IRB Frequently Asked Questions

Questions About Obtaining IRB Approval

We cannot make an official determination of whether a study requires IRB approval via email or over the phone.

Step 1: Use the Non-Human Subject Research Determination form on KRP to determine if IRB review is required. See Definition of Human Subjects Research for more information.

Step 2: Use the Exempt Self-Determination form on KRP to determine if IRB review is required. See Exempt Self-Determination for more information.

Any systematic investigation (including pilot studies, program evaluations, qualitative research), that is designed to develop or contribute to generalizable (scholarly) knowledge, and which uses living humans or identifiable private information about living humans qualifies as human subjects research. See Definition of Human Subjects Research for more information.


Projects that use an existing data set which includes identifiable data gathered in earlier research projects may require a new IRB protocol for review. Secondary analysis of existing data may include the review of medical records, student records, data collected from previous studies, audio/video recordings, etc. that were initially collected for another purpose. In order to be existing, the information must be "on the shelf" (i.e., it has already been collected) at the time that the current research is proposed.

Though such projects do not involve interactions or interventions with humans, they may still require IRB review, since the definition of "human subject" at 45 CFR 46.102(f) includes living individuals about whom an investigator obtains identifiable private information for research purposes.

In addition to being identifiable, the existing data must include "private information" in order to constitute research involving human subjects. Private information is defined as information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (e.g., a medical or school record). Information that contains identifiers and can be accessed freely by the public (without special permission or application) is not "private" and the research therefore does not therefore involve human subjects. For example, a study involving only analysis of the published salaries and benefits of public university presidents would not need IRB review since this information is not private.

Data analysis activities that meet the definition of research with human subjects may qualify for an exemption or require expedited or even full committee review. Any such project must receive IRB approval or a determination of exemption before the investigator accesses the data.

When does the secondary use of existing data not require review?
In general, the secondary analysis of existing data does not require IRB review when it does not fall within the regulatory definition of research involving human subjects, as referenced above.

Note: Although the definition of a human subject includes only living individuals, thereby excluding decedents, there are cases in which the health information of the deceased and death data files may require IRB review. For additional information and clarification on what constitutes human subject research, refer to Activities that Require IRB Review.

Public data: Public use data sets (such as portions of U.S. Census data, data from the National Center for Educational Statistics, National Center for Health Statistics, etc.) are data sets prepared with the intent of making them available for the public. The data available to the public are not individually identifiable and therefore their analysis would not involve homan subjects.

De-identified data: If the dataset has been stripped of all identifying information and there is no way that it could be linked back to the subjects from whom it was originally collected (through a key to a coding system or by any other means), its subsequent use by the lead researcher or another investigator would not constitute human subjects research, since it is no longer identifiable. Identifiable means the identity of the subject is known or may be readily ascertained by the investigator or associated with the information. In general, information is considered to be identifiable when it can be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems, or when characteristics of the information obtained are such that by their nature a reasonably knowledgeable person could ascertain the identities of individuals. Therefore, even though a dataset may have been stripped of direct identifiers (names, addresses, student ID numbers, etc.), it may still be possible to identify an individual through a combination of other characteristics (e.g., age, gender, ethnicity, and place of employment).

Example: Many student research projects involve secondary analysis of data that belongs to, or was collected by, their faculty advisor or another investigator. If the student is provided with a de-identified, non-coded data set, the use of the data does not constitute research with human subjects because there is no interaction with any individual and no identifiable private information will be used. The project does not therefore require IRB review.

Coded data: Secondary analysis of coded private information is not considered to be research involving human subjects and would not require IRB review if the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information pertains as a result of one of the following circumstances:

  1. The investigators and the holder of the key have entered into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (DHHS regulations for humans subjects research do not require the IRB to review and approve this agreement);
  2. There are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigator under any circumstances, until the individuals are deceased; or
  3. There are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.

Note: If a student is analyzing coded data from a faculty advisor/sponsor who retains a key, this would be human subjects research, because the faculty sponsor is considered an investigator on the student's protocol, and can readily ascertain the identity of the subjects since he/she holds the key to the coded data. If the student's work fits within the scope of the initial protocol from which the dataset originates, the faculty sponsor (or investigator who holds the dataset) may wish to consider adding the student and his/her work to the original protocol by means of a modification request rather than having the student submit a new application for review.

Example: Researcher A plans to examine the relationships between attention deficit hyperactivity disorder (ADHD), oppositional defiance disorder, and teen drug abuse using data collected by Agencies I, II, and III that work with "at risk" youth. The data will be coded and the agencies have entered into an agreement prohibiting release of the key to the researcher that could connect the data with identifiers. The use of the data would not constitute research with human subjects and does not require IRB review.

