Frequently Asked Questions: Limited Institutional Review Board Review and Related Exemptions

Date of Issuance: June 16, 2023

Note: This draft guidance is consistent with the 2018 Requirements (i.e., the revised Common Rule).

---

This guidance, when finalized, will represent the Office for Human Research Protections’ (OHRP’s) current thinking on this topic and should be viewed as recommendations unless specific regulatory requirements are cited. The use of the word “must” in OHRP guidance means that something is required under the Department of Health and Human Services (HHS) regulations at 45 CFR part 46. The use of the word “should” in OHRP guidance means that something is recommended or suggested, but not required. An institution may use an alternative approach if the approach satisfies the requirements of the HHS regulations at 45 CFR part 46. OHRP is available to discuss alternative approaches at 240-453-6900 or 866-447-4777.

---

Contents

I. Introduction

A. Terms

B. Scope and Audience

II. What is limited IRB review? What role does it serve in the 2018 Requirements?

III. When do the exemptions require limited IRB review and what determinations must an IRB make?

A. The exemption for research that only includes interactions involving educational tests, survey procedures, interview procedures, or observation of public behavior (45 CFR 46.104(d)(2))

B. The exemption for benign behavioral interventions in conjunction with the collection of information from adults (45 CFR 46.104(d)(3)(i))

C. The exemption for storage or maintenance of identifiable biospecimens or identifiable private information for secondary research for which broad consent is required (45 CFR 46.104(d)(7))

D. The exemption for secondary research involving the use of identifiable private information or identifiable biospecimens for which broad consent is required (45 CFR 46.104(d)(8))

IV. Who may conduct limited IRB review and how may it be conducted?

V. What aspects of the 2018 Requirements apply when limited IRB review is conducted?

VI. Which provisions of the 2018 Requirements need not be followed when limited IRB review is conducted?

VII. What happens when an investigator contemplates making changes to an exempt research activity that requires limited IRB review as a condition of exemption? When must an IRB conduct a new limited review before such changes can be implemented?

VIII. Can limited review be conducted using an expedited procedure?

IX. How may an IRB obtain sufficient expertise to review provisions for protecting privacy and confidentiality?

X. What should an IRB consider when reviewing provisions protecting privacy and confidentiality when a study eligible to be exempt under 45 CFR 46.104(d)(7) involves a change to storage or maintenance of the information or biospecimens made for research purposes?

XI. What should an IRB consider when reviewing whether a specific secondary study is within the scope of a broad consent?

Additional Information

---

I. Introduction

A. Terms

Pre-2018 Requirements: The term “pre-2018 Requirements” refers to subpart A of 45 CFR part 46 as published in the 2016 edition of the Code of Federal Regulations .¹ The pre-2018 Requirements were originally promulgated in 1991, and subsequently amended in 2005.

2018 Requirements: The term “2018 Requirements” refers to subpart A of 45 CFR 46 (often referred to as the Common Rule) as published in the July 19, 2018 edition of the e-Code of Federal Regulations .² The 2018 Requirements were originally published on January 19, 2017 and further amended on January 22, 2018 and June 19, 2018. More information about implementing the revised Common Rule is available on the OHRP website at https://www.hhs.gov/ohrp/education-and-outreach/revised-common-rule/revised-common-rule-q-and-a/index.html.

Secondary Research: While not defined in the 2018 Requirements, in this guidance OHRP considers the term “secondary research” to generally refer to the research use of identifiable private information or identifiable biospecimens that are or will be collected for a purpose other than the present research use. The original purpose of the collection may be for nonresearch activities, such as blood collected for routine clinical tests, information collected for census work, or public health or health care quality assurance activities. In addition, secondary research may refer to the use of identifiable private information or identifiable biospecimens originally collected for research purposes and subsequently used for a different research purpose.

Identifiable Private Information and Identifiable Biospecimens: These terms are defined under 45 CFR 46.102(e)(5) and (6): “(5) Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information;” and “(6) An identifiable biospecimenis a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen.”

Broad Consent: Broad consent, as detailed in the 2018 Requirements at 45 CFR 46.116(d), is an alternative to standard informed consent obtained under § 46.116(b) and (c). It is a form of consent in which an individual or their legally authorized representative permits their identifiable private information or identifiable biospecimens—that have been or will be collected either for another research study or for nonresearch purposes—to be stored, maintained, and used in secondary research. When an individual provides broad consent, they are consenting to secondary research using their identifiable private information or identifiable biospecimens in accordance with the conditions stipulated in that broad consent.

