IRB Help

IRB and Human Subjects Definitions

Adverse Events: any undesirable and unintended effect, whether anticipated or not, experienced by a research subject occurring as a result of participating in a research project. Adverse events may be anticipated or unanticipated, be related or unrelated to the research, occur at a frequency greater than expected, and/or be serious in nature. Examples of adverse events include:

• Breaches in confidentiality (including loss of or infiltration of identifiable data)
• Physical, social, psychological, financial (employability), or legal harms
• Subject complaints indicating an undesirable or unintended effect
• Investigator findings indicating an undesirable or unintended effect
• Subject complaints that cannot be resolved by investigators
• Any finding that increases overall risk profile
• An unexpected risk or discomfort that has not been previously observed

Anonymous: unidentified (i.e., personally identifiable information was not collected, or if collected, identifiers were not retained and cannot be retrieved); information or materials (e.g., data or specimens) that cannot be linked directly or indirectly by anyone to their source(s). A study is not considered anonymous if their identity can be ascertained, even if not linked to data. 

Anticipated: any adverse event that is previously identified in the IRB approved protocol and not occurring at a rate higher than expected.

Approval Date: the date research is approved and can initiate. This date is stated in the IRB approval email. Human subjects research may not proceed until it is approved. 

Approval Term: the period for which the human subjects portions of a study are approved. Approval terms are defined in the initial approval and continuing approval emails.  

Assent: a subject's affirmative agreement to participate in research. Mere failure to object should not, absent affirmative agreement, be construed as assent. Assent is most typically associated with children or individuals with decisional impairments. 

Authorization: signed permission to allow a covered entity to use or disclose protected health information. (see also HIPAA) 

Business Associate: a person or entity who, on behalf of a covered entity, performs or assists in performance of a function or activity involving the use or disclosure of individually identifiable health information. (See also HIPAA)

Children/Child: person(s) who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted. 

Clinical investigation: means any experiment that involves a test article and one or more human subjects and that either is subject to requirements for prior submission to the Food and Drug Administration under section 505(i) or 520(g) of the act, or is not subject to requirements for prior submission to the Food and Drug Administration under these sections of the act, but the results of which are intended to be submitted later to, or held for inspection by, the Food and Drug Administration as part of an application for a research or marketing permit. The term does not include experiments that are subject to the provisions of part 58 of this chapter, regarding nonclinical laboratory studies.

Clinical Trial: per NIH, a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of those interventions on health-related biomedical or behavioral outcomes.

Clinical Research: is research that typically focuses on the treatment, prevention, or diagnosis of medical condition(s). (https://www.fda.gov/patients/clinical-trials-what-patients-need-know/what-are-different-types-clinical-research). 

Coded: direct personal identifiers have been removed (e.g., from data or specimens) and replaced with words, letters, figures, symbols, or a combination of these for purposes of protecting the identity of the source, but the original identifiers are retained in such a way that they can still be traced back to the source. Note: Sometimes also referred to as a “key” “link”, or “map”. 

Coercion: persuasion to do or agree to something by using obvious or implied force or threats.

Confidentiality: maintaining subject identities in a manner that prevents inadvertent or inappropriate disclosure of participants’ identity or participation in the study even if it cannot be linked to data.

Conflict of Interest: this occurs when the relationship between an individual's private interests and his or her professional obligations to the university is such that an independent observer might reasonably question whether the individual's professional actions or decisions are determined by considerations of personal gain, financial or otherwise. An "actual" conflict of interest depends on the situation and not on the character or actions of the individual.  (see Policy Register 10-04.1 for a more detailed description)

Consent: the consent process involves three key features: (1) disclosing to potential research subjects information needed to make an informed decision; (2) facilitating the understanding of what has been disclosed; and (3) promoting the voluntariness of the decision about whether or not to participate in the research. Informed consent must be legally effective and prospectively obtained. HHS regulations at 45 CFR 46.116 and 45 CFR 46.117 describe the informed consent requirements.

Continuing Noncompliance: is multiple or repeated instances of non-compliant activity, which may involve concerns that have or have not been previously reported to the IRB. 

Covered Entity: a health plan, a health care clearinghouse, or a health care provider who transmits health information in electronic form in connection with a transaction for which HHS has adopted a standard. Covered entities can be institutions, organizations, or persons. (see also HIPAA)

Data and Safety Monitoring:  the process for reviewing data collected as research progresses to ensure the continued safety of current and future participants as well as the scientific validity and integrity of the research.

• Data and Safety Monitoring Board (DSMB) or Committee (DSMC):  A group comprised of expert(s) in the field of medicine and/or science applicable to the research, statistician(s), lay representative(s), and others as necessary to monitor study progress.  A data and safety monitoring board reviews study-specific data periodically throughout the research to ensure continued participant safety and scientific validity and to make recommendations whether to continue, modify, or terminate the study.  Note: The following terms are interchangeable – data and safety monitoring board, data and safety monitoring committee, and data monitoring committee.
• Data and Safety Monitoring Plan:  The plan for reviewing research data to ensure the safety of participants and scientific validity of the research, including who will perform the monitoring, the type and frequency of review, and procedures for notifying appropriate entities (e.g., investigators, sponsor, etc.) of the results.  Note: Monitoring performed by a data and safety monitoring board is one type of data and safety monitoring plan.

Data Use Agreement: a contractual document used for the transfer of non-public or restricted use data. 

Debriefing: information about the research that is provided to participants after study completion. A debriefing session is used to provide important information about the nature of the research, additional information for educational purposes, or additional resources that may be appropriate for, or useful to, participants. Debriefing is often required when the research involves deception or incomplete disclosure. In general, this type of debriefing explains any deception or incomplete disclosure, provides information about why it was necessary to use deception or incomplete disclosure to conduct the research, and provides other options available to participants (e.g., the ability to withdraw their data).

