IRB Frequently Asked Questions

When to Obtain IRB Approval

Protocol Questions

Tutorial Questions


When to Obtain IRB Approval

What exactly qualifies as human subjects research?

Any systematic investigation (including pilot studies, program evaluations, qualitative research), that is designed to develop or contribute to generalizable (scholarly) knowledge, and which uses living humans or identifiable private information about living humans qualifies as human subjects research. See Definition of Human Subjects Research for more information.

top of page

Does my study need IRB review?

We cannot make an official determination of whether a study requires IRB approval via email or over the phone. In order to receive a written response from the IRB confirming that no IRB approval is needed for this project, please submit a Request for a Determination of Non-Human Subjects Research Form.   If you do not need a formal written response from the IRB, you may use the form as a guide to determine whether you need to submit to the IRB for this particular project. See Definition of Human Subjects Research for more information.

Do students' academic research projects require IRB approval?

Yes, if a student's research project qualifies as human subjects research; whether it is biomedical or social-behavioral in nature, IRB approval is required prior to initiation.

Students, fellows, residents are required to obtain a faculty sponsor to oversee the research. For more information on the requirements for faculty sponsor eligibility, see Lead Researcher Eligibility.

top of page

Does secondary analysis of a data set gathered for another purpose require a new research project for review?


Projects that use an existing data set which includes identifiable data gathered in earlier research projects may require a new IRB protocol for review. Secondary analysis of existing data may include the review of medical records, student records, data collected from previous studies, audio/video recordings, etc. that were initially collected for another purpose. In order to be existing, the information must be "on the shelf" (i.e., it has already been collected) at the time that the current research is proposed.

Though such projects do not involve interactions or interventions with humans, they may still require IRB review, since the definition of "human subject" at 45 CFR 46.102(f) includes living individuals about whom an investigator obtains identifiable private information for research purposes.

In addition to being identifiable, the existing data must include "private information" in order to constitute research involving human subjects. Private information is defined as information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (e.g., a medical or school record). Information that contains identifiers and can be accessed freely by the public (without special permission or application) is not "private" and the research therefore does not therefore involve human subjects. For example, a study involving only analysis of the published salaries and benefits of public university presidents would not need IRB review since this information is not private.

Data analysis activities that meet the definition of research with human subjects may qualify for an exemption or require expedited or even full committee review. Any such project must receive IRB approval or a determination of exemption before the investigator accesses the data.

When does the secondary use of existing data not require review?
In general, the secondary analysis of existing data does not require IRB review when it does not fall within the regulatory definition of research involving human subjects, as referenced above.

Note: Although the definition of a human subject includes only living individuals, thereby excluding decedents, there are cases in which the health information of the deceased and death data files may require IRB review. For additional information and clarification on what constitutes human subject research, refer to Activities that Require IRB Review.

Public data: Public use data sets (such as portions of U.S. Census data, data from the National Center for Educational Statistics, National Center for Health Statistics, etc.) are data sets prepared with the intent of making them available for the public. The data available to the public are not individually identifiable and therefore their analysis would not involve homan subjects.

De-identified data: If the dataset has been stripped of all identifying information and there is no way that it could be linked back to the subjects from whom it was originally collected (through a key to a coding system or by any other means), its subsequent use by the lead researcher or another investigator would not constitute human subjects research, since it is no longer identifiable. Identifiable means the identity of the subject is known or may be readily ascertained by the investigator or associated with the information. In general, information is considered to be identifiable when it can be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems, or when characteristics of the information obtained are such that by their nature a reasonably knowledgeable person could ascertain the identities of individuals. Therefore, even though a dataset may have been stripped of direct identifiers (names, addresses, student ID numbers, etc.), it may still be possible to identify an individual through a combination of other characteristics (e.g., age, gender, ethnicity, and place of employment).

Example: Many student research projects involve secondary analysis of data that belongs to, or was collected by, their faculty advisor or another investigator. If the student is provided with a de-identified, non-coded data set, the use of the data does not constitute research with human subjects because there is no interaction with any individual and no identifiable private information will be used. The project does not therefore require IRB review.

