Investigator Handbook

Chapter 1: Introduction

The Institutional Review Board (IRB) at Utah State University (USU) is a committee designated to prospectively review research involving human participants, and to conduct periodic reviews of such research. The IRB operates according to the Belmont Report, 45 Code of Federal Regulations (CFR) part 46, and other pertinent Federal and State guidelines. International studies involve the use and guidance applicable international human research standards such as those compiled in the Office of Human Research Protections’ International Compilation of Human Research Standards.

Mission Statement

Utah State University conducts research designed to create new knowledge and promote an improved quality of life for citizens of Utah, the nation, and the world. The IRB furthers the university research mission by:

  • Reviewing proposed research involving human participants, in order to serve as participant advocates in the context of research participation
  • Promoting high-quality studies that can provide benefits to participants and/or society;
  • Educating the larger university community about ethical issues in research with human participants; and
  • Overseeing compliance with federal, state, and university regulatory requirements for research with human participants.

Authority and Responsibility of the IRB

USU’s IRB operates under a Federal Wide Assurance (FWA). A FWA is a document which formalizes an institution’s commitment to protect human participants and is required by any institution that participates in federally supported human participant research. This is an agreement between the IRB and the Department of Health and Human Services (DHHS) outlining the responsibilities of the IRB in upholding the ethical principles of research involving human participants. These principles are outlined in the report of the National Commission for the Protection of Human Subjects in Biomedical and Behavioral Research entitled, Ethical Principles and Guidelines for the Protection of Human Subjects of Research, known as the “Belmont Report.”

Research activities are overseen for DHHS by the Office for Human Research Protections (OHRP). Other agencies that the IRB reports to include: the Office of Research Integrity, funding agencies, and USU’s Institutional Official. USU’s Institutional Official is the Vice President for Research. They are responsible for administering the program, ensuring compliance with the Public Health Service Act, Protection of Human Participants, and 45 CFR 46.

IRBs were established to protect the rights and welfare of human participants in research. The USU IRB has the authority to establish the site of review, approve, disapprove, or require modifications of research activities that fall within its jurisdiction. IRBs may work in conjunction with other universities or institutional committees. However, IRBs independently review proposed research projects based upon the principle that human participants must be adequately protected.

IRB Members

The Vice President for Research, or the Vice President’s designee, appoints members of the IRB, in consultation with the IRB Chair and HRP Director. Appointments generally have three-year terms. Federal requirements mandate that the IRB have a minimum of five members with varying backgrounds to adequately review research activities commonly conducted at USU. IRB members must be knowledgeable about institutional commitments and regulations, applicable laws, standards of professional conduct, and practice. The IRB membership must be diverse in race, gender, and cultural background. IRBs must include at least one person in each of the following categories:

  • A scientific member,
  • A non-scientific member,
  • A community member, which must be someone who is not affiliated with the institution, nor an immediate family member of a person who is affiliated with the institution.

It is important to note, too, that no member of the IRB may participate in the review of any project with which that member has a conflict of interest, except to provide information requested by the IRB. 

USU’s IRB roster is listed online on the Roster and Terms of Office page.

Chapter 2: Defining Research

All research projects involving human participants carried out by USU faculty, staff, or students are subject to review and approval, exemption, or Reliance by the IRB.


Federal Regulations define research as “a systematic investigation, including development, testing and evaluation, designed to develop or contribute to generalizable knowledge” [§45CFR46.102(d)]. A systematic investigation is a process that involves the formulation of a hypothesis, exploration of a theme, or establishment of research questions, and the collection and/or analysis of data that will lead to a conclusion that either proves or disproves the hypothesis, addresses the themes, or that answers the research question.

Research generally does not include operational activities such as defined practice activities in psychology or social work, or studies for internal management purposes such as program evaluation, quality assurance, quality improvement, fiscal or program audits, marketing studies or contracted-for services. It also does not include certain public health surveillance activities done in partnership with a public health authority, collection and analysis efforts for certain criminal justice purposes, or authorized operational activities in support of intelligence/homeland security/defense/national security missions. However, even some of these activities may include or constitute research in circumstances where there is a clear intent to contribute to generalizable knowledge.

Sometimes the issue of whether or not the study will contribute to generalizable knowledge is unclear. For example, some qualitative studies, which may not directly “contribute to generalizable knowledge,” are still research. In addition, course research assignments conducted by students may be research even if they are limited in scope.

For the purpose of determining the need for IRB review (per the above definition of research), generalizable knowledge is knowledge that is “expressed in theories, principles, and statements of relationships” that can be widely applied to our experiences. Generalizable knowledge is usually created to share with other people, such as through presentations and publications. For example, Masters theses and PhD dissertations are generally considered to present generalizable knowledge.

Factors that the IRB examines in considering whether the project will contribute to "generalizable knowledge" includes:

  • Outcomes will be expressed in theories, statements, or principles that are of general applicability;
  • The activities are designed to draw general conclusions;
  • The findings would be representative of more than just the individuals under direct study;
  • The information contributes to a theoretical framework or established body of knowledge;
  • Publication, presentation, or other distribution of the results are intended to inform the field of study;
  • The primary beneficiaries of the outcomes/outputs are other professionals, practitioners, researchers, and/or scholars;
For example, an oral history project which generates only information about the person or persons under study, and makes no attempt to draw conclusions about a broader cultural context, generally will not yield results that hold across additional populations. Focus groups designed to understand a phenomenon will generally yield results that hold across additional contexts or populations.

If you plan to present or publish the work or otherwise share results of the study, it is probably research. If the research being conducted is only used for instructional purposes, it may be excluded from IRB Review, and you might consider filing a Non Human Subjects Research (NHSR) Determination.

Criteria used for review of research follow basic principles and guidelines for the protection of its participants, established in The Belmont Report. These principles outline the acceptable conduct of research involving human participants. The criteria are summarized below.

  • Respect for persons, or autonomy, requires recognizing the personal dignity and autonomy of individuals, and provides special protection for persons with diminished autonomy.
  • Beneficence creates an obligation to protect people from harm by maximizing anticipated benefits and minimizing possible risks.
  • Justice requires that the benefits and burdens of research be distributed fairly.

All research conducted by or at USU that includes human participants is reviewed using these principles, in conjunction with regulatory requirements at 45 CFR 46. Utah State University promotes each principle with policies and procedures overseen by the IRB. For example, the principle of “respect for persons” requires researchers to obtain informed consent, “beneficence” requires a risk/benefit analysis of the research to minimize risks and maximize benefits to the research participants, and “justice” requires that participants be fairly selected.

In determining whether a proposed activity is research, the following criteria are applied, as outlined in the “Not Human Subjects Research” Determination:

  • Does the activity meet the definition of “research” as defined above?
  • If yes, does the research involve “human participants” as defined below?
  • If both of the above criteria are answered “yes” the protocol must be reviewed and approved by the IRB.

To avoid potential regulatory consequence, researchers should consult the IRB if they are uncertain whether or not a study qualifies as research with human participants.

Defining Human Subjects

While the regulatory language refers to “human subjects,” the USU IRB recognizes the autonomy of prospective participants. Humans are not “subject” to research or researchers’ requests, but are rather participants in our shared inquiries. Therefore, the USU IRB and its representatives use the term “human participant” rather than “human subject” when not directly quoting the regulations.

Human subject is defined by Federal Regulations as: “

Human subject means a living individual about whom an investigator (whether professional or student) conducting research: (i) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; OR (ii) Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.”

Living individual: The specimen(s)/data/information must be collected from live participants. Cadavers, autopsy specimens / information from participants now deceased are not human participants; however, IRB review and approval is required for projects involving existing data, including data or specimens from deceased individuals.

About whom: A human participant research project requires the data received from the living individual to be about the person.

Intervention: includes both physical procedures by which information or biospecimens are gathered (e.g., venipuncture) and manipulations of the subject or the subject's environment that are performed for research purposes.

Interaction: Includes communication or interpersonal contact between the investigator and the participant. This includes face-to-face, mail, and phone interaction as well as other methods of communication.

Private: information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public.

Chapter 3: Types of IRB Review for New Protocols

There are three categories of substantive IRB review for new protocols. The categories are shown in the table below and described in more detail in the following sections of this chapter.

Exempt Review Expedited Review Full Review
Some Research is exempt from federal regulations. Categories of exemption are listed in 45 CFR 46.104. Research meets the criteria for expedited review. Fully convened IRB is not necessary. Approval is reported at the next meeting or by a monthly report to the board. Research involves issues that do not qualify for exempt or expedited review. A convened meeting of the board is required.

Exempt Review

Under the Common Rule, some research is exempt from most of the requirements in the regulations. Greater than minimal risk projects are not eligible for exemption. In addition, all of the Belmont Principles must still be present in the design of the project. To ensure these things, the USU IRB applies a Limited IRB Review process for projects that qualify for exemption.

It is important to note that all research – even research that investigators believe falls into one of the exempt categories – must be submitted to the IRB prior to the beginning of research activities. The IRB, not the individual researcher, determines the appropriate review categorization of each study. It is also within the IRB’s purview to establish procedures that are consistent with the protection of the participants, even if the research is found to be exempt.

A consent process is typically appropriate and often required for exempt studies involving prospective interactions with participants, and this information must be submitted with the supporting documentation for the study. The extent of the consent process required for the study will be determined by the IRB, and a full consent process, including participant signatures on digital or physical consent documents, is not unusual.

If the IRB determines a study is exempt, the researcher will receive a Certificate of Exemption which is valid for five years, after which the study will be automatically closed. If the research will extend beyond five years, it is the responsibility of the Principal Investigator (PI) to notify the IRB before the study’s expiration date and submit a new application to continue the research.

As part of the IRB’s quality assurance procedures, exempt research may be randomly selected for continuing review during the period of exemption. If so, the PI will receive a request for completion of a Post Approval Monitoring process; a representative from the IRB may also be required to review materials related to the study, including consent documents, recruitment materials, and data maintenance.

In all cases, it is the PI’s responsibility to notify the IRB prior to making any changes to the study by submitting an Amendment request. This will document whether or not the study still meets the requirements for exempt status under federal regulations.

If the study does not meet the criteria for exemption or if the issue is not clear and/or any of the required supporting documents are missing, the researcher will be notified via the protocol submission system as to what is required before an exemption determination can be made. 

Several media and organizational outlets have released false or misleading information regarding certain disciplines (oral history, journalism, biography, literary criticism, legal research, and historical scholarship) falling entirely outside of any oversight by the Revised Common Rule. It is important for researchers to note that the core definition of “research” has not changed in the Revised Common Rule. Research means “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”

“Scholarly and journalistic activities… that focus directly on the specific individuals about whom the information is collected” is not research under the federal definition. Those types of activities have never been considered research by the current USU IRB administration. The USU IRB abides by the Department of Health and Human Services guidance on when those activities rise to the level of “research” under 45 CFR 46, which notes that:

[A] significant portion of the activities that are characteristic of these fields fall outside of the category and therefore remain within the scope of 45 CFR 46. Studies using methods such as participant observation and ethnographic studies, in which investigators gather information from individuals in order to understand the beliefs, customs, and practices, not only of those individuals, but also of the community or group to which they belong, would not [be excluded from] 45 CFR 46. The purpose and design of such studies or activities is to reveal something about the community or group – that is, to develop generalizable knowledge. Because the purpose of such studies or activities is not to limit the inquiry to knowledge about the particular individuals being observed, the protections provided by the requirements of 45 CFR part 46, such as the requirement to minimize any harm to the specific individuals from which the information was collected, are appropriate. Such activities would continue to fall within the scope of the definition of “research” under the Revised Common Rule.