When is the secondary use of existing data non-exempt? If secondary analysis of existing data does involve research with human subjects and does not qualify for exempt status, the project must be reviewed either through expedited procedures or by the full committee. Again, an IRB Application must be submitted.

Consent: Researchers using data previously collected under another study should consider whether the currently proposed research is a "compatible use" with what subjects agreed to in the original consent form. For non-exempt projects, a consent process description or justification for a waiver must be included in the research protocol. The UCI IRB may require that informed consent for secondary analysis is obtained from subjects whose data will be accessed.

"Restricted Use Data": Certain agencies and research organizations release files to researchers with specific restrictions regarding their use and storage. The records frequently contain identifiers or extensive variables that combined might enable identification, even though this is not the intent of the researcher. Research using these data sets most often requires expedited or full committee review.

For an explanation of the different categories of human subjects research, see Levels of Review.

As part of the 2018 Common Rule, the Office for Human Research Protections has offically called out oral history projects as not meeting the definition of research.  The revised Common Rule at 45 CFR 46.102 states the following regarding the definition of "research":

(l) Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities. For purposes of this part, the following activities are deemed not to be research:

(1) Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.

(2) Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).

(3) Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.

(4) Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.

Kuali Research Protocols (KRP) is UCI's IRB, sIRB and hSCRO submission and management system.

All transactions for the IRB must be submitted in KRP. For help navigating KRP, review the KRP User Guide.





  • Exempt and Expedited applications are reviewed by a subcommittee of IRB members. There are no submission deadlines for Exempt and Expedited research. Exempt/Expedited reviews occur on a rolling basis.  IRB review typically occurs within 4-6 weeks of receipt of all required documentation.
  • Full Committee applications are reviewed monthly. UCI has two biomedical IRBs and one Social/Behavioral IRB. See HRP Calendar and Deadlines for full Committee meeting dates and deadlines.

IRB Review & Determination:

The results of the IRB review can be found once logged into the protocol in KRP. Refer to either ‘Administrative Details’ or ‘Admin Notes & Files’. 

Full Committee meeting results are posted by 3 pm, the afternoon of the meeting.

The IRB reviews the application and make a determination:

  • A - Approval. The approval letter and stamped approved documents are available in KRP within 3-5 working days. Research studies should not begin until stamped approval documents are released.
  • M - Minor changes required. IRB comment are available in KRP within 10 working days.
  • T - Tabled for re-review. The application requires significant clarifications and revisions. IRB comment are available in KRP within 10 working days.

Protocol Questions

As illustrated by the below Research Personnel Heat Map, only Research Personnel involved in the below activities (illustrated in orange) should be listed in the IRB Application and Protocol Narrative. All other Research Personnel should be tracked in the Study Team Tracking Log. (Note: For more information on IRB COI disclosure requirements, click here).

Role of Research Personnel Minimal Risk Protocol Greater Than Minimal Risk Protocol
Access to subject identifiable data including Protected Health Information (PHI) for screening/ determining eligibility

List only the LR and Co-Researcher(s) in the Study Team section in KRP. The LR is required to maintain a Study Team log or something similar to track Research Personnel independently.

Recruiting subjects directly via phone, email or in person
Access to subject identifiable data which may include
PHI for data collection purposes
Involvement in the informed consent process
(i.e., explaining the study to prospective subject)
Performing research procedures that involve greater than minimal risk  

List the LR, Co-Researcher(s) and Research Personnel in the Study Team section in KRP.

Involvement in the interpretation of study data
Finalization of the informed consent process
(i.e., able to sign off as the individual obtaining consent)
Has a disclosable financial conflict of interest

No. The IRB approves protocols with the understanding that the work will be conducted only by the investigators named in the protocol application. If your colleagues would like to work on your research project, you may modify your existing protocol to add them as co-investigators. Otherwise, they must apply for their own IRB protocol approvals. For more information on how to modify an approved protocol, visit Modifications to the Protocol.

Informed Consent Questions

Only those individuals who will be involved in the informed consent process are to be listed on the consent form. Individuals who obtain informed consent must be appropriately qualified through their education, training or experience to obtain the legally-effective informed consent from a subject. See the Informed Consent Process for more information.

If an adult is unable to consent on his/her own behalf due to cognitive or medical incapacity, federal regulations permit researchers to obtain consent from a legally-authorized representative. CA Health & Safety Code 24178 defines the categories of individuals who are legally authorized in California to provide surrogate consent for research. For more information see Obtaining Surrogate Consent. In order for a researcher to have the option to obtain consent from a subject's legally-authorized representative, the IRB must specifically approve the use of surrogate consent for a given protocol. If there is no legally-authorized representative, and the adult patient cannot consent, the individual may not become a human subject. A minor is unable to consent on his/her own behalf. A parent or legal guardian usually provides permission for the minor to participate in research. The assent of the minor is typically obtained.