Coded data: Secondary analysis of coded private information is not considered to be research involving human subjects and would not require IRB review if the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information pertains as a result of one of the following circumstances:

  1. The investigators and the holder of the key have entered into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (DHHS regulations for humans subjects research do not require the IRB to review and approve this agreement);
  2. There are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigator under any circumstances, until the individuals are deceased; or
  3. There are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.

Note: If a student is analyzing coded data from a faculty advisor/sponsor who retains a key, this would be human subjects research, because the faculty sponsor is considered an investigator on the student's protocol, and can readily ascertain the identity of the subjects since he/she holds the key to the coded data. If the student's work fits within the scope of the initial protocol from which the dataset originates, the faculty sponsor (or investigator who holds the dataset) may wish to consider adding the student and his/her work to the original protocol by means of a modification request rather than having the student submit a new application for review.

Example: Researcher A plans to examine the relationships between attention deficit hyperactivity disorder (ADHD), oppositional defiance disorder, and teen drug abuse using data collected by Agencies I, II, and III that work with "at risk" youth. The data will be coded and the agencies have entered into an agreement prohibiting release of the key to the researcher that could connect the data with identifiers. The use of the data would not constitute research with human subjects and does not require IRB review.

When is the secondary use of existing data exempt?
There are six categories of research activities involving human subjects that may be exempt from the requirements of the Federal Policy for the Protection of Human Subjects (45 CFR 46). However, only one category (Category 4) applies specifically to existing data. In order to qualify for an exempt determination, an Application for IRB Review must be submitted. The application is reviewed and if determined exempt, registered for a period of 5 years.

Research involving collection or study of existing data, documents, and records can be exempted under Category 4 of the federal regulations if: (i) the sources of such data are publicly available; or (ii) the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

The latter condition of this category applies in cases where the investigators initially have access to identifiable private information but abstract the data needed for the research in such a way that the information can no longer be connected to the identity of the subjects. This means that the abstracted data set does not include direct identifiers (names, social security numbers, addresses, phone numbers, etc.) or indirect identifiers (codes or pseudonyms that are linked to the subject's identity). Furthermore, it must not be possible to identify subjects by combining a number of characteristics (e.g., date of birth, gender, position, and place of employment). This is especially relevant in smaller datasets, where the population is confined to a limited subject pool.

The following do not qualify for exemption: Research involving prisoners, research involving collecting protected health information from HIPAA-covered entities and FDA-regulated research.

When is the secondary use of existing data non-exempt? If secondary analysis of existing data does involve research with human subjects and does not qualify for exempt status as explained above, the project must be reviewed either through expedited procedures or by the full committee. Again, an IRB Application must be submitted.

Consent: Researchers using data previously collected under another study should consider whether the currently proposed research is a "compatible use" with what subjects agreed to in the original consent form. For non-exempt projects, a consent process description or justification for a waiver must be included in the research protocol. The UCI IRB may require that informed consent for secondary analysis is obtained from subjects whose data will be accessed.

"Restricted Use Data": Certain agencies and research organizations release files to researchers with specific restrictions regarding their use and storage. The records frequently contain identifiers or extensive variables that combined might enable identification, even though this is not the intent of the researcher. Research using these data sets most often requires expedited or full committee review.

For an explanation of the different categories of human subjects research, see Levels of Review.

top of page

If departmental or personal funds are used to support research, is IRB approval required?

Yes. UCI has assured the federal regulatory agencies that the institution will review and approve all research involving human subjects before it is initiated. This assurance covers all research regardless of funding.

top of page

When do oral histories qualify as human subjects research?

A decision whether oral history or other activities solely consisting of open ended qualitative type interviews are subject to IRB review is based upon the prospective intent of the investigator. If the activity meets the federal definition of "research", IRB review is required.

The evaluation of such activities depends on whether the investigator is engaged in the creation of "generalizable knowledge" that is, whether the activity represents a systematic investigation in which the investigator engaged in such activities intends to develop or contribute to generalizable knowledge. Oral history activities, as described to OHRP by the oral history representatives, in general are designed to create a record of specific historical events and, as such, are not intended to contribute to generalizable knowledge.