You may view that guidance in its entirety here.

The USU IRB continues to make its Non-Human Subjects Research Determinations available to researchers whose work involves scholarly activities where the necessary oversight might not always be clear. We encourage USU researchers to take advantage of that short process, which is typically completed in the same business day as submission. Consistent with longstanding guidance from HHS, the IRB will remain the only source of Exemption determinations.

Categories of Exemption

Research that falls into any of the following categories is eligible for Limited IRB Review:

1. Exemption #1 reads:

Research, conducted in established or commonly accepted educational settings, that specifically involves normal educational practices that are not likely to adversely impact students’ opportunity to learn required educational content or the assessment of educators who provide instruction. This includes most research on regular and special instructional strategies, and research on the comparison among instructional techniques, curricula, or classroom management methods.

It is important to note that under this exemption category, there can be no likelihood of adverse impact to assessment of an educator. There also can be no likelihood of adverse impact to students’ opportunity to learn required educational content. For example, students cannot be pulled out of core subjects for research participation, and neither can the educational research itself be likely to negatively impact student learning of those core content areas.

This is not to say that research which might have an adverse impact on those areas cannot be completed, it simply means that it cannot be completed using this exemption. Expedited Review processes are still available to researchers who need to be able to, for example, use core content class time for behavioral interventions, or assess culturally competent ways of teaching that might reflect negatively on an instructor.

2. Exemption #2 reads:

Research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) if at least one of the following criteria is met: (i) The information obtained is recorded in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subject; (ii) Any disclosure of the responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation, or (iii) the information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and the IRB conducts a limited IRB review to make required determinations.

Because USU’s Human Research Protection Program is fully accredited by AAHRPP, we have always completed a limited review of exempt projects. Please note that children are still not permitted to be involved under this exemption except in the case of public observation; in such instances, there can be no interaction by the research team.

3. This exemption is quite long, and we encourage you to read the full text if this exempt appears to be applicable to your research. This exemption is for 

Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following criteria is met: The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects; OR (B) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; OR (C) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by §46.111(a)(7).

Because USU’s Human Research Protection Program is fully accredited by AAHRPP, we have always completed a limited review of exempt projects. For this exemption, which was introduced in 2019, the USU IRB provides the following guidance:

Prospective Agreement

Data collection can only take place with adult subjects who are able to consent for themselves. Please note that several states do not use 18 as the age of majority, so this might be something you need to take into account in your recruitment plan (e.g. use of MTurk participants). The participants must prospectively agree to the specific intervention, although deception (or withholding of full information) is permitted as long as the participant also prospectively agrees to be deceived or to proceeding without full information. Example language for this is included in our Informed Consent for Exemption template.

As with Exemption 1, this does not mean that you may not ever use deception or lack of full information in a study. If your study does not allow participants to be alerted to the deception or lack of full information, it simply means that it must take place under Expedited or Convened IRB review.

Data Collection

The exemption is quite restrictive in terms of the ways data can be collected. Data collection is limited to: verbal or written responses by the subject, data entry by the subject themselves, or observation of the subject including audiovisual recording. No devices, medical procedures, sensors, passive data collection methods (other than AV recording) etc. would be permitted under this exemption.

The Intervention

The intervention itself is limited to one (or a combination) of the following: (1) communication or interpersonal contact with the participant; (b) performance of a cognitive, intellectual, educational, or behavioral task; or (3) manipulation of the subject’s physical, sensory, social, or emotional environment. The examples HHS has given include manipulating a keyboard, doing a puzzle, or the introduction of music during a participant’s regular walking activities. Physical exercise, range of motion activities,  or other physical tasks or manipulations cannot be included under this exemption.

Additionally, the intervention must be brief in duration, harmless, painless, unlikely to have adverse effects on the participant following participation, and unlikely to cause emotional discomfort, offense, or embarrassment. Brief in duration means that the intervention with any given participant will not span more than three hours (separate sessions are okay), and will be contained within a single day. Data collection can be distinct from the intervention in terms of the time permitted: if there is an hour and a half of assessments, followed by a two hour intervention, and then another hour and a half of assessments, the project could be eligible for exemption if the assessments are covered by Exemption #2.

Privacy & Confidentiality

The same restrictions that exist within subsections (i) – (iii) of Exemption 2 also exist here. The data researchers collect must be either anonymous, benign, or the collection and storage procedures must be reviewed and approved by the IRB

4. The exemption reads:

Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met: (i) the identifiable private information or identifiable biospecimens are publicly available; (ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not have contact with the subjects, and the investigator will not re-identify subjects; or (iii) the research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under HIPAA.

While the class of data that can be used for this exemption has expanded, there are some important items to note. For all subsections, the data must be truly secondary. This means it must all exist because a) it was collected for another, non-research purpose, or b) it was originally collected with the informed consent of the participant for a research study. For data that does not yet exist, if the way the data is being collected in the primary instance is shifted at all for the purposes of research, it does not qualify for this exemption; Expedited review should be sought. For (i), the data must be truly publicly available. Any person must be able to access that which a researcher is seeking to access under this exemption. Subsection (ii) requires that the participant’s identity not be able to be readily ascertained from the data – this might involve the use of an honest broker, for example, to provide you with the data. And Subsection (iii) requires that the researcher still follow all HIPAA requirements in obtaining the secondary data. This will generally require a HIPAA Waiver of Authorization, which can only be granted via an Expedited Review process, so expect for this particular exemption to take a little more time than the rest. However, on the whole, this exemption will save significant time for researchers by drastically broadening the type of data eligible for exempted use.

Utah State University’s IRB recognizes that many researchers are conducting important education-based research, which carries its own protective federal measures, akin to the HIPAA protections referenced above. To prevent duplicative regulatory oversight, the USU IRB has created a new, site-specific subsection of this exemption category for data that are protected by FERPA. Researchers who are accessing, using, or disclosing identifiable education records that are still subject to FERPA protections will be able to do so under this exemption category. This requires that the education records be accessed or used either (a) with a valid FERPA Authorization from the parent (K-12) or eligible student (higher education); (b) under one of the exceptions outlined in FERPA; or (c) from the institution’s data custodian, stripped of all identifiers. This subsection is not available to federally funded research. 

5. Exemption #5 reads as follows:

Research and demonstration projects that are conducted or supported by a Federal department or agency, or otherwise subject to the approval of department or agency heads (or the approval of the heads of bureaus or other subordinate agencies that have been delegated authority to conduct the research and demonstration projects), and that are designed to study, evaluate, improve, or otherwise examine public benefit or service programs, including procedures for obtaining benefits or services under those programs, possible changes in or alternatives to those programs or procedures, or possible changes in methods or levels of payment for benefits or services under those programs. Such projects include, but are not limited to, internal studies by Federal employees, and studies under contracts or consulting arrangements, cooperative agreements, or grants. Exempt projects also include waivers of otherwise mandatory requirements using authorities such as sections 1115 and 1115A of the Social Security Act, as amended.

(i) Each Federal department or agency conducting or supporting the research and demonstration projects must establish, on a publicly accessible Federal Web site or in such other manner as the department or agency head may determine, a list of the research and demonstration projects that the Federal department or agency conducts or supports under this provision. The research or demonstration project must be published on this list prior to commencing the research involving human subjects.

6. Exemption #6 reads as follows:

Taste and food quality evaluation and consumer acceptance studies:

(i) If wholesome foods without additives are consumed, or

(ii) If a food is consumed that contains a food ingredient at or below the level and for a use found to be safe, or agricultural chemical or environmental contaminant at or below the level found to be safe, by the Food and Drug Administration or approved by the Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture.

The USU IRB has not adopted Broad Consent, so the exemptions at sections 7 and 8 of the Common Rule are not applicable at Utah State University.

Expedited Review

Certain types of research do not require review by the convened IRB and may instead undergo an expedited review. These types of studies are reviewed by two board members and reported to the remaining board in a monthly report or at its next convened meeting. All research undergoing initial review using the expedited procedure must meet the following criteria:

  • The research presents no more than minimal risk to participants. (Not applicable for category (8)(b), as explained below).
  • The identification of the subjects or their responses will not reasonably place them at risk of criminal or civil liability or be damaging to their financial standing, employability, insurability, reputation, or be stigmatizing, unless reasonable and appropriate protections will be implemented so that risks related to invasion of privacy and breach of confidentiality are no greater than minimal (not applicable for category (8)(b)).
  • The research is not classified.
  • The category or categories of research allow review using the expedited procedure (1)-(9). When using category (8), the reviewer document must be able to determine and document whether category (8)(a), (8)(b), or (8)(c) applies.

To be eligible for expedited review, the proposed research must fall into one of the nine categories outlined by the federal regulations (see These categories apply regardless of the age of participants, except as noted.

1. Clinical studies of drugs and medical devices only when 1 of 2 conditions is met:

  • Research on drugs for which an investigational new drug application (21 CFR Part 312) is not required. (Note: research on marketed drugs that significantly increases the risks or decreases the acceptability of the risks associated with the use of the product is not eligible for expedited review), or
  • Research on medical devices for which (i) an investigational device exemption application (21 CFR Part 812) is not required; or (ii) the medical device is cleared/approved for marketing and the medical device is being used in accordance with its cleared/approved labeling.

NOTE: USU does not currently allow research falling in this category to be undertaken at USU.

2. Collection of blood samples by finger stick, heel stick, ear stick or venipuncture as follows:

  • From healthy, non-pregnant adults who weigh at least 110 pounds. For these participants, the amounts drawn may not exceed 550 ml in an 8 week period and collection may not occur more frequently than 2 times per week.
  • From other adults and children, considering the age, weight, and health of the subjects, the collection procedure, the amount of blood to be collected, and the frequency with which it will be collected. For these participants, the amount drawn may not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and collection may not occur more frequently than 2 times per week.

3. Prospective collection of biological specimens for research purposes by noninvasive means, such as:

  • Hair and nail clippings in a non-disfiguring manner
  • Deciduous teeth at time of exfoliation or if routine patient care indicates a need for extraction
  • Permanent teeth if routine patient care indicates a need for extraction
  • Excreta and external secretions (including sweat)
  • Uncannulated saliva collected either in an unstimulated fashion or stimulated by chewing gum base or wax or by applying a dilute citric solution to the tongue
  • Placenta removed at delivery
  • Amniotic fluid obtained at the time of rupture of the membrane prior to or during labor
  • Supra- and subgingival dental plaque and calculus, provided the collection procedure is not more invasive than routine prophylactic scaling of the teeth and the process is accomplished in accordance with accepted prophylactic techniques,
  • Mucosal and skin cells collected by buccal scraping or swab, skin swab, or mouth washings,
  • Sputum collected after saline mist nebulization

4. Collection of data through noninvasive procedures (not involving general anesthesia or sedation) routinely employed in clinical practice, excluding procedures involving x-rays or microwaves. Where medical devices are employed, they must be cleared/approved for marketing. Studies intended to evaluate the safety and effectiveness of the medical device are not generally eligible for expedited review, including studies of cleared medical devices for new indications. Examples:

  • Physical sensors that are applied either to the surface of the body or at a distance and do not involve input of significant amounts of energy into the subject or an invasion of the subject’s privacy
  • Weighing or testing sensory acuity
  • Magnetic resonance imaging
  • Electrocardiography, electroencephalography, thermography, detection of naturally occurring radioactivity
  • Moderate exercise, muscular strength testing, body composition assessment, and flexibility testing where weight and health of the individual are appropriate

5. Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for non-research purposes (such as medical treatment or diagnosis). Some research in this category may be exempt from the federal regulations.