No. Study subjects are given a copy of the consent to be used as a reference document to reinforce their understanding of the study and, if desired, to consult with their physician or family members about the study.

In order to meet the requirements of federal regulations, the consent document must be presented in language understandable to the subject. When the prospective subject is fluent in English, the consent document and process should be conducted in English.

However, when it is anticipated that many of the study subjects will be non-English-speaking people, and it is anticipated that the consent process will likely be conducted in a language other than English, the LR should submit a certified, translated consent form for IRB review after approval of the English version.

A copy of the translated consent document must be given to each appropriate subject. While a translator may be used to facilitate conversation with the subject, ad hoc translation of the consent document cannot substitute for a written translation. See Non-English Speaking Participants for more information.

Federal regulations require that the written consent form approved by the IRB be signed and dated by the subject or the subject's legally authorized representative (if approved by the IRB) at the time of consent. A copy should be given to the person signing the form.

It is the IRB's expectation that the person obtaining consent (the Lead Researcher, or another individual listed on the consent form), will also sign and date the form, attesting to the informed consent conversation. The LR should sign the form only if he or she was present for the consent process. In addition for clinical research, a witness to the informed consent conversation must also sign and date the consent form. See the Informed Consent Process and Non-English Speaking Participants for more information.

Yes. All research involving interaction with human subjects (including collection of specimens) requires informed consent regardless of who the subjects are. In some cases, written informed consent may be waived. Also, special rules apply to recruiting students and staff from within one's own department. See Vulnerable Subject Populations for more information.

No. Federal regulations require that the IRB must communicate directly with the Lead Researcher regarding protocol-related issues. Accordingly, all correspondence to the IRB must be submitted with the Lead Researcher's signature.

The Lead Researcher has overall responsibility for the conduct of the research study, which includes responsibility for the submission of protocols and other correspondence to the IRB. The IRB may return any protocol-related correspondence that is received without evidence of the Lead Researcher's approval.

Prisoners in Research (Guidance from OHRP)

No, subpart C applies whenever any human subject in a research protocol becomes a prisoner at any time during the study.

The investigator should report this situation to the IRB immediately.

When a previously enrolled research subject becomes a prisoner and the relevant research protocol
was NOT reviewed and approved by the institutional review board (IRB) in accordance with the
requirements of subpart C, the principal investigator should promptly notify the IRB of this event. All
research interactions and interventions with, and obtaining identifiable private information about, the
now-incarcerated prisoner-subject must cease until the requirements of subpart C have been satisfied
with respect to the relevant protocol.

NOTE: OHRP has allowed one important exception. In special circumstances in which the principal
investigator asserts that it is in the best interests of the subject to remain in the research study while
incarcerated, the IRB Chairperson may determine that the subject may continue to participate in the
research until the requirements of subpart C are satisfied.

Upon receipt of notification that a previously enrolled research subject has become a prisoner, the IRB
should promptly re-review the protocol in accordance with the requirements of subpart C if the
principal investigator wishes to have the prisoner subject continue to participate in the research.

It is important that the IRB remind the principal investigator that, except in the special circumstances
noted above, all research interactions and interventions with, and obtaining identifiable private
information about, the now-incarcerated prisoner-subject must cease until all of the requirements of
subpart C have been satisfied with respect to the relevant protocol.

Yes. In addition to subpart C, most likely subpart D (Protections for Children) would also apply.

Yes, however, OHRP recommends that the convened IRB review research involving prisoners as human subjects.

The exemptions at 45 CFR 46.101(b) do not apply to research involving prisoners. See 45 CFR
46.101(i), footnote 1.

CITI Training Questions

If you do not already have an account at Collaborative Institutional Training Initiative (CITI), you would first need to set one up.  UCI students, staff, faculty and research personnel will be able to log in to the Collaborative Institutional Training Initiative (CITI) website using their UCINetID and password. When setting up your account, it is important that you use your UCI email as your primary on this account because that is the only way our database can receive updates regarding your training. For additional information on the registration process, please follow these step-by-step instructions.

If you already have a CITI account from another Institution, your prior courses may be eligible for transfer, log on to the CITI site and add UCI as an affiliate institution. CITI will review the modules you previously completed and the date(s) on which you took them. CITI will ask you to complete any modules required by UCI that were not required by your previous institution and/or modules that are no longer eligible to be transferred. You should also ensure that your profile for UCI includes your UCI email address as the IRB database links to CITI through an individual's UCInetID or his/her UCI email address. For additional information, please follow these step-by-step instructions.

If you are working with a colleague outside of UCI who needs UCInetID access, you may be able to sponsor your colleague for a temporary UCInetID. Only UCI faculty or management-level staff members or their designees may sponsor someone.