Deception: a procedure in which investigators deliberately mislead participants during research by withholding information or providing false information.  As a result, participants are not fully informed about the research when they consent to participate.  

De-identified: all direct personal identifiers are permanently removed from the data, no code or key exists to link the data to the original source or to the individual, and the remaining information cannot be used to reasonably identify the individual. Please refer to the IRB Policy on PHI for information on de-identification under the HIPAA laws.

Decisional Impairments: relates to individuals that may lack the ability to provide valid informed consent to participate in research; sometimes as a result of trauma, mental health concerns, dementia, or cognitive impairment. Impairments may temporary, permanent, progressive, or fluctuating during the research.    

Disapproved: an IRB action taken when the determinations required for approval of research cannot be made. Research can only be disapproved through a full board process. 

Disclosure: the release, transfer, access to, or divulging of information in any other manner outside the entity holding the information. (see also HIPAA)

Effective Dose: a measure used to estimate the risk resulting from an exposure of ionizing radiation, calculated as a weighted average of exposure to different body tissues.  The effective dose is measured in rems or sieverts.

Engaged: an institution or individual is considered engaged in research when its employees or agents for the purposes of the research project obtain: (1) data about the subjects of the research through intervention or interaction with them; (2) identifiable private information about the subjects of the research; or (3) the informed consent of human subjects for the research. An organization also becomes engaged when it receives a direct federal award to support the research.

Exempt Research: sometimes referred to level I research, is minimal risk research that involves human subjects as defined by federal regulations and university policy.  Note: Investigators performing exempt research must comply with the requirements of the HSPP even when the research is exempt.

Existing: available or “on the shelf” (e.g., data, specimens) at the time the research is submitted for a determination of whether the research is exempt.

Expedited Review: process by which designated IRB members, on behalf of the full IRB, approve a limited class of research activities through reviews conducted outside of the convened IRB meeting.

Expiration Date: the date that the IRB’s approval of research has lapsed, and research can no longer be performed. 

Generalizable Knowledge: information from which one may infer a general conclusion; knowledge brought into general use or that can be applied to a wider or different range of circumstances.  For example, publication and presentation are typical methods used to disseminate research findings, thereby contributing to “generalizable knowledge.” However, not all information that is published or presented represents generalizable knowledge.  Generalizable knowledge is also interpreted to include data intended for general use, regardless of its eventual distribution or acceptance.

Guardian: an individual has been formally appointed as a guardian or legal representative by a court to care for a child, including to consent on behalf of a child to general medical care. Ohio law does not permit grandparents or other family members who are not formally appointed as guardians or legal representatives by a court generally do not have the authority to provide consent on behalf of a child without consent by the child’s parents.

Health Information: any information, whether oral or recorded in any form or medium, that (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. (see also HIPAA)

Health Insurance Portability and Accountability Act (HIPAA, also known as the privacy rule): establishes national standards to protect individual’s medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.  The Rule requires appropriate safeguards to protect the privacy of personal health information and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients’ rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections. 
HIPAA has three components, all of which are enforced by the federal Office for Civil Rights: 

• HIPAA Privacy Rule: protects the privacy of individually identifiable health information
• HIPAA Security Rule: sets standards for the security of electronic protected health information 
• HIPAA Breach Notification Rule: requires covered entities and business associates to provide notification following a breach of unsecured protected health information 

Human Subjects  Protection Program: is a program designed to protect the rights, dignity, welfare, and privacy of human subjects in all research conducted on behalf of KSU. 

Human Subject: 

• DHHS:  a living individual about whom an investigator (whether professional or student) conducting research obtains data through intervention or interaction with the individual or identifiable private information.  
• FDA:  an individual who is or becomes a participant in research, either as a recipient of a test article or as a control.  A subject may be either a healthy human or a patient.  For research that involves medical devices, a human subject also includes an individual on whose specimen an investigational device is used.
• DOD: an activity, for research purposes, where there is an intervention or interaction with a living individual for the primary purpose of obtaining data regarding the effect of the intervention or interaction.  Note: This definition applies only to activities that are considered to be research involving human subjects and does not include activities that meet the exemption criteria at 32 CFR 219 (Common Rule) or research involving the collection or study of existing data, documents, records, or specimens from living individuals.  Research involving a human being as an experimental subject is a subset of research involving human subjects; used only when 10 USC 980 (Limitation on Use of Humans as Experimental Subjects) applies.

Hybrid Entity: a single legal entity that is a covered entity, performs business activities that include both covered and non-covered functions, and designates its health care components as provided in the Privacy Rule. KSU is a hybrid entity. (See also HIPAA)

Indirect Identifier: is more than one data element that can be used to ascertain an individual’s identity.

Individual Investigator Agreement: a written agreement between an organization and a collaborating external investigator who will be engaged in the organization’s non-exempt human subjects research that describes each party’s responsibilities for research conduct and oversight.

Individually Identifiable: the identity of the participant is or may readily be ascertained by the investigator or the investigator’s staff or is associated with the information.   

• Information is individually identifiable under the HIPAA Privacy Rule (45 CFR Part 160) if it contains any one of 18 identifiers as defined by 45CFR160. 

Interaction: communication or interpersonal contact between an investigator and participant.

Intervention: manipulation of the subject’s physical, sensory, social or emotional environment. Also, physical procedure (e.g. venipuncture, exercise) by which data are gathered. Intervention can be defined in many different ways; this definition is non-inclusive. 

