An institutional review board is not a grammar committee, a scientific journal, or a guarantee that a study is wise. It is a formally constituted body that reviews covered human-subject research against regulatory criteria and ethical protections. Its job includes examining risk, expected benefit, participant selection, consent, privacy, data safety, and safeguards for people who may be vulnerable to coercion or undue influence.
The Common Rule is the shared name for the Federal Policy for the Protection of Human Subjects. For HHS, it appears in Subpart A of 45 CFR part 46. Multiple federal departments and agencies have adopted parallel provisions. The current framework is often called the 2018 Requirements because most revised provisions became generally applicable on January 21, 2019.
The system is broad but not universal. Coverage depends on who conducts or supports the activity, what an institution has promised through its assurance, whether another statute or regulation applies, and whether the activity meets the definitions of research and human subject. “The IRB approved it” therefore needs context.
Why the rule exists#
Modern U.S. research protections grew from documented abuses and from recognition that scientific value does not excuse treating people merely as means. The Belmont Report, published in 1979, organized the ethical foundation around respect for persons, beneficence, and justice.
Respect for persons supports meaningful choice and additional protection when autonomy is limited. Beneficence requires a reasoned effort to maximize possible benefit and minimize possible harm. Justice asks who bears research burdens and who may receive its benefits.
The principles are not a complete rulebook. Reasonable people can disagree about risk, payment, exclusion, or acceptable uncertainty. Regulations turn parts of the ethical framework into defined responsibilities, while the IRB applies them to a protocol and local context.
The first gate: is it research involving a human subject?#
Under the 2018 Common Rule, research is a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. The rule separately identifies activities that are not research for its purposes, including some public-health surveillance, criminal-justice, intelligence, and authorized operational activities.
A human subject is a living individual about whom an investigator conducting research obtains information or biospecimens through intervention or interaction and uses, studies, or analyzes them, or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
Each term does work. A systematic quality-improvement project may aim only to improve one local process, yet an activity labeled “quality improvement” can still be research if its design and purpose meet the definition. Publishing a project does not by itself convert it into research, and calling it innovation does not remove it from the rule.
Secondary use of records or specimens can be human-subject research when information or biospecimens are identifiable. Conversely, analysis of information that investigators cannot readily link to living people may fall outside the human-subject definition, depending on how access, coding, and identity are structured.
Do not settle a high-stakes coverage question with a slogan. Institutions commonly route projects through a human-research protection office for a documented determination. OHRP provides 2018 decision charts, but institutional facts still matter.
Coverage is not the same as ethical responsibility#
The Common Rule applies principally to research conducted or supported by departments and agencies that adopted it. An institution with a Federalwide Assurance commits to specified compliance for covered HHS research and may choose to apply protections more broadly. State privacy law, tribal law, education records law, health privacy rules, contractual duties, and institutional policies may add obligations.
Some privately funded activity may not be covered by the Common Rule. That does not make deception, avoidable harm, insecure data, or unfair recruitment acceptable. Many institutions use similar review standards for a wider portfolio because ethical duties outlast a funding classification.
International research adds another layer. The Common Rule can apply to federally supported work abroad, while host-country law, local ethics review, culture, language, and community expectations also matter. A U.S. approval cannot substitute for every local responsibility.
FDA rules are related but separate#
FDA human-subject protection regulations appear mainly in 21 CFR parts 50 and 56, with additional rules for investigational drugs, biologics, and devices. They apply to defined clinical investigations involving FDA-regulated products and to data intended to support certain FDA submissions.
The FDA comparison shows many parallels and some differences. FDA exemptions are not identical to Common Rule exemptions. FDA regulations do not contain the Common Rule's broad-consent pathway. Emergency-use provisions, waiver rules, reporting, and product-specific responsibilities require their own analysis.
A federally funded drug trial may fall under both systems. A product study not federally supported may still fall under FDA rules. A behavioral study may fall under the Common Rule and not FDA rules. The correct question is which authorities apply, not which acronym wins.
What an IRB is made of#
Section 46.107 requires at least five members with varying backgrounds. Membership should support complete and adequate review through professional competence and diversity, including race, gender, cultural background, and sensitivity to community attitudes. An IRB cannot consist entirely of one profession.
At least one member's primary concerns must be in scientific areas and at least one member's in nonscientific areas. At least one member must be unaffiliated with the institution and must not be an immediate family member of an affiliated person. One individual can sometimes satisfy more than one membership characteristic, but the board still needs at least five members.
An IRB may invite a consultant when it lacks needed expertise. Consultants cannot vote. A member with a conflicting interest cannot participate in initial or continuing review except to provide information at the board's request.
For convened review, a majority of voting members must be present, including at least one nonscientist. Approval requires a majority of members present. If quorum is lost, the board cannot keep voting.
These rules prevent review from becoming the opinion of one investigator's close colleagues. Composition is a safeguard, not proof that every perspective affected by the study is represented. Community consultation and participant input may still be needed.
What the IRB must find before approval#
Under section 46.111, an IRB must determine that risks are minimized through sound procedures and, when appropriate, by using procedures already being performed for diagnosis or treatment. Risks must be reasonable in relation to anticipated benefits, if any, and the importance of the knowledge reasonably expected.