6. Collection of data from voice, video, digital, or image recordings made for research purposes.

7. Research on individual or group characteristics or behavior (including, but not limited to: research on perception, cognition, motivation, identity, language, communication, cultural beliefs or practices, and social behavior) or research employing survey, interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies.

8. Continuing review of research previously approved by the convened IRB as follows:

  • Where research is permanently closed to the enrollment of new subjects, all subjects have completed all research-related interventions and the research remains active only for the long-term follow-up of subjects, or
  • Where no subjects have been enrolled and no additional risks have been identified, or
  • Where the remaining research activities are limited to data analysis.

9. Continuing review of research, not conducted under an investigational new drug application or investigational device exemption where categories two (2) through eight (8) do not apply but the IRB has determined and documented at a convened meeting that the research involves no greater than minimal risk and no additional risks have been identified.

Expedited review may NOT be used when: a) identification of the participants and/or their responses would reasonably place them at risk of criminal or civil liability or be damaging to the participant’s financial standing, employability, insurability, reputation, or be stigmatizing unless reasonable and appropriate protections will be implemented so that risks related to invasion of privacy and breach of confidentiality are no greater than minimal, or b) the information gained from the research is considered “classified”, or otherwise protected by the federal government.

The IRB must uphold the standard requirements for informed consent (or its waiver, alteration, or exception) regardless of the type of review (expedited or convened).

Expedited Review Procedures

Two board members, usually an IRB coordinator and an IRB member with appropriate expertise, conduct expedited reviews. Protocols submitted for expedited review must include all of the materials required in Kuali. The IRB may determine that the study is eligible for expedited review if it meets the applicability criteria and falls into one or more categories of research allowing review using the expedited procedure. Reviewers use the IRB Review Checklist to determine whether research meets the applicability criteria and is included in an appropriate category for expedited review. This determination must be made for each review, whether the submission is for initial review, continuing review, or review of modifications. If the reviewers determine that the project requires review by the convened IRB, the researcher will receive a new Review Type assignment in their protocol by way of notification.

The reviewers may exercise all of the authorities of the IRB except they may not disapprove the research. Research may only be disapproved by the convened IRB. A list of the protocols that receive expedited review since the last convened meeting is included in the packet of materials given to IRB members on a monthly basis and in preparation for convened quarterly meetings. Members may request additional information on any project which has received approval or those which have been amended through an expedited review process. Such requests are normally made through the IRB office.

The IRB may also approve minor revisions to already approved projects through expedited review. A minor change is one which, in the judgment of the IRB reviewer, makes no substantial alteration in (1) the level of risks to participants; (2) the research design or methodology; (3) the number of participants enrolled in the research; (4) the qualifications of the research team; (5) the facilities available to support safe conduct of the research; or (6) any other factor which would warrant review of the proposed changes by the convened IRB. In addition, added procedures must (7) involve no more than minimal risk, and (8) fall into categories 1-7 of research that would allow review using the expedited procedure. The expedited review procedure can only be used if the reviewers determine the modifications are minor as defined here.

Initial Review at Convened Meetings

For all studies that do not qualify as exempt or are not eligible for expedited review, protocol review is conducted by the convened IRB at bi-monthly meetings. In order for a new study to be reviewed, all required materials must be submitted by the PI to the IRB office. IRB office staff will conduct a pre-review to ensure all required materials are included before the protocol is sent to reviewers. However, reviewers may request additional data before they bring the protocol to the board. For this reason, the USU IRB recognizes and encourages PIs to communicate with the IRB regarding full board protocols.

The protocol is distributed to all members of the IRB and becomes the primary source used by the IRB to determine whether a study will be approved, whether changes will be requested prior to approval, or whether the study will be disapproved.

USU’s IRB uses a system of primary reviewers. Under this system, one or two members of the IRB are appointed to carefully review the proposed research. At least one of these primary reviewers will have scientific or scholarly expertise as required to review the study. If the study involves research with vulnerable populations, at least one of the reviewers will be in a position to represent the interests of individuals in that population. If the expertise required to carry out the review is not available on the IRB, the IRB Chair may appoint consultants to work with the IRB. Review procedures for initial reviews are set forth in the Standard Operating Procedure 406.

Continuing Review of Studies at Convened Meetings

For all studies that do not qualify as exempt or are not eligible for expedited review, protocol review is conducted by the convened IRB. In most cases, a study that was initially approved by the convened IRB will also receive continuing review in a meeting of the convened IRB. Studies may be approved by the IRB for up to a year; however, the IRB may choose to review projects more frequently. In order for a previously approved study to be reviewed, the PI must submit a status report for review to the IRB office. 

The Status Report Form that the research team submits to the IRB includes:

  • The number of participants accrued;
  • A summary since the last Convened IRB review of:
    • Adverse events and adverse outcomes experienced by research participants;
    • Unanticipated problems involving risks to participants or others;
    • Participant withdrawals and the reasons therefor;
    • Any complaints about the research;
    • Any unreported modifications;
    • Any relevant recent literature produced as a result of the research project; and
    • Any interim findings.
  • Any relevant reports from other research sites
  • The researcher’s current risk:potential benefit assessment based on analyses conducted to date

This material, along with the protocol and any amendments, is distributed to the IRB at least one week in advance of the convened IRB meeting. Members of the IRB will then determine whether the protocol needs verification from sources other than the researchers that no material changes have occurred since the last review by the Convened IRB. Members of the IRB use the information to determine whether the study may continue, whether the current informed consent document is complete and accurate, whether any significant new findings have arisen that might relate to participants’ willingness to continue participation, whether additional information about the study should be provided to participants, whether changes to the research will be required, and whether any reason exists for the study to be suspended or terminated.

Review of Amendments by the Convened IRB

The Principal Investigator may apply for changes in ongoing research studies that have been previously approved by the IRB. Preparation for submission shall be as outlined in “Amendments and Revisions,” et. seq., in Chapter 6, below. Minor modifications can be made through the expedited review process. Non-minor modifications will be reviewed in a convened meeting of the IRB. In order to be approved, an Amendment must be submitted by the PI to the IRB Office along with all documents. This material is forwarded to IRB members at least one week in advance of the convened IRB meeting.

The outlined materials – along with a copy of the initially approved application, and if appropriate, the approved Informed Consent document – are used to determine whether the amendment will be approved, whether changes will be required, or whether the amendment will not be approved.

Primary reviewers may be assigned by the IRB Chair, and they shall review the materials and present recommendations to the convened IRB. Review of amendments and modifications are further discussed in Chapter 6, below.

Chapter 4: Protocol Submissions

Submission Deadlines and Meeting Schedule

IRB applications may be submitted at any time. Applications are entered in the queue for review in the order they are received. Most research with human participants does not need the full board’s review. As soon as a protocol application is received by the IRB office, the IRB staff will determine if the application can be reviewed under the regulations for Expedited Review and, if so, the review process will begin without waiting for a convened board meeting.

Submission deadlines only apply to applications that require Full Board Review and such applications must be received 4 weeks before a scheduled monthly IRB meeting. A list of IRB meeting dates and submission deadlines may be found on the IRB Timelines page. Protocols that require full IRB review but are not received by the deadline will be held over for consideration until the next meeting.

Research that requires Full Board Review includes any protocol in which the risk to participants is more than minimal. Minimal risk “means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.” In addition, the Full Board must review any research that does not fit any of the Expedited Review Categories of the federal regulations.

Required Documentation

For any human research that is not exempt from the regulations, the following documentation is required for review. For initial review, the following documents are distributed by IRB staff to all IRB members who will be charged with reviewing the protocol. For review by the convened IRB, the documents are distributed to all members of the IRB:

  • The IRB Application
  • A copy of the full proposal (e.g., grant proposal, thesis/dissertation proposal)
  • The proposed Informed Consent document or Letter of Information
  • Any proposed privacy authorization
  • Any advertisement to be used for recruitment
  • Any brochures to be used during the study
  • Any survey instrument to be administered
  • Proposed types and amounts of compensation for participation
  • The Reviewer’s Checklist, to be used by primary reviewers and reviewers assigned to conduct reviews under expedited procedures

After initial review, PIs should anticipate requests for additional documentation to facilitate other types of review by the IRB.

Continuing Review requires a copy of the Status Report Form for the protocol, prepared by the PI.

A Minor Modification requires a submitted Amendment, prepared by the PI in the protocol submission system.

The IRB staff checks to verify that all documents required for the review are delivered to the IRB and IRB reviewers. When the review will be by the convened IRB, the packet is delivered at least 5 days prior to the IRB meeting where the protocol is to be reviewed, whether for initial review, continuing review, review of minor modifications, review of unanticipated problems or review of serious or continuing noncompliance.

Review Process

After the appropriate reviewers have completed the protocol review, it will either be approved, sent back for modifications, or denied in a meeting of the Convened IRB. Protocols that spend an excessive amount of time with the PI for modifications will be returned to the PI, and must be submitted as a new protocol. This generally will not be less than two weeks (for an Exempt Application) or four weeks for an Expedited/Convened IRB review. You may always contact the IRB ( to learn the status of your pending protocol.

Ethical Considerations

The IRB has jurisdiction over all aspects of the review of research, including:

  • Methods of identifying potential participants
  • Methods proposed for contacting potential participants
  • Recruitment materials and proposed compensation
  • Pilot studies
  • Proposals to use or provide stored blood, tissues, or confidential data
  • Surveys and questionnaires
  • The informed consent document(s) and process (or Letter of Information)
  • The proposal including summary literature review and research design
  • Any risks to participants from the proposed research are reasonable in relationship to anticipated benefits
  • Proposed changes to the research
  • Unanticipated problems involving risk to the participant or others
  • Yearly continuing reviews
  • Determination of a protocol’s eligibility for waiver of full review

Planning an IRB Submission

Principal Investigators (PIs) should understand that research with human participants must be carried out under a research plan or “protocol” that has been submitted and approved by the IRB. All changes in the protocol must be approved by the IRB before they are implemented. PIs must submit a research protocol detailing how all phases of the study are to be conducted. PIs must also submit the research portion of any grant that will support the proposed research. Note that the grant sections do not replace the detailed description of how all aspects of the study are to be accomplished.

Application information and processes can be found in our Kuali resources. All protocol determinations are made in the Kuali system, including determinations that document if a study does not fall under the purview of the IRB (e.g. Not Human Subject Research submissions).

  • The PI of a research protocol must be a USU faculty member, a research scientist or a research specialist. A PI will have a role statement that includes research.
  • If the researcher is a student, the faculty member directing the student’s research must be listed as the PI and the student as “Student Researcher” or “Research Assistant.”
  • If a study is to be conducted off-campus, the PI should obtain a letter of approval from the research site and submit a copy of that approval to the IRB.

Preparation for human research should reflect careful and unhurried consideration on the part of the PI. Information such as questions the PI proposes to answer and the precise methodology needed to obtain those answers must be included in the research plan. It is not acceptable to simply give reference to a research grant, or to copy the grant proposal’s narrative into the application.

Approval or clearance from institutions, facilities, school principals, school districts etc. where research will occur is should be obtained prior to beginning the study. For K-12 school settings, this is not optional. Ideally, the PI will present appropriate letters of approval with the protocol submission to the IRB for review. However, research involving schools usually requires USU IRB approval prior to district/school approval. Contact the IRB for more information. A Reviewer’s Checklist is available to assist the investigator in preparing the IRB submission.