Investigator: an individual performing various tasks related to the conduct of human subjects research activities, such as obtaining informed consent from subjects, interacting with subjects, and communicating with the IRB. The IRB does not distinguish be key personnel and Co-investigators. See also Principal Investigator. 

Institutional Review Board (IRB): a body established to ensure that human subjects research is conducted in a way that protects the rights and welfare of subjects. 

Ionizing Radiation: any radiation capable of displacing electrons from atoms or molecules, thereby producing ions.  Examples include alpha, beta, gamma, and X-rays.  High doses of ionizing radiation may produce severe skin or tissue damage.

IRB Authorization Agreement: a written agreement between organizations collaborating in non-exempt human subjects research that describes each organization’s responsibilities for IRB review and oversight of the research.

IRB of Record: the IRB responsible for review of research and for determining that the research meets the regulatory requirements for approval. 

Leftover/Remnant Specimen: remaining portion of a specimen obtained for clinical purposes that is no longer needed for its original purpose and that would otherwise be discarded.

Legally Authorized Representative: legally authorized representative (LAR) means an individual or judicial or other body authorized under applicable law to consent on behalf of a prospective subject to the subject’s participation in the procedure(s) involved in the research. The issue as to who can be a LAR is determined by the laws of the jurisdiction in which the research is conducted (e.g., local or state law). Some states have statutes, regulations, or common law that specifically address consent by someone other than the subject for participation in research. Most states have no law specifically addressing the issue of consent in the research context. In these states, law that addresses who is authorized to give consent on behalf of another person to specific medical procedures or generally to medical treatment may be relevant if the research involves those medical procedures or medical treatment.

Limited Data Set: health information that excludes certain direct identifiers, but may include city, state, and ZIP code; elements of date; and other numbers, characteristics, or codes that cannot be used to identify an individual or the individual’s relatives, employers, or household members. Information that may remain in a limited data set is Dates, City, state, zip code, age. (see also HIPAA) 

Minimal Risk: the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.

Minor Changes: changes to research that in the judgment of the IRB do not affect assessment of the risks and benefits of the study by substantially altering any of the following. Multiple minor changes (requested at one time or multiple individual changes) can be considered a significant change as determined by the IRB. 

Noncompliance: is failure to comply with applicable policies, laws, regulations, protocols, or IRB requirements. Noncompliance may be intentional or unintentional. Noncompliance may be non-serious or serious. Examples of non-compliant activities include:

• Conducting non-exempt research without IRB approval
• Conducting research on an expired or unapproved protocol
• Failure to obtain consent or use of an inadequate consent process
• Inadequate Principal Investigator (PI) oversight of research activities or research personnel
• Initiating changes to non-exempt research without IRB approval unless the change is to eliminate apparent or immediate hazard to subject

Non-Scientist:  an individual appointed to the IRB who (due to training, background, and/or occupation) is inclined to view research activities from the standpoint of someone outside the scientific or scholarly discipline of the IRB on which he/she serves.

Non-serious Noncompliance: does not increase risk to research participants, compromise participants’ rights or welfare, or affect the integrity of the research/data or the human subjects research protection program. 

Parent: a child’s biological or adoptive mother or biological or adoptive father.

Parental Consent: the agreement of a parent(s) or legal guardian to the participation of his/her child or ward in research.

Performance Site: a site whose staff, facilities or private records of individuals are engaged in the conduct of research; or a site that receives HHS funds. The performance site is the actual place where the research activity (e.g., site where staff are consenting subjects).

Personally Identifiable Information: (1) any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

Principal Investigator (PI): in accordance with guidance published from the Office of Human Research Protections (OHRP) the PI has overall responsibilities for studies involving human subjects. 

Prisoner: an individual involuntarily confined or detained in a penal institution (e.g., prison, jail, or juvenile offender facility), with restricted ability to leave the institution. The term is intended to encompass individuals sentenced to such an institution under a criminal or civil statute, individuals detained in other facilities by virtue of statutes or commitment procedures that provide alternatives to criminal prosecution or incarceration in a penal institution, and individuals detained pending arraignment, trial, or sentencing.

Privacy: the control over the extent, timing, and circumstances of sharing oneself with others.

Private Information: information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, or information that has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public. Classrooms are considered private.

Procedure: a series of actions conducted in a certain order or manner; operational methods are used. Procedures can be social/behavioral, psychological, educational, biomedical, or clinical.

Protected Health Information (PHI): individually identifiable health information held or transmitted by a covered entity or its business associates, in any form or media, whether electronic, paper, or oral. 

Recruitment: a process by which suitable subjects are attracted to a study. Recruitment should be supported by recruitment media/materials

Related: associated with or having a timely relationship with, as in a reasonable possibility exists that an outcome may have been caused or influenced by the research, even if an alternative explanation is present. 

Repository: collection of data and/or specimens obtained and stored for future research uses and/or distribution, including a collection not originally or primarily obtained for research purposes.

Research: a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.  

Research Performance Site: location/site at which human subjects research may be performed because of an understanding of the local research context and appropriate oversight mechanisms that ensure protection of research participants.  

Restricted Data: datasets that cannot be distributed to the general public, because of, for example, participant confidentiality concerns, third-party licensing agreements, or national security considerations. 

Routine (Not-for-Cause) Review: an assessment or examination of something (e.g., a practice or procedure) with the possibility or intention of instituting change if necessary.

Secondary Research: study of existing information or materials (e.g., data or specimens) that have been previously collected for a purpose (including non-research purposes) other than the currently proposed activity.