General principles for evaluating Oral History type activities:

  • Oral history activities, such as open ended interviews, that ONLY document a specific historical event or the experiences of individuals without an intent to draw conclusions or generalize findings would NOT constitute "research" and would not require IRB review.
    • Example: An oral history video recording of interviews with World Trade Center (WTC) survivors is created for viewing in a museum. The creation of the videotape does NOT intend to draw conclusions, inform policy, or generalize findings. The sole purpose is to create a historical record of specific personal events and experiences related to the attack on the WTC and provide a venue for WTC survivors to tell their stories.
  • Systematic investigations involving open-ended interviews that are designed to develop or contribute to generalizable knowledge (e.g., designed to draw conclusions, inform policy, or generalize findings) WOULD constitute "research" and require IRB review
    • Example: Open ended interviews of surviving Gulf War veterans to document their experiences and to draw conclusions about their experiences, inform policy, or generalize findings.
  • Oral historians and qualitative investigators may want to create archives for the purpose of providing a resource for others to do research. Since the intent of the archive is to create a repository of information for other investigators to conduct human research, the creation of such an archive WOULD constitute research and require IRB review.
    • Example: Open ended interviews are conducted with women basketball players in order to create an archive for future research. The creation of such an archive would constitute human subjects research since the intent is to collect data for future research.

top of page

Protocol Questions

I can't upload documents into the IRB Application! Help!

Use any browser other than Safari: Explorer, Google Chrome, Firefox should work.

Who needs to be listed on the protocol narrative? Do all researchers (including collaborators) need to be listed?

All researchers* engaged in human subject research (including offsite collaborators) must be listed in the protocol narrative of the UCI IRB approved research project if they will:

  • intervene with subjects by performing research procedures, or by manipulating the environment for research purposes;
  • participate in the recruitment and/or selection of subjects;
  • participate in the informed consent process;
  • collect or report subject identifiable data; or
  • have access to subject identifiable study data.

If your research team should change once the project is approved, you must submit a modification to your protocol adding the new investigator(s) or removing those no longer involved.

*Effective September 13, 2018, investigators do not need to include UCI undergraduate research personnel (RP) in the Protocol Narrative unless the research is greater than minimal risk (Full-Committee) or is being conduct outside California. Instead, investigators must maintain a separate log  for all UCI undergraduate students who are engaged in human subject research conducted in California. The log must be updated when UCI undergraduates are removed or added to the research team.  While the log does not need to be submitted to the IRB, it is subject to routine monitoring by the Human Research Protections unit in the Office of Research.  or more information please, review the following documents:

top of page

Do I need to include my research staff or student researchers on the protocol application?

Yes, if the work performed on the research project would allow the staff person or student researcher to have direct contact with subjects and/or access to subject identifiable data in the context of research, then his or her name must be listed on the protocol, except as specified below*.

For staff personnel - if the individual's role on the project is part of his or her regular paid duties (i.e. phlebotomist, x-ray technician) and involvement in the project is limited to performing those duties without contributing to the research endeavor, then such individuals need not be listed as co-investigators or research personnel.

*For minimal risk studies (Exempt or Expedited), do not add UCI undergraduates as research personnel (RP) except when the research will be conducted outside California. All non-UCI undergraduates must be listed on an IRB Application.

top of page

I have submitted my IRB Application. Now what happens?