B. Scope and Audience

This guidance document applies to HHS-supported or -conducted research involving human subjects that meets the requirements of one of the following four exemptions in the 2018 Requirements that require limited institutional review board (IRB) review:

• 45 CFR 46.104(d)(2)(iii),
• 45 CFR 46.104(d)(3)(i)(C),
• 45 CFR 46.104(d)(7), and
• 45 CFR 46.104(d)(8).

The guidance discusses the concept of limited IRB review and provides information about how limited review may be conducted. As there are many regulatory provisions that are interconnected with limited IRB review, OHRP recommends reviewing this guidance document in conjunction with a copy of the regulatory text of the 2018 Requirements .³

Two of these exemptions pertain to research involving a collection of information by interacting or intervening with subjects: §§ 46.104(d)(2)(iii) and (d)(3)(i)(C).

The exemption at § 46.104(d)(7), for which broad consent is required, pertains to storage or maintenance of identifiable private information or identifiable biospecimens for potential secondary research use.

The exemption at § 46.104(d)(8), for which broad consent is required, pertains to secondary research use of identifiable private information or identifiable biospecimens.

While broad consent is a requirement of the exemptions found at §§ 46.104(d)(7) and (8), this guidance does not address what information would satisfy the elements of broad consent found in 45 CFR 46.116(d).

This document also discusses IRB and investigator responsibilities when reviewing and conducting exempt research that requires limited IRB review as a condition of exemption. Note that limited IRB review is a provision that is only included in the 2018 Requirements. If a research study is covered by the pre-2018 Requirements, then limited IRB review is not a consideration.

The target audience for this document includes IRBs, investigators, research administrators and other relevant institutional officials, and funding agencies that may be responsible for review or oversight of human subjects research conducted or supported by HHS, and the general public.

II. What is limited IRB review? What role does it serve in the 2018 Requirements?

The 2018 Requirements attempt to better align the level of IRB review required for a given research activity with its risk profile, while retaining appropriate protections for human subjects. For research in which the primary risks relate to privacy and confidentiality, the 2018 Requirements create a new type of IRB review, called “limited IRB review.” Research that qualifies for an exemption requiring limited IRB review under the 2018 Requirements generally would have required IRB review either through the expedited review procedure or by a convened IRB under the pre-2018 Requirements. The purpose of limited IRB review is to reduce the administrative burden imposed by IRB review while also helping to ensure human subjects are appropriately protected.

This new form of IRB review is required for research that falls within one or more of four exemption categories: 45 CFR 46.104(d)(2)(iii), 45 CFR 46.104(d)(3)(i)(C), 45 CFR 46.104(d)(7), and 45 CFR 46.104(d)(8).

To meet these exemptions, an IRB, through either a convened meeting or an expedited procedure, must review specific, more limited aspects of a proposed research study (i.e., 45 CFR 46.111(a)(7) or (8), as appropriate) as opposed to considering all of the criteria for IRB approval of research found at § 46.111. For example, three of the four exemptions (exemption § 46.104(d)(7) being the exception) require that an IRB review the research to ascertain whether the requirements at § 46.111(a)(7) are met (i.e., to determine that, when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data).⁴ In these cases, an IRB conducting the limited review would not be required to evaluate whether or not the study satisfies any of the other criteria at § 46.111. The exemption at § 46.104(d)(7) calls for a limited IRB review to make the determinations required at § 46.111(a)(8) regarding broad consent and protection of privacy and confidentiality (see Section III for further discussion).

The regulatory requirements relevant to IRB qualifications provided by 45 CFR 46.107(a) are applicable to limited IRB review. (See Section IV for more detail.) Other regulatory requirements such as the certification of IRB review and approval as required at 45 CFR 46.103(d) are not applicable (see Section VI). However, for research requiring limited IRB review that takes place at an institution where IRB review is conducted by an IRB not operated by the institution, some type of reliance agreement is required to ensure compliance with the regulatory requirements (45 CFR 46.103(e)).