When conducting transnational research, the Principal Investigator will have primary responsibility for understanding and complying with the laws and regulations of the country in which the research will be conducted. It may be required, for example, to receive review and approval from an IRB or another review body that has jurisdiction. All research must meet at least the ethical standards required of research performed in the U.S., and research participants must be afforded equivalent protections, whether the research is funded by a U.S. government agency or not. To help researchers identify laws and regulations that might apply in transnational research the following link is available on the OHRP website. If the researcher cannot provide evidence of local review of the project, they must budget additional time for the review process to allow the USU IRB to gather the required resources for an effective review of a transnational project. See Series 700 of the SOPs for more information on timelines and requirements.

The USU IRB will also provide support to researchers involved in transnational research to the degree possible by, for example, communicating with foreign IRBs, helping to locate researchers knowledgeable about the local context in the country where the research is to be conducted, or researching laws and standards in the location of the proposed project. All research protocols filed for transnational work must be submitted for expedited review, as most countries do not permit human subjects research to be “exempted.” Therefore, to meet international standards of review, the USU IRB cannot review exempt protocols for transnational research.

Dissertation and thesis research to be conducted outside of the United States must receive approval from the student’s graduate supervisory committee prior to submission to the IRB. A copy of the signed committee approval sheet must be provided to the IRB before the application can be reviewed.

Assigning Study Risk Category and Frequency of Continuing Review Reporting

New protocols are assigned categories of risk and frequency of continuing review. In order to approve research, the IRB must determine the degree of risk. Studies involving more than minimal risk are reviewed at least annually, and may be reviewed more often at the recommendation of the IRB.

PIs have a responsibility to minimize risks and to maximize the benefits that participants will experience related to the research. In general, benefits, either to the participants themselves or to the participant population, must outweigh the risks participants will experience. In assessing risks and benefits, incentives to participate in research may not be considered benefits to the participants. Risks to vulnerable populations are further discussed in Chapter 7 of this handbook. The IRB Chair and the HRP Director are also available to assist in exploring appropriate ways to minimize risk in human research. The risk categories are defined by 45 CFR 46.102 as follows:

Minimal Risk Greater Than Minimal Risk
Activity where the probability and magnitude of harm or discomfort anticipated in the research is not greater in and of themselves than those ordinarily encountered in daily life or during performance of routine physical or psychological examinations or tests. Research involving greater risk of harm than ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests, but presenting the prospect of direct benefit to the individual subjects; or the research presents no prospect of benefit to the subject, but is likely to yield knowledge about the disorder or condition.

Confidentiality Risks

Among the most commonly encountered risks in research reviewed by the USU IRB are those associated with privacy of individuals and confidentiality of data. These issues are sometimes conflated, in large degree because of ambiguity in regulations. For example, the Health Insurance Portability & Accountability Act (HIPAA) includes the Privacy Rule. The Privacy Rule pertains primarily to confidentiality issues, rather than privacy issues; however, a breach in confidentiality can easily impact an individual’s privacy interests. Privacy and confidentiality issues are defined and addressed below.

Privacy is the ability of an individual or group to seclude themselves or information about themselves and thereby reveal themselves selectively. The boundaries and content of what is considered private differ among cultures and individuals, but share basic common themes. When something is private to a person, it usually means there is something within them that is considered personally sensitive. The degree to which private information is exposed therefore depends on how the public will receive this information, which differs between places and over time. Privacy may be sacrificed or knowingly “waived” to some degree when an individual decides to participate in research. In developing strategies for the protection of subjects’ privacy, consideration should be given to:

  • The methods used to identify and contact potential participants.
  • The settings in which an individual will be interacting with an investigator.
  • The observation of the interaction by individuals not related to the research.
  • The methods used to obtain information about participants.
  • The nature of the requested information.
  • The nature of the experiences related to the research.
  • Information that is obtained about individuals other than the “target participants,” and whether such individuals meet the regulatory definition of “human participant” (e.g., a subject provides information about a family member for a survey).
  • Privacy guidelines developed by relevant professional associations and scholarly disciplines (e.g., oral history, anthropology, psychology).
  • How to access the minimum amount of information necessary to complete the study.

What is private depends on the individual and can vary according to gender, ethnicity, age, socio-economic class, education, ability level, social or verbal skill, health status, legal status, nationality, intelligence, personality, and the individual’s relationship to the investigator. For example, protecting the privacy interests of a young child might mean having a parent present at a session with an investigator. Protecting the privacy interests of a teenager might mean having a parent absent.

Confidentiality refers to the researcher’s agreement with the participant about how the participant’s identifiable private information will be handled, managed, and disseminated. The research proposal should outline strategies to maintain confidentiality of identifiable data, including controls on storage, handling, and sharing of data. When appropriate, Certificates of Confidentiality could be used to maintain the confidentiality of identifiable data. 

When the IRB evaluates research proposals for strategies for maintaining confidentiality, where appropriate, consideration will be given as to whether:

  • Methods to shield participants’ identity adequately protect participant privacy.
  • There is a long-range plan for protecting the confidentiality of research data, including a schedule for destruction of identifiers associated with the data.
  • The consent form and other information presented to potential research participants adequately and clearly describe confidentiality risks.
  • The informed consent process and the informed consent document, and if applicable the Authorization Form, clearly delineates who will have access to the subject’s information and under what circumstances data may be shared (i.e., government agencies, sponsors).

Collaborating With Other Institutions

This is a complex area with many nuanced requirements, so the IRB has built out an entire website dedicated to this topic. Please visit our Reliance Agreements webpage for information and flowcharts regarding collaborations across institutions. 

When the USU researchers is the lead researcher on a multi-site study, they must have a plan for managing information relevant to the protection of research participants, including collecting and communicating from all research sites:

  • Unanticipated problems involving risks to participants or others;
  • Interim results that might impact informed consent or the research methods; and
  • Modifications or amendment to approved protocols.

Internet Research

When doing research on the internet, PI’s are still bound by the confidentiality and privacy considerations that govern all research. Since a PI cannot know if participants are legally able to give consent or if participants are who they say they are, the PI must be particularly careful to screen participants to the best of their ability. Also, many web communities consider their communications to be private, even when they are publicly available; thus, private information is defined as such by the participant, not the PI.

Existing Data Analysis

Research using previously collected data that received IRB review is generally considered to be exempt. Exceptions occur when the data contain information that could be used to personally identify an individual. Such information could include birth date, addresses, geographical identifiers, or social security numbers. IRB review and approval is required for all existing data research.

Secondary Research Participants

Often researchers ask participants to describe characteristics of a family member, friend, business associate, or another person who is not the primary research participant. These people are called “secondary research participants.” If the information gathered from the participant is about a living individual, and the researcher obtains identifiable private information about that person, then that person is considered to be a participant in the research. Much research that asks about secondary participants can be considered to be “minimal risk,” and informed consent from the secondary participants may not be required. Under some circumstances, however, informed consent cannot be waived. These instances must be evaluated on a case-by-case basis and follow the same criteria that is followed for waiving consent for primary participants.

International Research

All NIH-supported research that takes place internationally and utilizes human participants must be reviewed by an IRB or the equivalent in the target country and it is the policy of USU’s IRB to recommend such review for unfunded research as well. If the research is performed by a USU-affiliated researcher then USU’s IRB reviews the protocols, keeping in mind the local norms of informed consent, respect for persons, beneficence, and justice in the country where the research will take place. Considerations for investigators conducting research outside the U.S. are presented in these AAHRPP webinar slides.

Training in the Protection of Human Participants

USU and federal regulations require that Principal Investigators, Co-Investigators and any research personnel who will be performing research activities with participants (i.e. obtaining informed consent, collecting data) or performing data analysis must receive training in the ethical protection of human participants. USU uses CITI online training to fulfill this requirement. The IRB cannot begin review of an application until notification is received from CITI that the PI and any research staff and students have completed the training with a minimum score of 80%. Renewal is required every three years. Training modules may be accessed at

PIs are also responsible to adequately train and inform all personnel in their facilities, whether or not they are involved directly in the conduct of human research, concerning participant safety and privacy and preserving the confidentiality of research data associated with participants.

With advanced notice, the IRB can provide various presentations to individual groups or classes; however, certification is not available using this method.

Advertisement for Participant Recruitment

Studies may require the use of print or other media (flyers/brochures, television, internet or radio advertisement) in order to recruit the participant population. This information must be submitted to the IRB prior to use. Any type of advertising for research participants that is intended to be seen or heard by possible participants is part of the selection process. The IRB must review both the information contained in the advertisement and the mode of its communications. Information placed on a website for the purposes of study recruitment must be reviewed and approved by the IRB. Further information can be found on the IRB Guidelines page.

Advertisements should not be coercive and should not state or imply a certainty of favorable outcome or other benefits beyond what is outlined in the consent document and the protocol. No claims should be made, either explicitly or implicitly, that the intervention or assessment will improve a participant’s outcome.

Advertisements should not promise “free treatment” when the intent is only to say participants will not be charged for taking part in the investigation. The IRB will determine if the promise of treatment without charge is coercive to financially constrained participants. Advertisements may state that participants will be paid, but should not emphasize the payment.

Advertisements must include:

  • The purpose of the research, or why participants are being sought;
  • Contact information for a person on the study team who can answer questions about the research or register complaints about the recruitment process;
  • Contact information for the PI, if different from the person above;
  • The protocol number and reference to Utah State University’s IRB;
  • The  basic  information  a  prospective  participant  would  need  to  know  to  determine  eligibility  (such  as inclusion/exclusion criteria);
  • The  basic  information  a  prospective  participant  would  need  to  know  to  determine  interest  (such  as  the location of the research, the compensation, and the time commitment)

Chapter 5: Informed Consent Requirements

A PI may not involve human participants in research unless the PI has obtained the informed consent of that individual or the individual’s legally authorized representative, or a waiver of consent has been granted by the IRB. A Letter of Information (which does not require the participant’s signature) is an alternative type of informed consent and may be used if a waiver of documentation of informed consent has been granted. Additional information about the conditions required for waiver of documentation and waiver of informed consent is provided later in this chapter.

The PI must seek informed consent only under circumstances that provide the prospective participant or the representative sufficient opportunity to consider whether or not to participate and minimize the possibility of coercion or undue influence. The informed consent document or Letter of Information must include the following:

  • If the document spans four or more pages for a sponsored project or clinical trial, it must begin with a concise presentation of key information explaining why someone might or might not want to participate in this research study
  • No exculpatory language that waives or appears to waive any legal rights may appear in the informed consent document
  • No exculpatory language that waives or appears to waive liability for negligence for the researchers, the sponsor, or the institution may appear in the informed consent document
  • A statement that the study is research must appear
  • The expected duration of participation must be disclosed
  • A description of all procedures the participant will be asked to complete or participate in must be disclosed
  • The document must identify any procedures that are experimental
  • There must be a description of any foreseeable risks or discomforts to the participant
  • There must be a description of any benefits to the subject that may reasonably be expected to result from the research
  • A description of any benefits to others that may reasonably be expected to result from the research must be included, if applicable
  • There must be a full disclosure of appropriate alternative procedures that might be advantageous to the participant
  • There must be a full disclosure of any appropriate courses of treatment that might be advantageous to the participant
  • A statement describing the extent to which confidentiality of records identifying the subject will be maintained must be included
  • If the research is greater than minimal risk, the document must contain a disclosure regarding whether compensation is available if injury occurs (if so, the method of compensation and where to go to obtain more information about compensation)
  • If the research is greater than minimal risk, the document must contain a disclosure regarding whether medical treatment is available if injury occurs (if so, what kind of medical treatment and where to go to obtain more information about the medical treatment)
  • A contact person must be listed for answers to questions about the research
  • A contact person must be listed for answers to questions about research participants’ rights
  • A contact person must be listed in the event of a research-related injury, regardless of level of risk
  • A statement must be included that participation is voluntary
  • A statement must be included that refusal to participate will involve no penalty, and no loss of benefits to which the participant is otherwise entitled
  • The document must include a statement that the participant may discontinue participation at any time with no penalty, and no loss of benefits to which the participant is otherwise entitled
  • A disclosure must be made regarding whether the research team intends to de-identify and share or use the data/information/biospecimens collected here for future research
  • When appropriate, at the judgment of the Primary and Secondary Reviewers, the following information must also be disclosed:
    • Whether a procedure involved carries risks to the subject or fetus (or fetus if likely to become pregnant) that are currently unforeseeable
    • Circumstances under which participation may be terminated by the researchers without regard to a participant’s consent to be withdrawn
    • Any additional costs to the participants that may result from participation in this research
    • Consequences of withdrawal
    • A process for withdrawal
    • Significant new findings that may develop over the course of the research that may relate to a participant’s willingness to continue, and how those will be provided to the participant
    • The approximate number of participants who will participate in the study
    • A statement regarding whether biospecimens (identifiable or not) used in this research may be used for commercial profit. If so, whether the participant will or will not share in the commercial profit.
    • Whether clinically relevant research results will result from this research, and if so, whether they will be disclosed, and if so, under what conditions
    • Whether whole genome sequencing is used 

Additional elements may also be required in order to comply with federal, state, and institutional regulations. Templates are available on the IRB’s webpage dedicated to Informed Consent.