If you're new to UCI, to activate your UCInetID, you'll need an ID number first. New employees will get their ID number from their department's payroll coordinator, student applicants will be sent their ID number when they first apply to UCI, and sponsored guests will receive their ID number from their sponsor.

UCI offers two versions of the Basic Human Research Training course: one for Biomedical Investigators (which includes HIPAA) and one for Social & Behavioral Investigators (with an optional HIPAA module).  Individuals choose the course that best matches their research activities / and role.

A CITI Refresher course is required every 5 years to ensure ongoing education about human research protections. There are also two versions of the refresher course.

The Basic and Refresher Courses require approximately two hours to complete. The modules may be completed over multiple sessions. You must complete a module and the related quiz before you log out of a session. If you do not complete the module, you will be required to take it again. 

The minimum "passing" aggregate score is 80%.  A passing score is based on the whole course, and not on the individual modules within a course.  When your Grade Book gives you an option to print a "Completion Report," it means you passed the course. A running tally is compiled in the Grade Book. If you want to improve a score on a quiz, you may repeat the module and the quiz.  You can print or download a Course Completion Report as evidence of completion. You can view or print your completion reports any time by logging into CITI.

For more information on required tutorials, see the Electronic Tutorials webpage. Also, to determine whether your research involves PHI, please see the PHI (HIPAA) webpage.

UCI Researchers:

  • If your CITI profile is accurate, your course completion is sent to UCI via a nightly data transfer. You will need to wait for the next day after course completion to add yourself to a UCI Web-application.
  • Your CITI profile must:

            1) Reflect your UCI Email as the primary email AND

            2) Affiliate with UCI.

Non-UCI Researchers:

  • You must upload a copy of the Course Completion Report with the UCI Web-application.

There is a tutorial verification page on the ORA website. Anyone can verify whether a person performing research has taken any of the electronic research tutorials for credit. To verify the completion of a tutorial for credit, go to Tutorial Verification and enter a first name, last name or both. The resulting page can be provided to the Office of Research or others who require verification of tutorial completion.

If you fail to complete the required CITI HRP Refresher course you will receive an expiration notice. Failure to complete the required CITI training course will delay approval of IRB submissions and could jeopardize an individual's ability to engage in human subjects research.

This training may be valid at UCI, depending on a number of factors such as how long ago the module was completed and the specific modules completed. Please see the CITI Support Center for more information.

Your prior courses may be eligible for transfer, log on to the CITI site and add UCI as an affiliate institution. CITI will review the modules you previously completed and the date(s) on which you took them. CITI will ask you to complete any modules required by UCI that were not required by your previous institution and/or modules that are no longer eligible to be transferred. You should also ensure that your profile for UCI includes your UCI email address as HPS links to CITI through an individual's UCInetID or his/her UCI email address.

UCINetID passwords are not known to anyone but you. If you've forgotten your password for your UCInetID, you need to have Office of Information Technology (OIT) reset your password and re-activate your UCInetID. See the OIT website for information and instructions.

Post IRB Approval Questions

To request approval of a proposed modification, complete and submit an Amendment.

Upload one version of all revised documents (i.e. consent/assent forms, recruitment letters or ads, questionnaires, etc.). In addition include any new documents added as a result of the proposed change (Sponsor Amendment, questionnaires, etc.)

Every 6th year of protocol approval will require submission of updated protocol documentation along with the Renewal.

There are three types of protocols do not require De Novo Review:

  1. Protocols that involve no greater than minimal risk to human subjects (e.g., expedited, exempt).
  2. Continuing review of research where:
    • the research is permanently closed to the enrollment of new subjects;
    • all subjects have completed all research-related interventions; and
    • the research remains active only for long-term follow-up of subjects; or
  3. Continuing review of research where the remaining research activities are limited to data analysis.

A De Novo Renewal includes submission of the following:

  • Updating the protocol to the most current version of the protocol; and
  • Ensuring that the consent document is updated to the CURRENT UCI templates. The consent templates are available at the IRB Forms page and requirements are available at the Informed Consent Preparation web page.
  • Submitting all documentation for the protocol review such as any data collection instruments, recruitment, stimuli, etc.

As with any review, studies are subject to meet all current regulatory requirements, UC/ UCI policies and procedures. Lead Researchers should not assume that at a Seven-Year De Novo continuing review, nor a standard continuing review, will receive automatic approval.

A study may be closed when all of the following apply:

  • All subject recruitment and enrollment is complete (i.e., no new subject recruitment or enrollment are ongoing)
  • All subject specimens, records, data have been obtained (i.e., no further collection of data/information from or about living individuals will be obtained)
  • No further contact with subjects is necessary (i.e., all interactions or interventions are complete and no further contact with enrolled subjects is necessary)
  • Analysis of subject identifiable data, records, specimens are complete (i.e., use or access to subject identifiable data is no longer necessary. Note: this includes review of source documents by study sponsors).