Note that institutions may rely on a single IRB to conduct limited review of cooperative research (45 CFR 46.114) but are not required to do so. Further, the IRB conducting limited IRB review does not retain oversight responsibility over the exempted research in the same way that the IRB maintains oversight responsibility over nonexempt research approved by the IRB and covered by an institution’s Federalwide Assurance (FWA). (Detailed lists of what are and are not IRB and institutional responsibilities when conducting limited review are provided in Sections V and VI of this guidance.)

As is the case for research activities under the pre-2018 Requirements, a human subjects research activity to which the 2018 Requirements apply must satisfy the criteria of one or more exemptions at all times for the activity to be considered exempt and to maintain its exempt status. Additionally, the 2018 Requirements do not specify who may determine that a research activity meets an exemption category, nor do they specify how determinations required as a condition of an exemption must be made. Institutions are free to choose their own methods for conducting, communicating, or recording exempt determinations.

Finally, an institution may establish its own policies and procedures regarding how activities eligible for the four exemptions that require limited IRB review are identified, and how the limited IRB determinations are sought to fulfill the exemption criteria. For more on this issue, see OHRP’s Exemption Determination FAQs.⁵

III. When do the exemptions require limited IRB review and what determinations must an IRB make?

Four exemption categories in the 2018 Requirements call for an IRB to make certain determinations through limited IRB review as a criterion of the exemption. (See OHRP’s Decision Charts 04, 05, 09, and 10 at https://www.hhs.gov/ohrp/regulations-and-policy/decision-charts-2018/index.html#c4.) Note that the regulations do not specify who at an institution may determine that research is exempt under 45 CFR 46.104. However, OHRP recommends that, because of the potential for conflict of interest, investigators not be given the authority to make an independent determination that human subjects research is exempt. For more on this issue, see OHRP’s Exemption Determination FAQs.⁶

A. The exemption for research that only includes interactions involving educational tests, survey procedures, interview procedures, or observation of public behavior (45 CFR 46.104(d)(2))

The exemption at 45 CFR 46.104(d)(2) is for research that only includes interactions involving educational tests, survey procedures, interview procedures, or observation of public behavior. This exemption has three subparts (criteria) and applies if the conditions of at least one of the criteria is met.

The first two criteria (§§ 46.104(d)(2)(i) and (ii)) do not require limited IRB review because (i) they either involve research for which the information is recorded in such a manner that the identity of the subjects cannot be readily ascertained, or (ii) because any disclosure of the subject’s responses outside the research would not reasonably place them at risk of a variety of types of risk or harms.

The third criterion (§ 46.104(d)(2)(iii)) requires an IRB to conduct a limited review to make the determinations required by 45 CFR 46.111(a)(7); that is, to determine that when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. Limited IRB review in this case is required because, unlike § 46.104(d)(2)(i), the information obtained is recorded by the investigator in such a manner that the identity of the human subjects can be readily ascertained, directly or through identifiers linked to the subjects, and unlike § 46.104(d)(2)(ii), disclosure of the human subjects’ responses outside the research might reasonably place them at risk of a variety of types of harms. Note that this criterion may not be applied to research subject to subpart D (Additional Protections for Children Involved as Subjects in Research) (45 CFR 46.104(b)(3)).

B. The exemption for benign behavioral interventions in conjunction with the collection of information from adults (45 CFR 46.104(d)(3)(i))

The exemption at 45 CFR 46.104(d)(3)(i) applies to research involving benign behavioral interventions in conjunction with the collection of information from adult subjects if the subject prospectively agrees to the intervention and information collection. This exemption has three subparts (criteria) and applies if the conditions of at least one of the subparts is met.

The first two criteria (§§ 46.104(d)(3)(i)(A) and (B)) do not require limited IRB review because (A) they either involve research for which the information is recorded in such a manner that the identity of the subjects cannot be readily ascertained or (B) because any disclosure of the subject’s responses outside the research would not reasonably place them at risk of a variety of types of risk or harms.

However, the third criterion (§ 46.104(d)(3)(i)(C)) requires an IRB to conduct a limited review to make the determinations required by 45 CFR 46.111(a)(7); that is, to determine that, when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. Limited IRB review in this case is required because, unlike § 104(d)(3)(i)(A), the information obtained is recorded by the investigator in such a manner that the identity of the human subjects can be readily ascertained, directly or through identifiers linked to the subjects, and unlike § 104(d)(3)(i)(B), disclosure of the human subjects’ responses outside the research might reasonably place them at risk of a variety of types of harms.