The entire consent process involves:

  • providing a participant with adequate information concerning the study,
  • providing adequate opportunity for the participant to consider all options,
  • responding to the participant’s questions,
  • ensuring that the participant has comprehended the information,
  • obtaining the participant’s voluntary agreement to participate (minimizing undue influence),
  • continuing to provide information as the participant or situation requires,
  • providing ample opportunity for the investigator and the participant to exchange information and ask questions, and
  • unless a waiver of documentation has been granted (see below), obtaining the signature of the participant or legally authorized representative.

Issues to consider:

  1. Where will consent be obtained? Some research topics are sensitive or embarrassing. If this is the case, what location or methods will be used in order to maintain the privacy of the participant? How much time will be given to the process of obtaining the informed consent? When must participants decide?
  2. Who will be involved in the consent process, e.g., nurses, social worker, student? Is there any possibility that the participant(s) may feel coerced by the person obtaining the consent?
  3. How will the participant’s understanding of the research study be assessed?
  4. Has the participant made an informed decision?

Waiver of Documentation of Informed Consent

The IRB may waive the requirement for the investigator to obtain a signed consent for some or all participants (45 CFR 46.117c) if it finds that:

  • The only record linking the [participant] and the research would be the consent document. The principal risk would be potential harm resulting from a breach of confidentiality. Each [participant] will be asked if the [participant] wants documentation linking the [participant] with the research and the [participant’s] wishes will govern, or
  • the research presents no more than minimal risk of harm to [participants] and involves no procedures for which written consent is normally required outside of the research context.
  • In cases where the documentation requirement is waived, the IRB may require the investigator to provide [participants] with a written statement regarding the research.

Waiver of Informed Consent

In order to grant a waiver of informed consent, the IRB must document that it believes the request meets the following criteria (45 CFR 46.116d):

  • “The research involves no more than minimal risk to the subjects;
  • The waiver will not adversely affect the rights and welfare of the subjects;
  • The research could not be practicably carried out without the waiver; and
  • Whenever appropriate, the subjects will be provided with additional pertinent information after participation.”

Payment/Reimbursement of Research Participants

Federal regulations and the various codes of ethics governing human participant research require that no “undue inducements” be offered to potential research participants in order to secure their participation in a study. To comply, the IRB has adopted the following guidelines regarding payments to participants:

  • Participants should not be induced to participate in research for financial gain.
  • Payment is not a benefit. It is compensation for services. In the consent document, payment cannot be listed in the benefits section but must be in a separate section. There must be equivalence in compensation for completion of research activities.
  • PIs who plan to provide any payment/reimbursement to participants for any reason must indicate this clearly in the Informed Consent or Letter of Information, which must be approved by the IRB.

Informed Consent/Permission and Assent Documents

The informed consent document must provide signature and date lines for the PI, CoPI, student researcher, participant or the participant’s legally authorized representative, and in some cases the person obtaining consent (if other than an investigator).

Research studies that involve children should include signature and date lines of the child’s parent or legal guardian who is giving permission. If the individual giving permission for a child’s participation is not the child’s parent, the individual must provide written documentation of authority to consent to the child’s medical care (4CFR 46.402(e)) if the study is supported with funding from DHHS. For all other research, the individual giving permission must provide written documentation of authority to act as the child’s guardian. In some cases, signatures from both parents may be required. In addition, studies involving children old enough to understand the research (generally those over the age of 7), should include a child assent section (or a separate assent document).

Witness Information

In some situations, informed consent documents may require a witness signature. If a witness signature is required, the witness should not be a person who belongs to the study staff. Neither the PI nor the person obtaining consent can act as the witness.

Copies of Informed Consent

The PI must retain the original signed consent form in the respective study file and provide a copy to the participant. This document must be kept for three years after the study is completed or in accordance with USU’s, the state of Utah’s, or the funding agency’s record retention requirements.

Deception Research

Deception research is a type of research where the researcher intentionally tells a participant(s) something that is not the truth. This form of research is allowed; however, because informed consent cannot be obtained, the following criteria must be met for deception research to be approved:

  • The research provides value to the body of knowledge, and there are measurable benefits.
  • The research protocol meets scientific validity requirements.
  • The information could not be obtained without the use of deception.
  • The deception used would not likely influence the participants’ willingness to participate.
  • The possibility of harm to the participant is adequately addressed and a plan for debriefing has been established. Debriefing must be conducted as soon as possible after the conclusion of the study. Debriefing language must be provided to the IRB for review.
  • Participants will be notified that they may withdraw from the study after debriefing by requesting that any data collected from them be deleted and/or destroyed.
  • The deception does not cause invasions of privacy to participants or others.

Exculpatory Language

Exculpatory language, or language suggesting that by participating in research, individuals are waiting rights to legal recourse, is not allowed in informed consent documents. The regulations state: “No informed consent, whether oral or written, may include any exculpatory language through which the participant or the representative is made to waive or appear to waive any of the participant’s legal rights or releases or appears to release the PI, the sponsor, the institution or its agents from liability for negligence.” (45CFR46.116)

Conflicts of Interest

Conflicts of interest, as defined by USU Policy #307 and based on the “Utah Public Officers and Employees’ Ethics Act,” are expected to be disclosed to the IRB and may be managed in conjunction with that policy. If conflicts of interest are present in a research project, such conflicts should be clearly and explicitly described in the informed consent document and must be made clear and apparent to participants in any related research.

Chapter 6: Continuing Review, Revisions, and Reporting of Problems

Continuing Review

The IRB determines how often each protocol must be re-evaluated based on the level of risk. It is the responsibility of the PI to assure that IRB approval of a protocol is continuous. 

For protocols approved on or before January 20, 2019: All full board and expedited protocols are reviewed at least annually. For studies determined to be exempt from regulations or approvable under expedited review, a random sample of protocols is selected for review each year as part of the IRB’s quality assurance activities.

For protocols approved on or after January 21, 2019: All full board protocols are reviewed at least annually. For studies determined to be exempt from regulations or approvable under expedited review, a random sample of protocols is selected for review each year as part of the IRB’s quality assurance activities.
For all protocols undergoing continuing review: Reminder notices are sent to PIs by e-mail one month prior to the expiration date of each protocol, including a link to the Status Report (here for Expedited and Convened IRB protocols, and here to request closure for exemptions). The report and the protocol must be reviewed and approved by the IRB prior to the expiration of the previous study approval. If approval is given, the continuing review expiration date is updated for another term’s approval.

If the continuation review is not approved by the date specified, the study approval automatically expires and all research must stop including recruitment, advertisement, screening, enrollment, consent, interventions, interactions, and collection of private identifiable information until approval of the continuation. There is no grace period. Interventions and interactions on current participants may continue only when the IRB finds an over-riding safety concern or ethical issue involved such that is in the best interest of individual participants. Under no circumstances can enrollment of new participants occur.

The IRB Office sends a total of three reminder notices by e-mail to the PI prior to the expiration date. If there is still no response, the protocol is closed. At that point, the study approval expires, and the study is terminated. A new application will then be required before work can commence again. Patterns of non-response (or responses too late to allow completion of continuing review) by the PI can trigger formal inquiries under the Noncompliance SOPs by the IRB.

If the research is complete prior to the next annual continuation review or exemption expiration, investigators should submit a Status Report Form to the IRB Office requesting closure of the study.

In addition to required Protocol Status Reports, the IRB may conduct other types of post-approval reviews including, but not limited to, self-assessment by the PI, document review by IRB staff, interview with the PI, interview with research staff and surveys of past participants.

Protocol Revisions (Amendments)

Federal regulations require that any proposed change or revision to a currently approved study which affects human participants be reviewed and approved by the IRB prior to the implementation of that change.

A minor change is one which, in the judgment of the IRB reviewer, makes no substantial alteration in (1) the level of risks to participants; (2) the research design or methodology; (3) the participant population utilized in the research (deviation in number or kind); (4) the qualifications of the research team; (5) the facilities available to support safe conduct of the research; or (6) any other factor which would warrant review of the proposed changes by the convened IRB. In addition, revised procedures must (7) involve no more than minimal risk, and (8) fall into categories 1-7 of research that would allow review using the expedited procedure. Minor changes may be reviewed using the expedited procedure. Some examples of minor revisions are: changes in telephone numbers; addition/deletion of associates or staff; the deletion of questions in a survey; changes in funding; addition or deletion of PIs; advertisement changes; the number ( > + 15%) and kind of participants enrolled in the research; the qualifications of the research team; the facilities available to support safe conduct of the research; or similar factors which would not warrant review of the proposed changes by the convened IRB.

Non-minor revisions are those that may involve increased risk to participants or that substantially change the nature of the study. Examples may be: revisions to the recruitment plan, study design, or methodology; replacement of or significant changes to study instruments and methods, including surveys and questionnaires; adding/revising eligibility criteria or changes to the study population; adding a research site; and changing the informed consent to include a newly identified risk related to the study (this may require that participants sign a new consent form).

Process for making minor modifications to approved protocols

Requests for minor modifications to protocols are reviewed in a manner appropriate to the original risk level of the protocol. Minor modifications are reviewed and approved by the HRP Director and/or Coordinator as they are received by the IRB Office.

To submit an amendment to an active protocol in Kuali, select “Amend” on the right side of the application, and proceed to edit your protocol in the manner you propose to make changes. Please be sure to amend each affected field, and be sure to submit the full amendment when complete. Approval of a revision does not change the approval or expiration date of the protocol. It merely approves the modification to the study and allows the PI to begin using the modified or new procedures/documents. The PI must receive the amendment approval from the IRB Office prior to implementing the new changes.

Unanticipated Problems Involving Risks to Participants or Others

An unanticipated problem involving risks to participants or others is any incident, experience, or outcome that meets both of the following criteria:

  • Is unexpected (in terms of nature, severity, or frequency) given (a) the research procedures that are described in the protocol-related documents, such as the IRB-approved research protocol and informed consent document; and (b), the characteristics of the participant population being studied;
  • It suggests that the research places participants or others at a greater risk of harm (including physical, psychological, economic, or social harm) than was previously known or recognized.

Reporting requirements are set forth in the table, “Reporting Responsibilities of the Principal Investigator to the IRB,” in Chapter 9, below. Reportable Events submission form is available to facilitate such reporting.