  • The Lead Researcher and Administrative Contact(s) will receive an e-mail memo assigning a Human Subjects number (i.e., HS #). This takes place usually within 48 hours of electronic submission. Keep this number as all IRB correspondence will reference the study title and HS#.
  • If you have not already done so, please submit the applicable documentation to the Institutional Review Board, Office of Research (OR).  Refer to How to Submit Electonic IRB Applications for Review for specific details on what documents must be submitted.
  • Upon receipt of the required documentation, an administrative review will be conducted to ensure that all the necessary information is provided. If the application is in order it is assigned to an IRB Committee for review. If the application is incomplete (e.g., consent form or survey missing) the Lead Researcher and Administrative Contact (also Faculty Sponsor, if applicable) will receive an e-mail explaining how to correct the deficiency.
  • Exempt and Expedited applications are reviewed by a subcommittee of IRB members. There are no submission deadlines for Exempt and Expedited e-IRB Applications. Exempt/Expedited reviews occur on a rolling basis.  IRB review typically occurs within 4-6 weeks of receipt of all required documentation.
  • Full Committee applications are reviewed monthly. UCI has two biomedical IRBs and one Social/Behavioral IRB. See ORA Calendar and Deadlines for full Committee meeting dates and deadlines.
  • The IRB will reviews the application and determine one of four actions:
    • A - Approval
    • M - Minor changes required
    • T - Tabled for re-review. The application requires significant clarifications and revisions
    • D - Disapproval
  • For applications that receive a Committee determination of A - Approval, the Approval/Registration letter and stamped approved documents are sent to the Lead Researcher within 3-5 working days. Research studies should not begin until stamped approval documents are received.
  • For applications that receive a Committee determination of M - Minor Changes or T - Tabled for Re-Review: the Lead Researcher, Administrative Contact, and Faculty Sponsor, when applicable, receive detailed comments from the IRB via e-mail within 10 working days. Research studies must not begin until stamped approval documents are received.
  • For applications that receive a Committee determination of D - Disapproval, the Lead Researcher, Administrative Contact, and Faculty Sponsor, when applicable, receive detailed comments from the IRB via e-mail within 10 working days. Please note that only the full Committee can disapprove a protocol and disapprovals are rare.

top of page

What is the fastest way to find out what happened to my study at an IRB meeting?

Full Committee meeting results are posted to the web by 3 pm, the afternoon of each meeting. To get access to these same-day results for your submissions:

Note: This will provide you with the status of your protocol only. If your protocol is approved, approval documents will be sent to the Lead Researcher within five working days. If your protocol was not approved, detailed committee feedback will be sent directly to the Lead Researcher within 10 working days of the meeting at which the protocol was reviewed.

Exempt and Expedited protocols are reviewed by a subcommittee of IRB members and the results are not posted to the web. Check with the Research Protection staff for protocol status.

top of page

Can I share my IRB protocol approval with colleagues working on similar projects?

No. The IRB approves protocols with the understanding that the work will be conducted only by the investigators named in the protocol application. If your colleagues would like to work on your research project, you may modify your existing protocol to add them as co-investigators. Otherwise, they must apply for their own IRB protocol approvals. For more information on how to modify an approved protocol, visit Modifications to the Protocol.

top of page

How do I submit changes to a currently approved protocol?

To request approval of a proposed modification, complete and submit the electronic Modification request.

Upload two versions of all revised documents (i.e. protocol narrative, consent/assent forms, recruitment letters or ads, questionnaires, etc.) one version with the changes highlighted, one version without highlights. In addition include any new documents added as a result of the proposed change (Sponsor Amendment, questionnaires, etc.)

top of page

How are changes to an approved protocol reviewed?

Changes to an approved protocol are submitted to the IRB via an electronic Modification Request (MOD). Changes are categorized as either minor or significant. Minor changes do not significantly affect the risks and benefits assessment of the study and do not substantially change the specific aims or design of the study. Any change not considered a "minor" change is considered a "significant" change. Minor changes may include personnel changes, changes to recruitment materials, addition of non-sensitive questions to interview or survey format, addition of a new recruitment site. Minor changes qualify for expedited reviewed while significant changes require review by the full Committee.

top of page

What is Seven-Year De Novo Continuing Review?

Every 6th year of protocol approval will require submission of updated protocol documentation along with the electronic Continuing Protocol Application. This requirement went into effect February 1, 2010.  Effective Fall 2016, Seven-Year De Novo applies to both Biomedical and Social Behavioral Research involving greater than minimal risk. This includes submission of the following:

  • Updating the protocol narrative to the most current version of the protocol narrative available at the IRB Forms page; and
  • Ensuring that the consent form or study information sheet meets the most current consent/study information sheet requirements. The consent templates are available at the IRB Forms page and requirements are available at the Informed Consent Preparation web page.
  • Submitting all documentation for the protocol review such as any data collection instruments, recruitment, stimuli, etc. This includes re-submission of any applicable IRB appendices. The appendices are available for downloading under IRB Forms. Please review all the forms and submit any that are applicable. Even if the appendix was not available when the study was originally reviewed, it may still apply.