C. The exemption for storage or maintenance of identifiable biospecimens or identifiable private information for secondary research for which broad consent is required (45 CFR 46.104(d)(7))

This exemption requires that an IRB conduct a limited review and make the determinations required by 45 CFR 46.111(a)(8). Section 46.111(a)(8) requires an IRB to determine the following:

• That broad consent is obtained in accordance with 45 CFR 46.116(a)(1)-(4), (a)(6), and (d).
  • Note that the IRB conducting the limited review is not required to approve the content of the broad consent document  as a condition of this exemption. However, the limited IRB review must include a determination that the broad consent (i.e., the form or, if documentation is waived under § 46.117(c)(1), the script or comparable document) satisfies §§ 46.116(a)(1)-(4), (a)(6), and (d). For example, the IRB need not approve a particular broad consent form or script as part of the limited IRB review. Rather, the IRB would need to determine that broad consent is obtained in accordance with the relevant regulatory requirements.
  • Institutions and IRBs have the flexibility to develop their own policies and procedures to ensure that activities conducted under this exemption use broad consent that satisfies the relevant regulatory provisions
• That broad consent is appropriately documented or that documentation is waived per 45 CFR 46.117.
  • Note: Oral broad consent is permitted when documentation of informed consent is appropriately waived under § 46.117(c)(1).
• If there is a change made for research purposes in the way identifiable private information or identifiable biospecimens are stored or maintained, that adequate provisions are made to protect the privacy of subjects and to maintain the confidentiality of data.
• Examples of such changes to the storage or maintenance of information or biospecimens for research-related purposes might include the following:
  • As part of the research plans, information or biospecimens are moved from one electronic or physical storage location to another, such as a move from a clinical laboratory to a research registry or repository.
  • Information or biospecimens will be stored for potential secondary research purposes for longer than they otherwise would have been for the original purpose for which they were collected.
  • Investigators are given electronic or physical access that they do not otherwise have to identifiable private information or identifiable biospecimens.

Note that this exemption does not apply to primary collections of information or biospecimens. Primary collection is when an investigator obtains information or biospecimens through an intervention or interaction with research subjects for the purpose of the proposed research. For example, if an investigator wants to collect information directly from research subjects by asking them to complete a questionnaire, that would not be covered by this exemption. If an investigator wants to collect biospecimens by having subjects swab their cheek, that would similarly not be covered by this exemption. Alternatively, if an investigator wants to store or maintain for secondary research purposes identifiable information in a databank or identifiable biospecimens in a pathology laboratory, this exemption could apply assuming all of the relevant conditions described in 45 CFR 46.104(d)(7) are met.

D. The exemption for secondary research involving the use of identifiable private information or identifiable biospecimens for which broad consent is required (45 CFR 46.104(d)(8))

This exemption requires an IRB to conduct a limited review to make the determinations required by 45 CFR 46.111(a)(7); that is, to determine that, when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. Additionally, the exemption requires that an IRB conduct a limited review to determine whether the research to be conducted is within the scope of the broad consent that was obtained for the storage, maintenance, and secondary use of identifiable private information or identifiable biospecimens (45 CFR 46.104(d)(8)(iii)).

Note that for this exemption to apply, three additional requirements must be satisfied. These requirements are:

• Broad consent was obtained in accordance with 45 CFR 46.116(a)(1)-(4), (a)(6), and (d) (45 CFR 46.104(d)(8)(i));
  • Note that the IRB conducting the limited review is not required to approve the broad consent itself (i.e., the form or, if waived under § 46.117(c)(1), the script or comparable document) as a condition of this exemption. However, the broad consent used must satisfy §§ 46.116(a)(1)-(4), (a)(6), and (d).
• Documentation of broad consent or waiver of documentation of broad consent was obtained in accordance with 45 CFR 46.117 (§ 46.104(d)(8)(ii)); and
• The investigator does not include returning individual research results to subjects as part of the study plan. This provision does not prevent an investigator from abiding by any legal requirements to return individual research results (§ 46.104(d)(8)(iv)).

The regulations do not specify who must review these three requirements or make a determination that they have been satisfied. Institutions and IRBs accordingly have the flexibility to develop their own policies and procedures to ensure that activities conducted under this exemption involve broad consent that satisfies the relevant regulatory provisions.