Selection of subjects must be equitable. The IRB considers the research purpose, setting, and problems involving vulnerable populations. Consent will be sought and documented as required, unless a valid waiver or alteration applies. The protocol must include adequate data monitoring when appropriate and adequate provisions for privacy and confidentiality.
When some participants may be vulnerable to coercion or undue influence, the study needs additional safeguards. This is contextual. Illness, dependency, incarceration, limited decisional capacity, hierarchy, financial need, or immigration concerns can affect voluntariness without making every person in a group incapable of deciding.
Scientific design matters because a poorly designed study can expose people to burden without a reasonable chance of answering the question. The IRB need not replace peer review, but it cannot assess the risk-benefit relationship while ignoring whether the methods can produce useful knowledge.
Exempt research is still governed by conditions#
Section 46.104 describes eight exemption categories in the 2018 Requirements. They cover defined forms of education research, tests and surveys, benign behavioral interventions, secondary research, public-benefit programs, taste and food-quality studies, and certain storage or secondary use relying on broad consent.
“Exempt” means exempt from many Common Rule requirements because the activity fits all conditions of a category. It does not mean no privacy risk, no consent question, or no institutional oversight. Institutions decide who may issue an exemption determination. Many do not allow investigators to self-exempt.
Some exemptions exclude parts of research involving children or prisoners. Some require that identities are not readily ascertainable, that disclosure would not reasonably place subjects at risk, or that an IRB performs limited review. If the activity changes, it may no longer fit.
Limited IRB review focuses on specified matters, often privacy and confidentiality or whether proposed secondary research falls within broad consent. It is narrower than full review but still must be performed by a qualified IRB under the applicable provision.
Expedited review does not mean fast approval#
An IRB may use an expedited procedure for research that is no more than minimal risk and appears on the federal expedited-review list, for minor changes in previously approved research, and for limited review required by certain exemptions.
The chair or one or more experienced IRB members designated by the chair conducts the review. An expedited reviewer may exercise the IRB's approval authorities but may not disapprove a study. Disapproval can occur only after convened review.
The word “expedited” describes who reviews and how, not a promised turnaround time. A complex minimal-risk data study may take longer to resolve than a well-prepared convened-review submission. Missing privacy details, unclear consent language, or an uncertain data flow can stop either route.
Minimal risk means that the probability and magnitude of harm or discomfort anticipated are not greater than those ordinarily encountered in daily life or during routine physical or psychological examinations or tests. It does not mean zero risk.
Convened review and continuing oversight#
Research that is not exempt and does not qualify for expedited review ordinarily goes to a convened board. The board may approve, require modifications to secure approval, or disapprove. It records votes, controverted issues, required changes, and reasons for decisions.
Approval is not a permanent shield. Investigators generally must obtain approval before implementing protocol changes unless a change is necessary to eliminate an apparent immediate hazard. Unanticipated problems, serious or continuing noncompliance, and suspensions or terminations require reporting through defined channels.
The 2018 Requirements removed routine annual continuing review for many expedited studies and for research that has progressed only to analyzing identifiable data or accessing follow-up clinical data, unless the IRB documents a reason to require it. That change does not end oversight. Amendments and reportable events still matter, and other regulations or funders may require continuing review.
Consent is more than a signature#
The revised rule requires that consent begin with a concise, focused presentation of key information likely to help a reasonable person decide. The form must present information in understandable language, minimize the possibility of coercion or undue influence, and give enough opportunity to consider participation.
Required elements generally include purpose, expected duration, procedures, foreseeable risks, possible benefits, alternatives when relevant, confidentiality, compensation and treatment for research injury when applicable, contacts, and voluntariness. Additional elements apply when circumstances warrant.
Payment is not automatically coercive. The question is whether its amount, timing, and conditions create undue influence or unfairly penalize withdrawal. Reimbursement, compensation for time, and an incentive may raise different issues.
An IRB can waive or alter consent only when the regulatory criteria are satisfied. These include findings about minimal risk, impracticability, effects on rights and welfare, and provision of information afterward when appropriate, with additional conditions for research using identifiable private information or biospecimens. “It would be easier” is not the same as impracticable. Documentation can also be waived in defined circumstances. A consent conversation may still be required even when no signature is collected.
Broad consent is optional and limited#
The revised Common Rule created broad consent as an optional route for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens. It is not blanket permission for any future use.
The consent must describe types of future research, information or specimens involved, possible sharing, time period, whether commercial profit may result, return of results, and whom to contact, among other elements. An IRB conducts limited review for the relevant exemptions.
Institutions are not required to implement broad consent, and many use other lawful pathways. A significant constraint is that if a person was asked for broad consent and refused, the IRB may not later waive consent for that same storage, maintenance, or secondary use under the Common Rule.
Single-IRB review divides responsibilities#
Since January 20, 2020, most covered cooperative research conducted in the United States must rely on a single IRB for the U.S. portion, subject to regulatory exceptions. The reviewing IRB may be proposed by the lead institution or selected by the supporting federal department or agency.