During the Committee’s Seven-Year De Novo review(s), the Committee will require that all documents be incorporated into the CURRENT UCI templates. This may involve disclosing new information that has not been previously requested and therefore, not previously reviewed by the Committee. As with any review, studies are subject to meet all current regulatory requirements, UC/ UCI policies and procedures. Lead Researchers should not assume that at a Seven-Year De Novo continuing review, nor a standard continuing review, will receive automatic approval. Accordingly, Lead Researchers are asked to follow the submission timeline guidelines for Seven-Year De Novo reviews, as well as standard continuing reviews, to help avoid a lapse in IRB approval.

Exceptions to the Seven-Year De Novo Review Requirement

There are three types of protocols do not require Seven-Year De Novo Review:

  1. Continuing review of research where:
    • the research is permanently closed to the enrollment of new subjects;
    • all subjects have completed all research-related interventions; and
    • the research remains active only for long-term follow-up of subjects; or
  2. Continuing review of research where the remaining research activities are limited to data analysis.
  3. Protocols that involve no greater than minimal risk to human subjects (e.g., expedited, exempt).
top of page

When should I submit a closing report to the IRB?

A study may be closed when all of the following apply:

  • All subject recruitment and enrollment is complete (i.e., no new subject recruitment or enrollment are ongoing)
  • All subject specimens, records, data have been obtained (i.e., no further collection of data/information from or about living individuals will be obtained)
  • No further contact with subjects is necessary (i.e., all interactions or interventions are complete and no further contact with enrolled subjects is necessary)
  • Analysis of subject identifiable data, records, specimens are complete (i.e., use or access to subject identifiable data is no longer necessary. Note: this includes review of source documents by study sponsors).

top of page

Informed Consent Questions

Who needs to be listed on the informed consent document?

Only those individuals who will be involved in the informed consent process are to be listed on the consent form. Individuals who obtain informed consent must be appropriately qualified through their education, training or experience to obtain the legally-effective informed consent from a subject. See the Informed Consent Process for more information.

top of page

Who can consent on behalf of a subject for participation in a research study?

If an adult is unable to consent on his/her own behalf due to cognitive or medical incapacity, federal regulations permit researchers to obtain consent from a legally-authorized representative. CA Health & Safety Code 24178 defines the categories of individuals who are legally authorized in California to provide surrogate consent for research. For more information see Obtaining Surrogate Consent. In order for a researcher to have the option to obtain consent from a subject's legally-authorized representative, the IRB must specifically approve the use of surrogate consent for a given protocol. If there is no legally-authorized representative, and the adult patient cannot consent, the individual may not become a human subject. A minor is unable to consent on his/her own behalf. A parent or legal guardian usually provides permission for the minor to participate in research. The assent of the minor is typically obtained.

top of page

Is an English consent document okay to use when enrolling non-English-speaking subjects?

No. Study subjects are given a copy of the consent to be used as a reference document to reinforce their understanding of the study and, if desired, to consult with their physician or family members about the study.

In order to meet the requirements of federal regulations, the consent document must be presented in language understandable to the subject. When the prospective subject is fluent in English, the consent document and process should be conducted in English.

However, when it is anticipated that many of the study subjects will be non-English-speaking people, and it is anticipated that the consent process will likely be conducted in a language other than English, the LR should submit a certified, translated consent form for IRB review after approval of the English version.

A copy of the translated consent document must be given to each appropriate subject. While a translator may be used to facilitate conversation with the subject, ad hoc translation of the consent document cannot substitute for a written translation. See Non-English Speaking Participants for more information.

top of page

Who must sign the consent form?

Federal regulations require that the written consent form approved by the IRB be signed and dated by the subject or the subject's legally authorized representative (if approved by the IRB) at the time of consent. A copy should be given to the person signing the form.

It is the IRB's expectation that the person obtaining consent (the Lead Researcher, or another individual listed on the consent form), will also sign and date the form, attesting to the informed consent conversation. The LR should sign the form only if he or she was present for the consent process. In addition for clinical research, a witness to the informed consent conversation must also sign and date the consent form. See the Informed Consent Process and Non-English Speaking Participants for more information.

top of page

Is informed consent required even if the data/specimens will be collected from my friends and colleagues?