IV. Who may conduct limited IRB review and how may it be conducted?

Because limited IRB review must be conducted by an IRB as defined by 45 CFR 46.102(g), IRBs conducting limited review must comply with provisions of the 2018 Requirements that are applicable to IRB composition and expertise and the conduct of IRB review that are applicable to the limited review context. This means that IRBs conducting limited IRB review must (1) meet the membership requirements of 45 CFR 46.107, (2) satisfy the functions and operations requirements of 45 CFR 46.108 that are relevant to the limited IRB review context, and (3) maintain IRB records in accordance with 45 CFR 46.115. As is discussed in more detail in Section V, limited IRB review may be conducted via the expedited review procedure (see 45 CFR 46.110(b)(1)(iii) and (b)(2)).

V. What aspects of the 2018 Requirements apply when limited IRB review is conducted?

For studies that meet the conditions of one of the four exemptions requiring limited IRB review:

• IRBs are permitted to conduct limited review using the expedited review procedure (45 CFR 46.110(b)(1)(iii)).
  • As with any other form of expedited review, if limited IRB review is done through expedited review, it may be carried out by the IRB chairperson or by one or more experienced reviewers designated by the chairperson from among members of the IRB (45 CFR 46.110(b)(2)).
• IRBs must be sufficiently qualified to review the material relevant to the determination to be made through limited IRB review (45 CFR 46.107(a)).
• Institutions, or IRBs where appropriate, must maintain records of limited IRB reviews conducted to the extent required by 45 CFR 46.115.
• IRBs are only required to review broad consent to the extent required by the terms of the relevant exemption.
• If the IRB conducting the limited review is not operated by the institution conducting the research, the institution must document reliance on the IRB (and the responsibilities that each entity will undertake to ensure compliance with the regulatory requirements) (45 CFR 46.103(e)).

VI. Which provisions of the 2018 Requirements need not be followed when limited IRB review is conducted?

For studies that meet the conditions for one of the four exemptions requiring limited IRB review, IRBs and institutions are not required by the regulations to:

• Have a Federalwide Assurance (FWA) if the only type of research conducted at the institution involves activities that meet one or more of the 45 CFR 46.104(d) categories (45 CFR 46.103(a)).
• Certify to the funding or supporting department or agency that the research has undergone limited IRB review as described in the applicable exemption(s) (45 CFR 46.103(d)).
• Ensure prompt reporting to the IRB, appropriate institutional officials, the department or agency head, and OHRP of: (1) any unanticipated problems involving risks to subjects or others or any serious or continuing noncompliance with this policy or the requirements or determinations of the IRB, and (2) any suspension or termination of IRB approval (45 CFR 46.104(a), 45 CFR 46.108(a)(4)).
• Conduct continuing review of the determination(s) made by the IRB conducting the limited review unless the IRB determines otherwise (45 CFR 46.109(f)(1)(ii)).
  • However, if an IRB determines that continuing review is required regarding the determination(s) made by the IRB conducting the limited review, the reason for the continuing review must be documented (45 CFR 46.115(a)(3)).
• Adopt a method for keeping all members of the IRB advised of exempt research proposals that require limited IRB review that have been reviewed under the expedited review procedure (§ 46.104(a), 45 CFR 46.110(c)).
• Use a single IRB for cooperative research that meets the conditions of one of the four exemptions that require limited IRB review (§ 46.104(a), 45 CFR 46.114).
  • However, if a single IRB is used voluntarily, and the IRB is not operated by the institution conducting the research, reliance on that single IRB (and the responsibilities that each entity will undertake to ensure compliance with the requirements of the 45 CFR part 46) must be documented (45 CFR 46.103(e)).
• Post an informed consent form to one of the federal websites identified as the posting location for such forms (§ 46.104(a), 45 CFR 46.116(h)).

Moreover, the determinations required for limited IRB review at 45 CFR 46.111(a)(8) state that the IRB need not make the determinations at § 46.111(a)(1)-(7), of which (1) and (2) relate to risk determinations.

Note that an institution or, when appropriate, an IRB can implement any of the above through institutional policies. In addition, funding agencies might have different legal requirements or policies.

VII. What happens when an investigator contemplates making changes to an exempt research activity that requires limited IRB review as a condition of exemption? When must an IRB conduct a new limited review before such changes can be implemented?