Data and Safety Monitoring Plans

All research involving greater than minimal risks to participants will require a data and safety monitoring plan. The PI should propose a plan that will provide on-going review of data as it is collected and of participant profiles as they are enrolled to identify unexpected outcomes and to ensure participant safety. In some instances it may be appropriate to set “stop rules” against which data outcomes would be measured to indicate, statistically, if a study should be stopped based on unexpected outcomes. Alternatively, the PI may describe a plan that meets these objectives and is being implemented by others (in multi-site studies). There are a number of ways to accomplish effective data monitoring. In many cases, monitoring by the PI would be appropriate. An approach that would seldom be used at USU would be the use of a group representing the study’s industrial sponsor. A single expert, or a small committee of experts could be formed, or a Data and Safety Monitoring Board (DSMB) could be appointed. The IRB will not fulfill the data monitoring responsibility for any study.

Circumstances that the IRB will consider when evaluating a data and safety monitoring plan may include the level of risk to participants, whether the investigator has a conflict of interest, and whether work is being performed at multiple sites. The convened IRB will consider and approve a plan for data monitoring at the first review of a project where greater than minimal risk has been identified. In each subsequent review the IRB shall take the outcomes of safety monitoring into account in its deliberations.

Chapter 7: Research Involving Vulnerable Populations

Certain groups of participants are considered to be particularly vulnerable to coercion or undue influence in a research setting. These groups, as outlined in 45 CFR 46.111(b) are children, prisoners, individuals with impaired decision-making capacity, or economically or educationally disadvantaged persons.

In reviewing research studies involving all categories of vulnerable participants, USU must determine that their use is adequately justified and that additional safeguards are implemented to minimize risks unique to each group. A summary of the additional requirements for review and approval of research involving vulnerable populations is provided below.


Federal regulations (45 CFR 46, Subpart D) require that investigators explicitly address the measures taken to protect the rights and welfare of children participating in research.

Definition of Children (45CFR46.402(a))

Children are defined as “persons who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted.” In the state of Utah, children includes any person under the age of 18 unless the child has been emancipated by court order, marriage, or is on active military duty.

Categories of Research Involving Children

Subpart D of 45 CFR 46 classifies research involving children into one of four categories depending upon the risks and benefits of the proposed study, which can be approved as follows:

Category 1 (Section 46.404): Not greater than minimal risk

Risk/Benefit Conditions Consent Requirements
None Permission of both parents, unless one of the parents has sole legal responsibility for the care and custody of the child, or one of the parents is deceased, unknown, legally incompetent to provide permission, or is not reasonably available.
The IRB may determine that permission of one parent is sufficient, even if the other parent shares legal responsibility for the care and custody of the child, and is alive, known, legally competent to provide permission, and is reasonably available.

Assent of the child is required, unless the IRB determines that assent is not a requirement or waives assent.

Category 2 (Section 46.405): More than minimal risk to children is presented by an intervention or procedure that holds out the prospect of direct benefit for the individual subject, or by a monitoring procedure that is likely to contribute to the subject’s well-being.

Risk/Benefit Conditions Consent Requirements
The risk involved is justified by the anticipated benefit, and the relation of the anticipated benefit to the risk is at least as favorable as that presented by alternative approaches. Permission of both parents, unless one of the parents has sole legal responsibility for the care and custody of the child, or one of the parents is deceased, unknown, legally incompetent to provide permission, or is not reasonably available.
The IRB may determine that permission of one parent is sufficient, even if the other parent shares legal responsibility for the care and custody of the child, and is alive, known, legally competent to provide permission, and is reasonably available.

Assent of the child is required, unless the IRB determines that assent is not a requirement or waives assent.

Category 3 (Section 46.406): More than minimal risk to children is presented by an intervention or procedure that does not hold out the prospect of direct benefit for the individual subject, or by a monitoring procedure which is not likely to contribute to the well-being of the subject.

Risk/Benefit Conditions Consent Requirements
The research is likely to yield generalizable knowledge about the participant’s disorder or condition which is of vital importance for the understanding or amelioration of the subjects’ disorder or condition, and
the risk represents a minor increase over minimal risk,
and the research presents experiences reasonably commensurate with those inherent in the participant’s actual or expected medical, dental, psychological, social or educational setting.
Permission of both parents, unless one of the parents has sole legal responsibility for the care and custody of the child, or one of the parents is deceased, unknown, legally incompetent to provide permission, or is not reasonably available.
Assent of the child is required, unless the IRB determines that assent is not a requirement or waives assent.

Category 4 (Section 46.407): Otherwise not approvable, but presents an opportunity to understand, alleviate or prevent a serious child health problem.

Risk/Benefit Conditions Consent Requirements
The research presents an opportunity to understand, alleviate or prevent a serious child health problem, and will be forwarded to the HHS Secretary for review. Permission of both parents, unless one of the parents has sole legal responsibility for the care and custody of the child, or one of the parents is deceased, unknown, legally incompetent to provide permission, or is not reasonably available.
Assent of the child is required, unless the IRB determines that assent is not a requirement or waives assent.

Approval is also required from the Secretary of DHHS before any research is conducted.

Permission of Parents or Guardians and Assent of Children

  • Assent is a child’s affirmative agreement to participate in research. Mere failure to object should not, absent affirmative agreement, be construed as assent
  • Permission means the agreement of parent(s) or guardian to the participation of their child or ward in research
  • Guardian is an individual who is authorized under applicable State or local law to act on behalf of a child.

Permission of parents or guardians and assent of children shall be obtained as indicated in the table above.

Waiver of Permission of Parents or Guardians

One set of conditions under which Waiver of Permission may be granted is:

  • The research protocol is designed for conditions or for a participant population for which parental or guardian permission is not a reasonable requirement to protect the participants (for example, neglected or abused children), and
  • The PI has provided an appropriate substitute mechanism for protecting the children, and
  • The waiver is not inconsistent with Federal, state or local law.

Another set of conditions under which Waiver of Permission may be granted is:

  • The research involves no more than minimal risk to the subjects;
  • The waiver or alteration will not adversely affect the rights and welfare of the subjects;
  • The research could not practicably be carried out without the waiver or alteration; and
  • Whenever appropriate, the subjects will be provided with additional pertinent information after participation.

Assent of Children

The IRB can determine that assent is not a requirement of some or all children, when one or more of the following is true:

  • The children were not capable of providing assent based on the age, maturity, or psychological state.
  • The capability of the children was so limited that they could not reasonably be consulted.
  • The intervention or procedure involved in the research holds out a prospect of direct benefit that was important to the health or well-being of the children and was available only in the context of the research.
  • The assent can be waived.

Waiver of Assent may be granted only when all of the following criteria are met:

  • The research involves no more than minimal risk to the subjects;
  • The waiver or alteration will not adversely affect the rights and welfare of the subjects;
  • The research could not practicably be carried out without the waiver or alteration; and
  • Whenever appropriate, the subjects will be provided with additional pertinent information after participation.

Assent shall be obtained either in writing, using an assent form or a signature block on the informed consent form, or may be obtained orally if approved by the IRB.

Child Abuse Reporting

The State of Utah requires the reporting of suspected child abuse or neglect. PIs must abide by this law. If the protocol involves interviewing children about topics that may lead to a suspicion or to knowledge on the part of the investigator of child abuse or neglect, the child (and parent/guardian) must be informed of the reporting requirement as part of the informed consent process. Reports of abuse should be made to the Utah Division of Child and Family Services, or its equivalent in the jurisdiction where the research is conducted.

The following sentence(s) should be integrated into the currently required Informed Consent Document among the statements about confidentiality and its limits:

“Research records will be kept confidential, consistent with federal and state regulations.”

“The researcher is required to report any suspected child abuse or any intention you have to hurt yourself or others. The researcher, if ordered to do so by a court of law, may be required to disclose information you have provided.”

Wards of the State

Where children are wards of the state or another agency or institution, additional restrictions apply. Children may only be included in research that is related to their status as wards or which is conducted in schools or other institutions in which a majority of children are not wards. If the IRB approves research under this provision (45 CFR 46.409), it must appoint an advocate for each child that is a ward.

Emancipated Minors

There are exceptions to the rule of obtaining assent and seeking parental consent for individuals considered emancipated minors by the state of Utah. Emancipated minors may include individuals under the age of 18, living on their own and financially independent from their parent or legal guardian, individuals who have borne a child, or individuals who are married. Emancipation may also be sought through legal means, and may be stipulated by the state. Consent is sought from an emancipated minor rather than assent. A court document must be included in the supporting documentation application designating the individual as an emancipated minor.

Students as Participants

Many research studies recruit students as participants. PIs should be aware of possible coercion when using students in their research. Because classrooms are primarily learning environments for students, these spaces should not be environments where students become an opportunistic research population. If students believe their participation (or lack of participation) will be made known to someone who holds power over their academic status, the student may perceive coercion. How the PI plans to handle potential problems of coercion and undue influence must be addressed when the study is submitted to the IRB. In particular, activities that involve students who report directly to the PI or who attend a class for which the PI has responsibility should be avoided. See additional guidance about students as research participants.

In K-12 research settings, final approval for research in school settings will not be granted until the proposed research has been reviewed by the appropriate school district or charter school administration. Once the governing body has reviewed the information relevant to this study, including the procedures, level of risk, consent process, and benefits, the PI should obtain a letter of approval on district letterhead specifically stating that those items have been reviewed and upload that letter in the “Submit” section of your protocol within Protis. Protocol approval cannot be finalized until receipt of this letter. Please note that you can begin the review process for your protocol before securing this letter, but approval cannot be finalized until the governing body review letter has been received.


45 CFR 46, Subpart C, provides additional safeguards for prisoners since “Prisoners may be under constraints because of their incarceration which could affect their ability to make a truly voluntary and un-coerced decision whether or not to participate as participants of research.” The term “prisoner” means someone who is incarcerated or under adjudication, whether an adult or a minor. Research involving prisoners does not qualify for exemptions from IRB review.

For research involving prisoners, “minimal risk” means the probability and magnitude of physical or psychological harm that is normally encountered in daily lives, or in the routine medical, dental, or psychological examination of healthy persons.

Categories of research involving prisoners permitted under 45 CFR 46.306(a)

  • Studies regarding the possible causes, effects, and processes of incarceration, and of criminal behavior, provided that the study presents no more than minimal risk and no more than inconvenience to the subjects.
  • Studies of prisons as institutions, or of prisoners as incarcerated persons, if those studies present no more than minimal risk or inconvenience to the subjects.
  • Research on conditions affecting prisoners as a class after DHHS publishes a notice in the federal register.
  • Research on practices that are intended, and reasonably likely, to enhance the well-being of the subjects; however, if some of the prisoners will be assigned to control groups which will not benefit from the research, then the study must first be approved by DHHS.

In addition to the general requirements for review, in reviewing prisoner research, IRBs are required by 45 CFR 46.305(a) to:

  • Ensure that the membership of the IRB reviewing the protocol includes a prisoner, or a prisoner representative with appropriate background and experience to serve in that capacity, and that the majority of the IRB is not associated with the penal institution involved. If no current member of the IRB meets the prisoner or prisoners’ representative criteria, then the VPR and the IRB Chair will identify and recruit a qualified individual to fulfill this requirement and advise the IRB. In addition, a majority of the IRB members at the meeting must not be associated with the prison.
  • Ensure that any advantages prisoners will realize as a result of participating in the research, when compared to the general living conditions within the prison, are not so great as to impair prisoners’ ability to weigh the risks and benefits of participation and freely choose whether to participate.
  • Ensure that the risks involved in the research are commensurate with risks that would be accepted by non-prisoner volunteers.
  • Review procedures for selecting participants to determine whether they are fair, and free from arbitrary manipulation by prison authorities or prisoners.
  • Ensure that control participants will be selected randomly from among the group of eligible volunteers, unless the PI justifies a different procedure.
  • Review the information presented during the recruitment and consent procedures to ensure that the language and level of complexity is understandable to the target population.
  • Ensure that the parole board will not take participation in the study into account, and that each prisoner will be informed that participation will have no effect on parole.
  • Ensure that adequate provision will be made for follow-up care as necessary.