Yes. All research involving interaction with human subjects (including collection of specimens) requires informed consent regardless of who the subjects are. In some cases, written informed consent may be waived. Also, special rules apply to recruiting students and staff from within one's own department. See Vulnerable Subject Populations for more information.

top of page

Can I have my research coordinator or clinic manager respond to requests from the IRB on my behalf?

No. Federal regulations require that the IRB must communicate directly with the Lead Researcher regarding protocol-related issues. Accordingly, all correspondence to the IRB must be submitted with the Lead Researcher's signature.

The Lead Researcher has overall responsibility for the conduct of the research study, which includes responsibility for the submission of protocols and other correspondence to the IRB. The IRB may return any protocol-related correspondence that is received without evidence of the Lead Researcher's approval.

top of page

Tutorial Questions

I need to complete HRP CITI and HIPAA Training.  What are the next steps?

No CITI Account/ Have a UCInetID: If you do not already have an account at Collaborative Institutional Training Initiative (CITI), you would first need to set one up.  UCI students, staff, faculty and research personnel will be able to log in to the Collaborative Institutional Training Initiative (CITI) website using their UCINetID and password. When setting up your account, it is important that you use your UCI email as your primary on this account because that is the only way our database can receive updates regarding your training.For additional infromation on the registration process please follow these step-by-step instructions.

No CITI Account/ No UCInetID:  For new researchers without a UCINetID, please follow these step-by-step instructions. In addition, if you are working with a colleague outside of UCI who needs UCInetID access, you may be able to sponsor your colleague for a temporary UCInetID. Only UCI faculty or management-level staff members or their designees may sponsor someone.

Have a CITI Account: If you already have a CITI account from another Institution, your prior courses may be eligible for transfer, log on to the CITI site and add UCI as an affiliate institution. CITI will review the modules you previously completed and the date(s) on which you took them. CITI will ask you to complete any modules required by UCI that were not required by your previous institution and/or modules that are no longer eligible to be transferred. You should also ensure that your profile for UCI includes your UCI email address as the IRB database links to CITI through an individual's UCInetID or his/her UCI email address. For additional information, please follow these step-by-step instructions.

CITI Coursework:  UCI offers two versions of the Basic Human Research Training course: one for Biomedical Investigators (which includes HIPAA) and one for Social & Behavioral Investigators (with an optional HIPAA module).  Individuals choose the course that best matches their research activities / and role. A CITI Refresher course is required every 5 years to ensure ongoing education about human research protections. There are also two versions of the refresher course. The Basic and Refresher Courses require approximately two hours to complete. The modules may be completed over multiple sessions. You must complete a module and the related quiz before you log out of a session. If you do not complete the module, you will be required to take it again.  The minimum "passing" aggregate score is 80%.  A passing score is based on the whole course, and not on the individual modules within a course.  When your Grade Book gives you an option to print a "Completion Report," it means you passed the course. A running tally is compiled in the Grade Book. If you want to improve a score on a quiz, you may repeat the module and the quiz.  You can print or download a Course Completion Report as evidence of completion. You can view or print your completion reports any time by logging into CITI.

For more information on required tutorials, see the Electronic Tutorials webpage. Also, to determine whether your research involves PHI, please see the PHI (HIPAA) webpage.

I've forgotten my UCINetID password. How can I find out what it is?

UCINetID passwords are not known to anyone but you. If you've forgotten your password for your UCInetID, you need to have Office of Information Technology (OIT) reset your password and re-activate your UCInetID. See the OIT website for information and instructions.

top of page

How can I find out which tutorials I've taken? How can I verify my study team has completed the required tutorials?

There is a tutorial verification page on the ORA website. Anyone can verify whether a person performing research has taken any of the electronic research tutorials for credit. To verify the completion of a tutorial for credit, go to Tutorial Verification and enter a first name, last name or both. The resulting page can be provided to the Office of Research or others who require verification of tutorial completion.

top of page

I get the following message when I try logging on the tutorial: "Your Browser is not configured to accept Cookies." How do I fix this problem?

You need to reconfigure your browser setting to allow cookies. If you use Internet Explorer go to: Tools--Internet Options-Privacy--Advanced Privacy Settings. If you need more help with how to enable cookies, please check in with the computer support person in your department.

top of page
suggestions and comments