Once a research activity satisfies the conditions of an exemption, the research needs to continue to satisfy all conditions of the exemption in order to maintain exempt status throughout the conduct of the human subjects research. If, after initiation, the investigator modifies the research in a way inconsistent with the conditions of the exemption, then the research can no longer be conducted as exempt (under that particular exemption) (45 CFR 46.104(a)).

The exemptions conditioned on determinations made through limited IRB review do not specify when, or whether, another limited IRB review may be required to assess privacy and confidentiality safeguards that have changed since the initial limited IRB review. The requirements of 45 CFR part 46 also do not specify who makes exemption determinations or how or whether an institution should monitor exempt research to ensure that it is appropriately conducted in accordance with the exemption conditions. In other guidance, OHRP has previously stated: “Investigators should consult with the appropriate institutional authority whenever questions arise about whether planned changes to an exempt study might make that study nonexempt human subjects research. OHRP recommends that institutions have policies in place to define how proposed changes to exempt research will be evaluated. The person(s) authorized to make this determination should have access to sufficient information to make a correct determination. In addition, the institution should ensure the appropriate communication of such a policy to all investigators.” For more on this issue, see FAQ, https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/exempt-research-determination/index.html⁷

That quoted language is equally applicable to proposed changes to an exempt study that required limited IRB review in that it must be determined whether the changes could render the research non-exempt. When evaluating whether the study remains exempt, the person(s) making the described determinations would need to determine whether the prior limited IRB review needs to be conducted again. A new limited IRB review is only required when the changes made alter aspects of the study that were relevant to the determinations made as part of the earlier limited IRB review. If a new limited IRB review is required, this must occur for the study to remain exempt under one of the categories requiring limited IRB review as a criterion of the exemption.

For example, in a study that had previously been determined to be exempt under 45 CFR 46.104(d)(2)(iii) or 46.104(d)(3)(i)(C), no additional limited IRB review would be required when the proposed revised research newly incorporates a more protective safeguard in addition to those that were already reviewed by the IRB and determined to be adequate. The same would be true where the revised research incorporates a set of privacy and confidentiality safeguards that during the original limited review the IRB had determined would be adequate if adopted in the future. Alternatively, another limited IRB review might be required if the proposed changes introduce or alter risks to the privacy or security of the stored information or biospecimens (e.g., giving access to or transferring information or biospecimens for research purposes to someone who otherwise would not have access).

VIII. Can limited review be conducted using an expedited procedure?

Yes. Limited IRB review may be conducted via the expedited review mechanism as permitted by 45 CFR 46.110(b)(1)(iii). Note that studies eligible for expedited limited IRB review as described in this provision may be more than minimal risk and still qualify for expedited review. There are no minimal risk conditions associated with meeting any exemption.

IX. How may an IRB obtain sufficient expertise to review provisions for protecting privacy and confidentiality?⁸

The regulations require that an IRB is sufficiently qualified to adequately evaluate the studies it reviews (45 CFR 46.107(a)). In the limited review context, this requirement means that an IRB must be sufficiently qualified to evaluate the features of the study that are relevant to the determinations to be made through limited IRB review.

The conditions of the exemptions at 45 CFR 46.104(d)(2)(iii), (d)(3)(i)(C), and (d)(8) require an IRB to, when appropriate, determine that there are adequate plans to protect the privacy of subjects and confidentiality of data. This is the same IRB approval criterion related to privacy and confidentiality that is required for nonexempt human subjects research.

If an IRB conducting limited review determines that it does not have sufficient expertise in these areas, it could gain the necessary expertise in a variety of ways. Examples include:

• Recruiting new IRB members with particular expertise in privacy and confidentiality
• Inviting experts with competency in privacy and confidentiality to consult with the IRB in conducting its review (45 CFR 46.107(e))
• Periodically training IRB members in privacy and confidentiality procedures

X. What should an IRB consider when reviewing provisions protecting privacy and confidentiality when a study eligible to be exempt under 45 CFR 46.104(d)(7) involves a change to storage or maintenance of the information or biospecimens made for research purposes?

The exemption at 45 CFR 46.104(d)(7) requires that an IRB conduct a limited review that includes a determination that there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data when a change has been made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained (45 CFR 46.111(a)(8)(iii)). 