Secondary Subjects: is an individual about whom a researcher indirectly collects identifiable private information through interactions with a primary subject. For example, An investigator interviews a primary research subject and asks questions about the health of his/her family members. Those family members could become secondary research subjects if the investigator also obtains information that can uniquely identify them. In this situation you are required to protect their privacy, just as you would protect the privacy of your primary subjects. In research that involves only minimal risk, the IRB may waive the requirement for secondary subjects to provide informed consent, but otherwise consent of secondary subjects may be required as well unless a waiver of consent is justifiable.  

Serious Adverse Event: an event that results is fatal or life threatening, permanently disabling, requires prolonged hospitalization, or results in a significant disability or anomaly. 

Serious Noncompliance: increases risk to research participants, compromises participants’ rights or welfare, or affects the integrity of the research/data or the human subjects research protection program.  

Specific Component (DOD): any one of the military branches or organizational entities within the Department of Defense, including the Army, Navy, Air Force, Coast Guard, or Marine Corps.

Specimen: human biological material, including solid material (e.g., tissue, organs) body fluid (e.g., blood, urine, saliva, semen, cerebrospinal fluid), and cells.

Sponsor-Investigator: an individual who initiates (i.e., obtains an IND or IDE) and conducts an investigation and under whose immediate direction an investigational drug or device is administered, dispensed, or used.  Note: The regulatory requirements applicable to a sponsor-investigator include those applicable to both an investigator and a sponsor.

Summary Document: a written version of the full information presented to a subject or the subject’s legally authorized representative during the informed consent process, used in conjunction with a short form consent document.  For non-English speaking individuals, the IRB-approved English language consent form may serve as the summary when an appropriately translated document is not available.

Suspension: an action taken by the IRB withdraw approval for some or all research activities, temporarily or permanently.  The Institutional Official may also suspend research on an urgent basis.  Note: Similar actions taken by investigators or sponsors to stop research activities are not suspensions as described by HRPP policy.

Systematic Investigation: implementation of rules-based methods that are repeated with multiple participants in a consistent manner across the participants. Alternatively, the method may be implemented according to specified rules with a single participant for types of investigations. 

Tabled: an IRB “action” that indicates that review was not initiated or was not completed, resulting in postponement of IRB review, usually due to loss of quorum or other administrative issue. Research tabled at a convened meeting will be reviewed at a future convened meeting.

Termination: an action taken by the convened IRBs to permanently withdraw approval for all research activities (except for those follow-up procedures that may be necessary to protect the health and/or welfare of participants).  Note: Similar actions taken by investigators or sponsors to stop research activities are not necessarily terminations.

Unanticipated Problem Involving Risks to Subjects or Others: the Office of Human Research Protections considers unanticipated problems, in general, to include those events that: (1) Are not expected given the nature of the research procedures and the subject population being studied; and (2) Suggest that the research places subjects or others at a greater risk of harm or discomfort related to the research than was previously known or recognized. Unanticipated problems can occur in any type of research (medical or non-medical) and may involve physical, psychological, social, legal, or economic harms.

Unrelated: has no association with the research; evidence exists that an outcome is definitely related to an event external to the research. 

Use: with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within the entity or health care component (for hybrid entities) that maintains such information. (See also HIPAA)

2.1 Office of Human Research Protections Resources

• FAQs: https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/informed-consent/index.html
• Informed Consent Guidance: https://www.hhs.gov/ohrp/regulations-and-policy/guidance/informed-consent/index.html

2.2 What is consent?

• Consent is the hallmark of human subjects resaerch. It is an ongoing process of providing an individual with information about a study and is a real world application of the respect for persons principle in the Belmont Report. 
  • The riskier the study, the more intensive the process should be.
  • Provide the subject ample time to read and understand the form.
  • Discuss the form with the subject, don't simply ask them to read and sign it.  
  • The subject must be able to understand the consent form - if they don't, they can't participate. Use lay language and simple writing forms. 
  • Give the subject the opportunity to reaffirm consent and provide the subject with reminders about the procedures, risks, and voluntary nature of participation.   
  • Explain the difference between treatment and research.
  • Encourage the subject to ask questions. 
  • Provide the subject a copy of the consent form.
  • Answer the subject's questions.

2.3 What types of informed consent exist?

• Investigators can seek signed informed consent, a waiver of signed consent (online consent, verbal consent), and waive or alter elements of informed consent.Waiving elements essentially means you are waiving elements of the consent form or the accepted consent process. Only under certain circumstances may the IRB approve a request to waive signed consent or waive or alter the elements of informed consent. Requests must be made by the PI through the IRB application (Section 8) and supported by submitting Appendix M1 or M2. 

2.4 Are there any additional consent requirements when working with children?

• Yes. Generally, prior to consenting/assenting anyone under the age of 18 into a research project, investigators must seek the permission of the child’s parents/guardians through the use of a parental consent form. Assent is required of children age 12 years and younger in additional to parental permission. Assent is a child’s affirmative agreement to participate in research. Informed consent is required for children aged 13 to 18 and is required in additional to parental permissions. Please be aware that you must be in compliance with Kent State University  Policy 5-19, University Policy Regarding On-Campus Activities Involving Minors.

2.5 I am conducting a study in multiple languages. Do I need a consent form for each language?

• Yes.
• I have the English version ready, but do I need the foreign language form ready before I submit to the IRB?

  • In some cases it is acceptable for a delayed submission of a foreign language document. You have to have the foreign language form approved prior to recruiting those subjects; this can occur at initial approval or later on as an amendment. For example, if year one is English speakers only and year 2 is Spanish speakers, you don’t need the Spanish language form until year two. In this scenario the foreign language materials need to be submitted as an amendment prior to use. If foreign language speakers are recruited at the onset of the study both forms are necessary with the initial submission.

  • Our suggestion is to have all relevant language forms prepared at initial submission. If you're conducting grant or contract research that involves the enrollment of foreign language speakers, you will almost certainly need the foreign language documents upon initial submission. 