When an IRB reviews research falling within this category, its assurance provides for OHRP to be notified that the above criteria have been met.

A PI may not enroll a prisoner in an ongoing IRB-approved study without the approval of the committee. If a participant becomes a prisoner during the course of a research study, the IRB must be notified.

Pregnant Women and Fetuses

45 CFR 46, Subpart B, provides additional protections for research involving pregnant women. Pregnant women should not be excluded from research as participants if the risk to the fetus is minimal. If pregnant women are included in a research protocol, the informed consent must address the possible impact of the research activity on the fetus.

Researchers who conduct studies targeting conditions specific to pregnant women must obtain informed consent from both the pregnant woman and the father of the fetus, however, consent of the father is not necessary if:

  • The purpose of the study is to meet the health needs of the mother.
  • The identity or whereabouts of the father cannot be reasonably ascertained.
  • The father is not reasonably available.
  • The pregnancy is the result of rape.

Economically or Educationally Disadvantaged

For research involving economically disadvantaged participants, special care must be taken to assure that any financial incentives offered do not represent the sole grounds for the individual’s participation in the research protocol. Financial incentives should also not be used to encourage participants to assume risks that they would not ordinarily incur.

The consent form for research involving educationally disadvantaged participants must be written in language and with terminology appropriate to the participant. The PI must discuss orally every aspect of the study with the participant to insure their understanding.

Illiterate English Speaking Subjects

A PI who has received IRB approval for a study may enroll individuals who can speak and understand English, but cannot read or write. The potential participant must be able to place a written mark on the consent form.

The participant must also be able to

  • Comprehend the concepts of the study and understand the risks and benefits of the study as it is explained verbally, and
  • Be able to indicate approval or disapproval for study enrollment.

If a PI uses the above method to obtain consent, there must be documentation on the participant’s consent form specifying what method was used to communicate the information and the specific means that the participant communicated agreement to be in the study.

Non-English Speaking Participants

Non-English speaking individuals may not be excluded from research studies on the basis of language if there is a possibility that they might benefit by participating in the study.

If a research participant does not understand English, the informed consent document should be in a language readily understood by the participant. If the PI anticipates that consent interviews will be routinely conducted in a language other than English, the IRB requires a certified translated consent document be submitted after the English version submitted with the protocol has been approved. It is the PI’s responsibility to ensure that the translation is accurate.

A copy of the consent document must be given to each participant. While a translator may be helpful in facilitating conversation with a non-English speaking participant, verbal translation of the consent document must not be substituted for a written translation.

If a non-English speaking participant is unexpectedly encountered, enrollment of the participant may not occur until the IRB has prospectively reviewed and approved a written consent document in language understandable to the participant.

At the time of consent for non-English speaking participants, the following is required:

  • The short form document should be signed by the participant or the participant’s legally authorized representative.
  • The English language informed consent document should be signed by the person obtaining consent as authorized under the protocol.
  • The short form document and the summary should be signed by the witness.

Chapter 8: Using and Disclosing Health Information in Research

The Health Insurance Portability and Accountability Act (HIPAA) protects individuals’ medical records from unauthorized use. Medical records, however, are often integral to learning more about important research questions. This guide is intended to serve as a primer for researchers who seek to use medical records in their research, especially researchers who wish to conduct research with their own clinical records.

Please note that the standards here apply even where you do not intend to use the identifiable information. Any time you will access HIPAA-protected individually identifiable health information for research purposes, it must be in compliance with the HIPAA requirements.

Research Using Protected Health Information under HIPAA:

The HIPAA Authorization process closely mirrors the Informed Consent process. A HIPAA Authorization is a document researchers can share with individuals to request legal access to medical records. Individuals must sign these documents affirming researchers can access these materials for research purposes. A template can be located under the Informed Consent page.

An Authorization must contain the following elements, and can be combined with the Informed Consent document used for the study:

  • A specific description of the information that will be accessed and used for the research
  • A specific description of who will have access to the aforementioned information
  • A statement that the individuals receiving the protected health information may not be required to protect the information in the same way that the providing entity must protect it
  • A statement that if the treatment or intervention is being offered only for research purposes, declining to sign this Authorization may mean that the individual would not receive the treatment or intervention; OR that the researcher cannot refuse or alter treatment on the basis of whether the individual signs the Authorization (this depends on the circumstances of the treatment or intervention)
  • When the authorization expires (this can be “when the research has ended”)
  • A statement that the individual may revoke their Authorization at any time, that the disclosed information prior to revocation may still be used for the research purposes described previously, and who the individual should contact to revoke the Authorization

The following elements of an Authorization are optional, but should be included where relevant:

  • Any circumstances where the researcher would be required by law to release the health information (e.g., Tarasoff reporting requirements, child abuse, etc.)
  • That the individual’s information will not be shared in publications or presentations in an identifiable way
  • That if the information received is later deidentified to HIPAA standards, it can be shared or disclosed for other purposes
  • When, if ever, the records received for research purposes will be made available to the individual giving Authorization for access

In crafting an Authorization, researchers should note that the Office for Civil Rights requires that researchers only use the minimum necessary information contained in the individual’s medical records for research purposes. In most cases, this will not allow researchers to simply receive access to entire medical records; the information requested and specified in the Authorization must be the minimum necessary to address the research question.

Research Use/Disclosure Without Authorization:

The USU IRB may waive the requirement to obtain an Authorization if the following three criteria can be demonstrated by the Principal Investigator and documented by the IRB:

  • The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals;
  • The research could not practicably be carried out without the waiver; AND
  • The research could not practicably be carried out without access to and use of the protected individually identifiable health information.

Practicability does not mean mere difficulty. Instead, the IRB must make a determination that obtaining an Authorization presents an “extreme circumstance of expense or difficulty.”

In order to determine whether the use or disclosure involves no more than a minimal risk to the individuals whose information would be released, HIPAA requires that the PI demonstrate:

  • An adequate plan to protect the identifiers from improper use and disclosure
  • An adequate plan to destroy the identifiers at the earliest opportunity
  • Written assurances to the IRB that the protected health information will not be reused or disclosed to any other person or entity, or for other research purposes.

Please note that waivers to HIPAA Authorizations are rare. This is because respect for persons, or adhering to the principle of autonomy as articulated in the Belmont Report, requires that researchers obtain an Authorization whenever possible.

If the entity releasing protected health information (PHI) under a waiver or alteration is a USU entity, it is required to have policies and procedures in place to determine whether the information being disclosed is the minimum necessary information. The entity must review each disclosure or request for disclosure individually against the policies and procedures it has developed to ensure it is releasing only that information which is necessary to accomplish the purpose of the request or disclosure. It must also maintain records related to those disclosures. HIPAA requires that, at the request of any individual, the disclosing entity must account for all disclosures of protected health information for the previous six years.

Covered entities may use or disclose health information without restriction under HIPAA if the health information has been deidentified to HIPAA standards. There are two ways to accomplish this: 1) removal of all 18 HIPAA identifiers plus the inability to reidentify the data using actual knowledge; or 2) established statistical methods which allows some of the 18 HIPAA identifiers to remain in place, while ensuring reidentification risk is virtually impossible.

HIPAA Identifier Removal: Removal of all 18 HIPAA identifiers may render otherwise protected health information unidentifiable, thus permitting its disclosure. Those 18 identifiers are:

  • Names
  • Geographic subdivisions smaller than a state (including address, city, county, precinct, zip codes [except for the initial three digits if all zip codes beginning with those numbers comprise areas with more than 20,000 inhabitants or by changing the first three digits to 000])
  • All elements of dates, including DOB, admission date, discharge date, date of death, and all ages or dates indicative of an age over the age of 89
  • Telephone numbers
  • Fax numbers
  • Email addresses
  • Social security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate or license numbers
  • Vehicle identifiers/serial numbers, including license plates
  • Device identifiers or serial numbers
  • URLs
  • IP addresses
  • Biometric identifiers including fingerprints and voiceprints
  • Full-face or comparable photographic images
  • Any other unique identifying number, characteristic, code, etc.

In addition to the removal of these identifiers, the covered entity can have no actual knowledge that the information remaining could render the information identifiable. In cases where researchers are working in their own clinics, for example, the researcher must ensure that the information remaining could not be matched back to an identifiable medical file. In that case, researchers will almost always need to use an Authorization, waiver, or limited data use agreement.

Chapter 9: Research Record-Keeping and Reporting

Proper record keeping is integral to the validity and reliability of data collected during research. It is the PI’s responsibility to oversee the general organization and design of study records, both paper and electronic, and assure that all records are authentic. Such records may be received in the PI’s control, but ownership of all research data resides with the University. A summary of regulatory documents and individual documents which must be maintained by the PI appears below.

Regulatory Documents Individual Participant Files
Participant Log
Copies of all IRB correspondence
Approved Protocol
Approved Consent Form
IRB Approval Letters
Other Institutional approvals
Continuing review reports
Investigator’s Brochure (if applicable)
Correspondence with sponsors/agencies
Sample questionnaires
Sample study forms with instructions
Reports of deaths, protocol violations, protocol deviations and serious adverse events.
Original signed informed consent form

Copies of study recording forms (CRFs)

Supporting Documentation for:

Inclusion/Exclusion criteria
Results of tests or procedures
Adverse events
Communications with participants
Protocol deviations

Reporting Protocol Violations and Deviations

Protocol violations are activities clearly occurring outside of the approved research protocol and represent a failure to comply with the protocol. Protocol deviations are study events that are not covered under the approved research protocol, but which typically would have been approvable if filed in advance as an amendment. If an activity occurs that represents a significant alteration in the approved written protocol and/or affects the safety and welfare of the participant, the PI must report using the Reportable Events form.

Reporting Responsibilities of the Principal Investigator to the IRB

A table describing situations and events which require notification of the IRB by the PI is shown on the following page, along the time frame in which the situation must be reported.

Investigator Must Report Time Frame for Reporting
Deaths Within 24 hours, if subject currently in protocol. Otherwise, within 60 days of investigator's notification of the death.
Protocol deviations Immediately, when it represents a significant alteration in the approved protocol and/or if it affects the safety or welfare of the subject.
Change to the protocol made without prior IRB review to eliminate an apparent immediate hazard to participant Immediately
Protocol violations Immediately, when it represents a significant alteration in the approved protocol and/or if it affects the safety or welfare of the subject.
Changes in approved research procedures or protocol (amendments) Prompt notification within 10 days; must obtain approval prior to implementing.
Allegation or finding of noncompliance with conducting of research protocols. Immediately upon discovery of noncompliance
Restrictions, suspension, or termination of study by the sponsor or principal investigator. Within 3 days
Any activity which involves a potential or actual unexpected risk to subjects or others. Within 7 days of activity
Any harm experienced by a participant which, in the opinion of the investigator, is both unexpected and more likely than not caused by the research procedures. Within 7 days of report by participant
Complaint of a participant when the complaint indicates unexpected risks or cannot be resolved by the research team. Within 3 days of confirmation the team is unable to resolve the issue.
Information that indicates a change to the risks or potential benefits of the research. Within 10 days of discovery
Breach of confidentiality Within 3 days of discovery
Incarceration of a participant in a protocol not approved to enroll prisoners. Within 10 days
Any other problem that the investigator considers to be unanticipated, and indicates that participants or others are at increased risk of harm. Within 7 days of discovery

Notifying IRB of Pending Audits or Inquiries

Investigators conducting research with human participants are required to report any communication from a federal or state department, agency, or sponsor that questions the conduct of research or suggests an impending inquiry audit or investigation. The PI must inform USU’s IRB and the Director of Research Integrity & Compliance, by email upon notification of inquiry. A formal written notice to the IRB committee that includes a detailed description of the proposed inquiry is required from the PI. This notice should be received in the IRB office no less than 3 days after the notification of the PI by the agency or sponsor.