A single IRB does not make local institutions passive. Reliance agreements define responsibilities for reporting, local context, investigator qualifications, conflicts, ancillary reviews, consent language, privacy, and communication. Radiation safety, pharmacy, data security, biosafety, and contracting may remain local.
The model aims to reduce duplicate protocol review, but coordination can still be complex. Write down who owns each task. “The central IRB handled it” does not answer who was supposed to report a local event or check that a site was ready.
Special protections are layered onto Subpart A#
HHS regulations add Subpart B for pregnant women, human fetuses, and neonates; Subpart C for prisoners; and Subpart D for children. Each contains additional conditions. A project can satisfy the Common Rule's general criteria and still fail a subpart requirement.
Children usually require parental permission and the child's assent when the child is capable, with details depending on risk and prospect of benefit. Prisoner research requires permitted categories, equitable selection, attention to parole effects, and a prisoner representative on the IRB. Pregnancy is not a universal exclusion; unjustified exclusion can also be harmful and inequitable. Capacity is decision-specific and can fluctuate. When adults have impaired consent capacity, the protocol should address assessment, legally authorized representatives under applicable law, assent or objection, and reconsent if capacity returns.
Privacy, confidentiality, and identifiability#
Privacy concerns the circumstances in which people are observed or provide information. Confidentiality concerns how collected information is handled. A protocol can respect one and fail the other.
The IRB examines data elements, identifiers, access, transfer, storage, retention, sharing, breach response, and whether identifiability is necessary. Coding is not the same as de-identification when someone can access the key. Genetic and small-population data may remain reidentifiable even after direct identifiers are removed.
HIPAA is a separate rule with different definitions, covered entities, and authorization or waiver standards. An IRB approval does not automatically satisfy HIPAA, and HIPAA compliance does not automatically satisfy the Common Rule. Certificates of Confidentiality can protect identifiable, sensitive research information from compelled disclosure in many circumstances, but they do not replace security or every mandatory-reporting duty. Participants should receive an accurate explanation of protection and limits.
What approval does and does not establish#
IRB approval establishes that the board found the submitted study met applicable approval criteria at that time. It does not prove the hypothesis, certify the accuracy of every statement, guarantee no adverse event, or endorse later marketing.
The protocol reviewed matters. A press release, app update, recruitment advertisement, or secondary analysis may differ materially from what the board saw. Publication peer review, regulatory product authorization, sponsor monitoring, data audits, and institutional compliance serve other functions.
Say which route your study took: exempt determination, expedited approval, convened approval, or not-human-subject-research determination. Collapsing all four into “IRB approved” can overstate what occurred.
A practical submission map#
Most of the delay is avoidable. Before you submit, settle the question and the population, map where every piece of data and every specimen goes, work out which rules apply, and say who performs each procedure. Risks should include informational, social, economic, legal, and psychological harms, not only physical injury.
Your consent and recruitment materials should use the same facts as the protocol. Inclusion and exclusion criteria should have scientific and safety reasons. Payment, translation, accessibility, remote procedures, incidental findings, return of results, and data sharing should be addressed explicitly.
After approval, you need version control, staff training, delegation records, consent documentation, event reporting, and a plan for amendments. The ethical protocol is the one the team can actually carry out, not the idealized one in a file.
The durable idea#
The Common Rule is a floor for accountable research, not a substitute for judgment. It asks whether an activity is covered, assigns review routes according to defined conditions, and requires attention to risk, fairness, consent, privacy, and additional safeguards.
An IRB makes those requirements operational through multidisciplinary review and continuing authority. Its best work is neither automatic obstruction nor automatic permission. It is a documented examination of whether a valuable question can be pursued while treating participants as people whose rights, interests, and circumstances matter.
References#
- Electronic Code of Federal Regulations. 45 CFR part 46, Protection of Human Subjects.
- HHS Office for Human Research Protections. Revised Common Rule resources.
- National Commission. The Belmont Report.
- FDA. Comparison of FDA and HHS human-subject protection regulations.
- HHS Office for Human Research Protections. Human-subject regulations decision charts.
- HHS Office for Human Research Protections. What are IRBs?.
Questions and answers
Does every study involving people need IRB approval?
No. Some activities are not research, do not involve human subjects as defined, or fall outside Common Rule coverage. Some research is exempt. Institutions commonly require an authorized determination before work starts.
Does exempt research receive no review?
Not necessarily. An institution may review eligibility, privacy, conflicts, or local policy, and four revised-rule exemptions require limited IRB review. Exempt status lasts only while all category conditions remain satisfied.
Is expedited review less ethical than full-board review?
No. It is a regulatory procedure for defined no-more-than-minimal-risk research, minor changes, and certain limited reviews. The same core approval criteria apply when relevant.
Can an IRB force an investigator to change a study?
An IRB can require modifications as a condition of approval and can suspend or terminate approval. An institution may add protections but generally cannot authorize research that the IRB disapproved.
Are the Common Rule and HIPAA the same thing?
No. The Common Rule protects participants in covered research. HIPAA regulates protected health information held by covered entities and business associates. A project may need to satisfy both, one, or neither, plus other law and policy.