IMPORTANT! Any IRB regulated project involving access to HIPAA-regulated information must be reviewed by the KSU HIPAA Privacy Officer and HIPAA Security Officer and receive IRB approval prior to starting. Typically, use of Protected Health Information (PHI) must be reviewed and approved by a covered entity’s Privacy Board/IRB prior to submission to KSU IRB.

Projects involving the use of HIPAA protected information are reviewed on the Third Thursday of each month. The study PI is expected to attend the meeting.

3.1 Common Comments

• CITI IPS training is not complete.
• The HIPAA appendix describes a different process for handling data than the IRB application.
• Not all data points are disclosed (see HIPAA appendix, section 2, questions 8 and 9).
• Information is incorrectly described as deidentified (see HIPAA appendix, section 2, question 10).
• The incorrect type of authorization is selected (see HIPAA appendix, section 4).

3.2 What is Protected Health Information (PHI)?

• PHI is individually identifiable health information held or transmitted by a covered entity or its business associates, in any form or media, whether electronic, paper or oral. More information can be found on the Health and Human Services website.

3.3 What is the Health Insurance Portability and Accountability Act (HIPAA)?

• National standards to protect an individual's medical records and other personal health information and applies to health plans, healthcare clearinghouses and those healthcare providers that conduct certain healthcare transactions electronically. The Rule requires appropriate safeguards to protect the privacy of PHI and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients' rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.
• HIPAA has three components, all of which are enforced by the federal Office for Civil Rights:
  • HIPAA Privacy Rule: protects the privacy of individual identifiable health information.
  • HIPAA Breach Notification Rule: requires covered entities and business associates to provide notification following a breach of unsecured PHI.
  • HIPAA Security Rule: sets standards for the security of electronic PHI.

3.4 How do I know if I am affected by the HIPAA Privacy Rule?

• The HIPAA Privacy Rule affects research and researchers when:
  • Review DHHS resources at https://www.hhs.gov/hipaa/index.html
  • Research requires access to and/or use of PHI that is created or maintained by covered entities, or
  • A covered entity or component of KSU performs research that creates or generates PHI
  • https://www.kent.edu/compliance/hipaa

3.5 What should I do if my research involves access to PHI?

• All research involving HIPAA regulated information is reviewed by the University Privacy and Security Officers in addition to the IRB. IRB approval is withheld until approved by the Officers.
• Review typically occurs on the third Thursday of each month.
• You should review the relevant KSU policies on PHI/HIPAA protected information.
• Work with the privacy and security officers in advance of submitting your IRB application.
• IRB Policy
• University Policy
• NIH Resource

3.6 What is a limited data set?

• https://www.hhs.gov/hipaa/for-professionals/faq/limited-data-set

3.7 What forms are required by the IRB?

• Your IRB application must clearly describe use of PHI and you must append a copy of Appendix N.
  • Research projects involving use of/access to PHI are reviewed on the third Thursday of each month.
• You must obtain HIPAA authorization unless authorization has been waived; see Appendix N.
• Additional information:
  • HIPAA Authorization Template — A sample HIPAA Compliance Authorization document; to be used as a template for the investigator, when needed to document HIPAA Compliance Authorization in a study.
  • Requirements for a HIPAA Compliance Authorization Form — A document explaining when a HIPAA Compliance Authorization Form may be required.
  • Data Use Agreement for Limited Data Set —  This is to be used if you plan to send or receive protected health information. Contact Kat Lindsey for more information.
  • Any PHI must be securely accessed, transmitted, and stored. Contact Jim Raber for more information. Additionally, information is to be deidentified at the earliest time allowed by the research and you must follow the terms and conditions of any agreement.

3.8 Is there a specific method of data sharing I must follow?

• Data must be handled securely and you need to make sure your plans are acceptable to the data owner/originator. There is no prescribed handling plan, but helpful information on safe harbor is listed below.
• You must  de-identify Protected Health Information (PHI) for the research project in accordance with Section 164.514(a) of the HIPAA Privacy Rule that provides the standard for de-identification of PHI. Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual.  
  The following technical control plan identifies the steps according to “Safe Harbor” standards identified in the HIPAA Security rule for the Safe Harbor de-identification of PHI.  
• All PHI will be stored and manipulated within the hosting organization’s environment.  Ie… Identifiable PHI will not be transferred to Kent State University at any time without all external and internal approvals.
• The data will be de-identified within the hosting environment as follows:
  a.    All HIPAA 18 Identifiers are to be excluded, redacted or deleted from the data set (spreadsheet or word document).  See 18 Identifiers: HIPAA Security Rule  -  Safe Harbor 
  b.    Once de-identified, the data set is to be copied to a fresh, new workbook or document. (do not include any identifiers in this copy and paste)
  c.    The new workbook/document is to be saved, this can then be shared outside of the hosting environment for analysis or reporting.
• Reporting to KSU:  
  a.    The de-identified data is to be encrypted and transferred through a secure resource (typically the data owner's resource)..  
  b.    This file will be password encrypted if moved to KSU’s environment. 
  c.    The password for the file will be provided, verbally, to Kent State researchers.
  d.    Kent State is to maintain this file as a password encrypted document.
  e.    At no time will data be transmitted using any sort of portable device or drive such as USB memory stick or external hard drive without full disk encryption enabled. (BitLocker)
  f.    The Microsoft M365 environment (Teams, SharePoint, OneDrive) are the only approved online collaboration spaces for data of this nature.  Please take care to use appropriate permissions to ensure that only those who need access, have access. For more information on using Teams or OneDrive to share data with KSU, please consult the data standards (https://www.kent.edu/research/office-research-compliance/data-handling-…).
   