Adherence to Additional Sponsor Requirements

Investigators conducting research with human subjects must take care to design their study, engage with the review processes, and carry out the research procedures in a manner that adheres to any additional requirements that the Sponsor mandates. The USU IRB’s Standard Operating Procedures are designed to be in harmony with the requirements of the Department of Health and Human Services. However, the Department of Defense and Department of Education (sponsors who occasionally support human subjects research at USU) may have different requirements in place. These requirements are detailed in the Standard Operating Procedures in the 700 Series. Examples of differential requirements include:

Department of Defense

The Department of Defense (DoD) requires that an additional review occur within the DoD Component that is sponsoring the research. Surveys that will be performed on DoD personnel must be submitted, reviewed, and approved by each DoD Component overseeing the area where the survey will be deployed, after the USU IRB approves the protocol, but before the research can begin. Research involving “experimental subjects” may not obtain a waiver of informed consent from the USU IRB; such a waiver must be obtained from the Assistant Secretary of Defense for Research and Engineering. Civilian researchers seeking military participants should seek collaboration with a military researcher familiar with service-specific requirements whenever feasible. Reporting

The National Institutes of Health (NIH) has an expectation that all NIH-funded awardees and investigators conducting clinical trials, funded in whole or part by the NIH, will ensure that their clinical trials are registered at A summary of the results and the informed consent document must also be posted to for public posting.

A clinical trial means “a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of those interventions on health-related biomedical or behavioral outcomes.”

Investigators who oversee NIH-funded clinical trials are responsible for ensuring that all posting and reporting requirements are being met within the timelines specified by NIH policy. Please email to request access to Before your protocol can be closed, the IRB will verify that all required postings have been completed.

Chapter 10: Additional Policies and Resources

Investigators and Study Staff

It is the policy of USU that all PIs desiring to engage in research with human participants must familiarize themselves with related policies, procedures, and federal regulations. PIs should maintain a continuous relationship with the IRB during the course of their study/ies. This will help assure that both PIs and USU remain in compliance with all state and federal regulations regarding research involving human participants.

The Principal Investigator has primary responsibility for the protection of participants involved in studies under their direction, including recruitment practices, equitable and appropriate selection of participants, obtaining informed consent, and conducting and monitoring the research. Delegation of responsibilities and authority to study staff requires careful consideration of staff maturity and training.

IRB Authority in Non-Compliance Issues

Non-compliance is the failure to follow the regulations or the requirements and determinations of the IRB. Incidents of alleged non-compliance are reviewed and disposition made by the IRB unless the nature or duration of non-compliance indicates the need for institutional intervention.

Non-compliant activities may be identified through IRB oversight, self-reporting, reporting from employees, or reporting from research participants or others. The IRB seeks to collect sufficient information to identify who exhibited non-compliant behavior, when it took place, and other pertinent details that would allow for determination of non-compliance, and the nature and duration of the non-compliance. The IRB chair makes the initial determination if the non-compliance involves research with human participants, and whether it is serious and/or continuing. If the non-compliance is not considered to be serious or continuing, the IRB Chair will take steps with the investigator to correct the non-compliant behavior and will notify the department chair, dean, Institutional Official and any other relevant parties of the non-compliance and corrective action.

If the non-compliance is serious or continuing, the incident is referred to the OCA for investigation. The outcome of the investigation is presented to the convened IRB along with materials required in the Protocol Review Packet (see Chapter 4, “Required Documentation”), and the IRB reviews the non-compliance and takes corrective action.

In resolving incidents of non-compliance, the IRB has the regulatory authority to:

  • Increase the frequency of continuing review of the protocol.
  • Notify current participants when the incidence of non-compliance may relate to a participant’s willingness to continue to take part in the research.
  • Suspend the study approval until compliance is achieved.
  • Terminate the PI’s research protocols.

The IRB may also recommend additional sanctions to the Institutional Official and the Office of Sponsored Programs. These sanctions include:

  • Research privilege probation
  • Suspension of research privileges
  • Termination of research privileges
  • Embargo of publications

The PI will be notified in writing if non-compliance is considered serious or continuing. The results of any investigation will be communicated in writing to the PI within 30 days following completion of the review. These communications will include notification to the PI that:

  • The research may continue OR
  • That the research may continue after contingencies are completed OR
  • That the research may not continue due to placement of sanctions.

The IRB is required to report to the Vice President for Research/Institutional Official and the Sponsored Programs Office, sponsoring agencies, and OHRP of any suspension or termination of research protocols.

Study Closure

At the conclusion of any study, the PI must notify the IRB Office to request closure of the protocol. Prior to the IRB’s closure of a study, all participants’ personal identifiable information must be destroyed. Additionally, data analysis related to the original research questions must be completed in order to close a study. When enrollment and data collection are completed and the only remaining activities are data analysis or long-term follow-up, the PI should indicate this information on the Protocol Status Report form and the protocol may remain open. See more information about study closure.

The IRB Office must be notified within 60 days of the study completion. Studies that are not closed upon their completion by the PI may be terminated by the IRB. If no participants have been enrolled in the previous year and data analysis related to the original research questions is complete, the investigator should close the study.

A PI may not re-open a study once it has been completed and is considered closed by the IRB. A new application including supporting documentation is required. Applications for analysis of existing data may be considered for exemption if appropriate criteria are met.

Closure of a study may occur in the following situations:

  • At the completion of the study (i.e. new enrollment is closed and all data collection and analysis are completed);
  • If the PI chooses to close the study (e.g. the study has not met its enrollment goal, but the investigator does not plan to enroll new subjects, collect additional data from enrolled subjects, or perform any additional data analysis);
  • The investigator leaves the institution and does not intend to transfer responsibility for the study to another investigator at USU.


Suspension is a postponement or temporary interruption of research activities. Suspension may occur for the following reasons:

  • Unexpected problem or serious adverse events that significantly increase risks relative to benefits
  • Evidence that a PI failed to adequately protect participants in a research study
  • Willful or repeated failure to comply with federal regulations, state laws, or institutional rules that govern human research activities
  • Proven research fraud or scientific misconduct
  • At the request of the institutional official who is responsible for oversight of research involving human subjects
  • At the request of the study sponsor, OHRP, or other duly authorized regulatory or governmental department or agency head
  • Any other reason deemed necessary by a simple majority vote of the convened IRB (a quorum must be present)
  • The IRB or the PI decides that new enrollment and risk-bearing activities should be interrupted pending an investigation into any problem, or alleged problem, with a particular study

Any study may be suspended by majority vote of the IRB members. In contrast to a study that has been terminated, a study that is suspended may be reopened without resubmission as a new protocol and with a new consent form.

At the time the study is suspended, the IRB will establish a unique and specific plan that, if completed by the PI, will lead to re-review of the study resulting in a decision as to whether to continue or end the suspension or to terminate the study. An audit of the PI’s studies may be required. At a minimum, the unique and specific plan will include a set of questions or conditions that must be addressed in writing by the PI within a specified time period. The IRB may not end the suspension for continuing review delinquency until the requested information is provided by the PI and is reviewed and approved by the committee.


Termination is a non-voluntary action resulting in discontinuation of all study-related activities. A study that has been terminated may not be reopened without submission and approval of a new protocol. Termination may occur for the following reasons:

  • The Protocol Status Report form has not been received and given final approval within 12 months after the last review (or less than 12 months if the study was designated for review at more frequent intervals). This termination occurs automatically if more than 12 months have passed since the last approval was granted. This is the only situation for which termination is automatic (i.e., without any action on the part of the IRB). It is the responsibility of the PI to monitor approval dates to ensure that IRB approval for each study is up to date.
  • Unexpected and serious adverse events that significantly increase risks relative to benefits
  • Evidence that a PI failed to adequately protect participants in a research study
  • Willful or repeated failure to comply with federal regulations, state laws, or institutional rules that govern human research activities
  • Proven research fraud or scientific misconduct
  • At the request of the institutional official who is charged with responsibility for oversight of research involving human subjects
  • At the request of the study sponsor, OHRP, or other duly authorized regulatory or governmental department or agency head
  • The PI leaves the institution and fails to request closure of the study or fails to reassign the PIs responsibilities and duties to another qualified PI
  • Any other reason deemed necessary by a simple majority vote of the convened IRB (a quorum must be present)

A research study that is terminated by the IRB will be reported to the Institutional Official, Sponsored Programs Office, study sponsor, and to the appropriate department or agency head. Disciplinary action or sanctions may be appropriate and decisions will be made on a case-by-case basis. At the IRB level, appropriate sanctions might include a request for further information, an audit of ongoing research activities, or suspension of all ongoing research conducted by the same PI or group of PIs until all research activities are shown to be free of similar problems. The PI will be reminded that if a study is terminated, no further enrollment or data collection is permitted.

Procedures for Appeals of IRB Decisions

The IRB encourages research. The board is aware that some researchers may disagree with suggestions or requirements made by the board. PIs should make an effort to resolve their concerns by involving the IRB Chair or HRP Director in discussing their concerns. Appeals may be made directly to the board with a formal letter addressing the following:

  1. Identify the project
  2. Identify the IRB action in question
  3. Describe any steps taken to resolve the concern, and
  4. List the reason for appealing the IRB decision.

Upon receipt of the appeal letter, the IRB Chair will review the IRB decision in question and obtain additional information from other relevant sources as needed. The final decision about any appeal will rest with the IRB Chair.

Chapter 11: Office of Compliance Assistance and Internal Audit Services

The Office of Compliance Assistance (OCA) was established to help researchers, and the University as a whole, to achieve and maintain compliance with federal regulations governing research. The OCA is a division of the Vice President for Research Office, but is independent of the IRB. This division is responsible for the development and administration of compliance programs required by federal and state agencies and programs in order to conduct research at USU. The IRB may request the OCA to provide support for training activities, locating appropriate outside experts, or monitoring research activities carried out under federal regulations.

The conducting of audits of research protocols is a component of the Internal Audit Services (IAS). These audits will include random audits and “for cause” audits. The IRB may request the IAS to conduct an audit based on PIs protocol activities (large numbers of active protocols where oversight may be diminished, subject enrollment, reported protocol deviations and/or serious adverse events). Audit findings will be reported to the Institutional Official and the PI.


Ethical Principles and Codes

Belmont Report: Ethical Principles and Guidelines for the Protection of Human Subjects of Research
Guidelines for Good Clinical Practice

International Conference on Harmonization of Technical Requirements for Registration of Pharmaceuticals for Human Use (ICH) 

National Bioethics Advisory Commission

Nuremberg Code 

World Medical Association Declaration of Helsinki

Federal Regulatory & Advisory Guidelines

Protection of Human Subjects 45 Code of Federal Regulations 46

NIH Policy and Guidelines on the Inclusion of Children as Participants in Research Involving Human Subjects 

Protecting Human Research Subjects: Institutional Review Board Guidebook (DHHS/OHRP)
Office of Human Research Protections