Examples of such changes to the storage or maintenance of information or biospecimens for research-related purposes might include the following:

• As part of the research plans, information or biospecimens are moved from one electronic or physical storage location to another, such as a move from a clinical laboratory to a research registry or repository
• Information or biospecimens will be stored for potential secondary research purposes for longer than they otherwise would have been for the original purpose for which they were collected
• Investigators are given electronic or physical access that they do not otherwise have to identifiable private information or identifiable biospecimens

The determination at 45 CFR 46.111(a)(8)(iii) is the same IRB determination related to privacy and confidentiality that is required for nonexempt research under 45 CFR 46.111(a)(7). Importantly, for purposes of this exemption, this IRB determination is required only when a change is made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, and only pertains to the aspects of storage and maintenance that are changed for research purposes. This is because the investigators are assuming responsibility for the manner in which the information and biospecimens are stored and maintained for potential secondary research.

If no changes are being made for research purposes to the storage or maintenance of identifiable private information or identifiable biospecimens, then the limited IRB review does not need to include a determination that there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. The institution storing and maintaining the information or biospecimens still may determine whether any protections distinct from those required by 45 CFR part 46 are appropriate to apply, which may include other legal or regulatory safeguards or institutional policies.

XI. What should an IRB consider when reviewing whether a specific secondary study is within the scope of a broad consent?

For the limited IRB review described in 45 CFR 46.104(d)(8), the IRB is required to evaluate whether the research to be conducted is within the scope of the broad consent (§46.104(d)(8)(iii)). To satisfy this requirement, the IRB must determine through limited review that the proposed secondary research corresponds to the type of research for which the subject gave consent in the broad consent that was previously sought and obtained. This requirement reflects the considerations that (1) subjects providing broad consent should have a reasonable expectation for how their identifiable private information and identifiable biospecimens could be used in secondary research, and (2) if a broad consent includes some limitations on the type of future research that would be conducted, such limitations must be honored.

For example, consider a broad consent that provides that an individual’s leftover breast cancer biopsy material would only be used in future, unspecified research on a broad range of cancers. If an investigator later proposes to use the leftover biospecimen for Alzheimer’s disease research, an IRB conducting a limited review for purposes of the exemption at § 46.104(d)(8) reasonably may determine that the proposed study is outside the scope of the broad consent. However, consider that if the proposed study instead was designed to  investigate a possible link between cancer and Alzheimer’s disease, the IRB reasonably may determine that the proposed study is within the scope of the broad consent.

OHRP recommends that if there is reason to believe some subjects might be particularly concerned about the types of secondary research that are proposed for exemption, an IRB conducting a limited review for purposes of the exemption at § 46.104(d)(8) should consider whether a potential subject would expect that their broad consent would cover such research. Note that the IRB conducting the limited IRB review is not doing so in order to approve the content of the broad consent document or the consent process. Rather, it is charged with determining whether the proposed research falls within the scope of the broad consent.

Although the regulations do not limit how broad a broad consent may be, it still must meet the requirements of § 46.116(d) in order for a proposed research activity to be eligible for the exemption found at § 46.104(d)(8).  

Additional Information

If you have specific questions about how to apply this guidance, please contact OHRP by phone at (866) 447-4777 (toll-free within the United States) or (240) 453-6900, or by e-mail at ohrp@hhs.gov.

---

Endnotes

¹  https://www.govinfo.gov/content/pkg/CFR-2016-title45-vol1/pdf/CFR-2016-title45-vol1-part46-subpartA.pdf

²  https://www.ecfr.gov/cgi-bin/text-idx?SID=83cd09e1c0f5c6937cd9d7513160fc3f&pitd=20180719&node=sp45.1.46.a&rgn=div6

³  https://www.ecfr.gov/cgi-bin/text-idx?SID=83cd09e1c0f5c6937cd9d7513160fc3f&pitd=20180719&node=sp45.1.46.a&rgn=div6

⁴  Note that this document does not constitute the guidance on privacy and confidentiality referenced in § 46.111(a)(7)(i).

⁵  https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/exempt-research-determination/index.html

⁶  https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/exempt-research-determination/index.html

⁷  https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/exempt-research-determination/index.html

⁸  Note that this document does not constitute the guidance on privacy and confidentiality referenced in § 46.111(a)(7)(i).