• We agree that should there be a need to share PHI with Kent State -OR- if there is an impermissible release of PHI that no further work will be performed until this Technical and Data Control Plan is updated and approved by KSU’s IRB.  NOTE: Unauthorized release of PHI should follow HIPAA impermissible release guidance provided by the hosting organization, with immediate notification to KSU HIPAA Security and Privacy Officers. 

3.9 What are activities preparatory to research?

https://www.hhs.gov/hipaa/for-professionals/faq/317/can-the-prepatory-research-provision-be-used-to-recruit-individuals-to-a-research-study/index.html

4.5 Does the Protection of Pupil Rights Amendments (PPRA) affect my research? 

• If the research is occurring in schools, it may. 

4.6 Do any of the exemption categories apply to research on children?

• Yes. All elements of Category 1, 4, and 5 apply to research involving children. Category 2 research (educational tests, surveys, interviews, public behavior observation) applies only when procedures are limited to the observation of public behavior in which the investigators do not interact with the children or educational testing. Research involving surveys or interviews with children, or observation of public behavior when investigators interact with children, does not qualify for exempt status under this category. Category 3, (research involving benign behavioral interventions) does not apply to resaerch with children. 

4.7 Does the Children's Online Privacy Protection Act (COPPA) apply to research? 

• It may if your study involves the online collection of personal information about children under 13. In such cases the PI needs to consult with University Counsel; the IRB should be notified of UC's requirements/recommendations. Additional information on COPPA can be found at: https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule  

 

5.1 What must be included in research advertisements?

• The IRB must approval all recruitment plans and advertisements prior to use. Please see our forms page for additional guidance and templates. In general, all non-exempt study advertisements must include,
  • Name of PI and contact information and institution
  • Title and purpose of the project and disclosure that project is for research
  • Inclusion/exclusion criteria in summary form
  • Brief listing or summary of procedures,
  • Time commitment
  • Potential compensation
  • Additional information – should not emphasize compensation or use catchy or enticing language or graphics.

5.2 May I use social media to recruit?

• Yes, but it is important to understand the platform (to help ensure privacy and confidentiality) that is being used.
• Many researchers use social media as part of their recruitment strategy. If your research recruitment plans include using social media (Facebook, Twitter, blogs, Instagram, etc.) you must submit a description of your plans (i.e., platforms, frequency of posting, and process of corresponding), copies of the exact text (including pictures) proposed for use during recruitment. Recruitment strategies using social media platforms should, whenever possible, follow the basic standards used for any other form of research recruitment. To help ensure privacy and ensure that potential participants are fully informed about the study, the IRB typically requires that initial posts on social media be more general in nature and allow users to link to a site that contains more detailed information about the study (consent form, eligibility requirements, etc).
• The IRB does not endorse posting directly/publicly to any individual or organization’s social media account without prior authorization- such plans will be reviewed in context of the entire project.
• To further help protect the privacy of participants, the IRB does not typically endorse the use of social media as a form of two way communication or the use of private accounts.
• Please see our forms page for additional guidance and templates. 
• Additional Guidance  https://www.hhs.gov/ohrp/sites/default/files/ohrp/sachrp/mtgings/2013%20March%20Mtg/internet_research.pdf  (PDF)

5.3 Are recruitment templates or more detailed guidance available?

• Yes, for a comprehensive overview of recruitment review recruitment guidance and template document.

5.4 What is ResearchMatch?

• ResearchMatch a National Institutes of Health (NIH) recruitment support program is live! Learn more on the Recruitment FAQ page. 
• DO NOT REGISTER A STUDY UNTIL AFTER IRB APPROVAL IS OBTAINED!
• To qualify, your study must be "health related" and you must have IRB approval to recruit via ResearchMatch.
  • Already approved studies: you must submit an amendment and specifically state you are “Adding ResearchMatch to aid in subject recruitment.” You must include the recruitment script.
  • New studies, select “other” and enter “ResearchMatch.” You must include the recruitment script.
• Kent State's obligation is to help grow the subject pool, which is currently over 156,000. If you know anyone that may be interested in becoming a research subject, let them know about ResearchMatch.
• FAQs
• Review this help document.  

5.5 Can I recruit via email?

• Yes, but it is important to only use emails obtained through valid channels. For KSU students, this is typically the Registrar's Office. 
• It is also important to consider subject privacy when recruiting via email. In many instances it may be a violation of privacy to email subjects using narrow criteria. In many instances email offers no privacy. 
• Always use BCC!   

6.5 Whom do I contact with questions? 

• The Office of Research Compliance is here to help and you can contact us at researchcompliance@kent.edu. You can also contact any IRB member.

6.6 What do I need to know about Certificates of Confidentiality?

• CoCs are issued by agencies and information should be obtained from their websites.
  • NIH funded: https://grants.nih.gov/policy/humansubjects/coc.htm
  • NIH issued for non NIH funded projects: https://nexus.od.nih.gov/all/2020/03/03/new-certificates-of-confidentiality-system-for-non-nih-funded-research/
  • DOJ:https://nij.ojp.gov/funding/frequently-asked-questions-regarding-national-institute-justices-confidentiality-and-human

6.7 Issues related to audio and/or video recording (including photography)

• Recording should only be conducted when necessary to conduct the research.
• Recordings are considered identifiable until they are de-identified. Even if a recording does not capture an individual's face it may record other identifiers such as tattoos, birthmarks or vocal characteristics.
• Researchers are responsible for knowing the recording laws for the jurisdiction where they are conducting the research. 
• Personal cellphones should not be used to record.
• Consent must be obtained from participants for future use of the recordings.
• When recording in group settings you should have a plan for excluding those who wish to not be recorded. It is acceptable in most circumstances to exclude subjects who do not want to be recorded - prospective subjects should be advised of this. 
• The consent process must explain the use of the recordings, what will be captured, storage, and retention/destruction.
• If recording is optional, the consent form should include an additional line for express permission (see consent template).

