process consents in TSD

Forms linked to TSD deliver responses directly to TSD, and you must therefore process the consents in TSD.

• See this page for information on processing consents delivered to TSD.

Link data from several de-identified forms

If you have several de-identified forms that forward to each other, the data can be linked together, for example in Excel.

• Read how linking data across forms can be done here

Check the validity of a signed document

If it is necessary to check that a signature is valid, it is possible to check in Adobe Acrobat Reader. It is not possible inside TSD, because it requires an internet connection.

1. Export the signed PDF file from TSD to a secure machine where you are allowed to store the consent.
   • See instructions for export in TSD
2. Open the file with Acrobat Reader.

You can click on Signature Panel for more details about the signature.