6.8 Biosafety Review

• Human biomaterials may not be collected or obtained until Institutioanl Biosafety Committee approval is obtained. Contact Environmental Health and Safety for questions about use of biohazardous or potentially biohazardous materials. 
• Information on saliva collection:
  • Using a BSl-1 environment, saliva should be self-collected, i.e., the human subject should be given instructions for the production and transfer of saliva to an empty tube, transfer of saliva to the tube should occur so that potential spitting or splashing occurs away from the investigator. The tube should then be sealed by the subject after which the tube is wiped with a disinfecting wipe, before providing it to the investigator. 
  • If testing of the saliva is to occur off campus, no IBC protocol is necessary. Packing and shipping of other potential infectious material (OPIM) should follow IOTA/USDOT regulations.
  • If testing of the saliva is to occur on campus, an IBC protocol is required as the saliva is now considered OPIM. Testing should be completed in a BSL-2 environment.

 

7.2 Research personnel management for level I studies 

• Personnel changes to level I studies and for new level I, other than change in PI or external personnel, no longer need to be reported to the IRB. The PI continues to be responsible for personnel and ensuring that all personnel are properly trained; this includes the requirement to complete CITI training. There are no changes being made to personnel management processes for level II/III studies. 

7.3 What is required of the principal investigator?

• The requirements are detailed in the application’s Assurance Page, but in general the principal investigator has overall responsibility for the study and the ongoing conduct of the approved research. This includes completing an IRB application and obtaining IRB review/approval, including continuing review and amendments if necessary, and ensuring the research is conducted as described in the protocol. Finally, the principal investigator must ensure all personnel working on the project are adequately trained and knowledgeable about research procedures and the ethical conduct of research.

7.3 Minors: Are there any special requirements for minors working in my lab?

• Please review the KSU University Policy 5-19 Regarding Minors (http://www.kent.edu/policyreg/university-policy-regarding-campus-activities-  involving-minors) and complete any action that may be required of that policy. The minor must complete applicable training programs including CITI, lab specific training, and applicable training offered through Compliance and Risk Management. Additionally, the minor’s parent/guardian must complete a waiver that is available through Compliance and Risk Management.

7.4 Volunteers: Are there any special requirement for volunteers working in my lab?

• Please review the KSU Administrative Policy 6-04.4 Regarding Volunteers (http://www.kent.edu/policyreg/administrative-policy-regarding-volunteers), complete appendix B and indicate they are volunteers (this will add the personnel to the project  or change the status of the personnel), and complete the Volunteer Agreement form. The Volunteer Agreement form must be signed by your Chair or Dean and maintained in the investigator/department file for at least two years beyond the completion of the volunteer’s duties. The minor must complete applicable training programs including  CITI, lab specific training, and applicable training offered through Compliance and Risk Management.

7.5 I am new faculty at KSU or I am new to human subjects research, what are tips on getting started?

• We recommend starting by reviewing our IRB Help page  and completing CITI training. In most cases, if you completed CITI at another institute we will accept your certificate through its expiration date. You must change your affiliation to Kent State no later than your next required refresher.

7.6 I have an open project at my former institute. What do I need to do?

• In most cases you will need to seek approval of a new application or inter institutional authorization agreement from the KSU IRB if you want your former institute to remain as the IRB of record. Additionally, you should contact your former institute for guidance on their policies.

7.7 I have data that needs to be transferred from my former institute. What do I do? 

• In general, you will need to seek IRB approval prior to transfer and data should be managed as described in the in the protocol for which the data was collected under. Also, you should contact your former institute’s IRB (and funder if applicable) to ensure you are compliant with their rules.
• Coming soon - data security and use standards!

7.8 Leaving Kent State University?

• If your study is funded, contact Sponsored Programs. 
• PI leaving KSU: if an open project is to continue and the PI is leaving one of two actions typically happen. First, if KSU will continue to be the main contributor (including primary recipient of funds) a change in PI must be submitted. The person leaving KSU will need to be added as external personnel (using appendix B) and if they continue to be engaged in the research, an IAA must be completed. Second, if KSU will cease being the main contributor, the study must be closed and the PI needs to consult their new institute’s IRB. 
• Co-Investigators leaving: if an exiting Co-I continues to be engaged they will need to obtain their own  IRB approval or seek an IAA (IAA’s are mandatory for federally funded projects). Co-Is can be removed via the annual review form. If your study is not subject to annual review you do not need to notify the IRB. If they are no longer engaged, access should be revoked as described in the IRB application. If only using de-identified data, complete a de-identified data use agreement.
• If a student is to leave the institute and continue to be engaged in the research they will need to be added as external personnel (using appendix B). If they are unaffiliated after leaving KSU, they may be considered volunteers.
• Questions regarding data ownership, management, and use must be directed to your Department Chair or College Dean.

7.9 Do transcriptionists and translators need to be added to my protocol?

• Typically not. Transcriptionists and translators are not considered engaged so long as all of the following apply: their services do not merit professional recognition or publication rights, their services are typical of those performed for non-research purposes, and they are not administering a study intervention or being evaluated under a protocol. University Counsel requires the use of a confidentiality or non-disclosure agreement. 

 

         

Multi-site research often allows and, in some cases requires, review by only one institution’s IRB with other institutions relying on that review. The single IRB (sIRB) process requires documentation of the reliance arrangement. Kent State researchers collaborating on studies with other institutions or individuals engaged in research may need to work with the Office of Research Compliance to appropriately document IRB reliance arrangements.

There are multiple approaches to reliance and there is variation in how institutions implement reliance arrangements. The Office of Research Compliance advises contacting the office to discuss the appropriate approach if you are not sure how to manage IRB oversight of a multi-site project. In some cases, when permitted by the regulations, we may advise you or your collaborator to obtain their own IRB review. In some cases, as in NIH funded studies, single IRB review may be required.

8.1 Reliance Agreement Types

• Master IRB Collaboration Agreement or SMART IRB Agreement                                                        The Kent State IRB has entered into multiple master agreements with institutions including Akron Children’s Hospital, Akron General Hospital, Summa Health System, Ursuline College, University of Akron, NEOMED, YSU, Cleveland State University and Cleveland Clinic. KSU may also use the SMART IRB Agreement which is a standing authorization agreement many other institutions have also signed. We also maintain an agreement with Advarra, a commercial provider of IRB and other services. Use of Advarra is ideal for commercial and industry sponsored studies, and some studies occurring in clinical settings. If you have questions about partnering with Advarra, please contact researchcompliance@kent.edu.                                                                           
• IRB Authorization Agreement (IAA)                                                                                              An IAA is a formal written agreement between two or more institutions that have IRBs, which permits IRB review to be limited to one institute – the reviewing institution is referred to as the IRB of record or Reviewing IRB. To execute and IAA, the Kent State IRB, ORC and University Counsel collaborate to negotiate study specific agreements with your collaborator’s IRB. It is not uncommon for external institutions to have different standards or policies and procedures than KSU for oversight of research and executing agreements. As a result, IAAs may delay the review process.  To expedite review of IAAs, as early as possible let all institutes involved in the IAA know of your plans to request single IRB review.
• Individual Investigator Agreement (IIA)                                                                                        In the event your collaborator’s institution does not operate an IRB, the Kent State IRB may extend oversight to individuals engaged in research under the Individual Investigator Agreement (IIA). Additional information for individual investigators may be provided in the application via Appendix B - Ancillary Personnel. 

8.2 What are the steps for reliance arrangements?

• Work with your collaborators to determine (1) engagement; (2) reviewing IRB; (3) agreement type. Review this FAQ and contact the Office of Research Compliance if you have questions about these determinations.
• Access the Kuali/electronic application to prepare the submission. Application type will depend on the reliance arrangement; however, a submission is required regardless of reviewing IRB.
• Develop a communication plan with your collaborators to ensure submission processes at all engaged institutions are followed during the initial review process and for the full life of the study, including amendments, continuing reviews and events.
• When KSU is to be the IRB of record, the following forms may be required:
  • IAA Template
  • Local Context Information
  • Investigator Attestation 

8.3  What does it mean to be engaged in research activities?

• Visit OHRP's website: https://www.hhs.gov/ohrp/regulations-and-policy/guidance/determining-when-institutions-are-engaged-in-research/index.html
• View the OHRP You Tube video: https://www.youtube.com/watch?v=7gmRz0dNUmI&feature=youtu.be 

8.4 How do I know which institution should be the IRB of record?

External Review

If any of the following are true about the study, use of an external IRB may be appropriate:

• Kent State faculty/staff will be performing the majority of the study procedures at an external institution/site and the institution/site holds a current FWA and IRB registration.
• The involvement of the KSU investigator(s) is limited. (For example, data analysis of information collected at another institution.)
• Another institution’s reviewing IRB is more properly constituted to review a certain scope of work, or may have knowledge of the local research context. (For example, a biomedical research project where the interaction involves a clinical investigation with patients as subjects)
• The IRB of Record has been determined by a sponsor.

KSU Review

If any of the following are true about the study, KSU as the IRB of record may be appropriate:

• Most of the study procedures will be performed at Kent State, or by Kent State faculty/staff.
• KSU faculty/staff are serving as the coordinating center.
• The KSU IRB is more appropriately constituted to review the scope of work.

8.5 What is local context review?

• Local Context Review refers to the process of considering institutional, local and state specific laws, policies and procedures with regard to a specific research study. IRBs frequently use local context review procedures to document and communicate site specific information.
• When KSU is the IRB of Record, local context information is required when adding an external, relying site. Local context information is submitted via the electronic application via Appendix O - Relying Site Local Context. 
• When KSU is relying on another IRB, the office of Research Compliance completes a local context review to ensure state laws and institutional policies and procedures, including ancillary reviews, are addressed in the research protocol. Review for local context is completed via the electronic application.
• For more information, review this DHHS guidance document: https://www.hhs.gov/ohrp/sachrp-committee/recommendations/2013-january-10-letter-attachment-a/index.html

8.6 Special Considerations for Reliance Arrangements

Exempt research

• The NIH sIRB policy does not currently apply to exempt research, so most IRBs, including Kent State's, opt not to enter into IAAs for exempt research. If you are working on a project that was exempted (level I approval) by another IRB, we will either require you to submit a KSU level I application or review the application that was approved by the external institute. The external collaborator may be asked to enter into a data use agreement (per University Counsel), consult with their IRB or another action may be required.     

International research

• Authorization agreements are generally not applicable when working with sites outside of the United States. If you are planning a multi-site study with international sites engaged in the research, contact the Office of Research Compliance.

Collection and storage of shared data

• Identifiable "offsite" data needs to be stored per the KSU-approved IRB application and IT security policy (https://www.kent.edu/is/security-requirements-faculty-and-staff).
• If it is not possible to store the data offsite according to KSU procedures, contact IT to ensure data/subject information is secure.   

Genomic Data

• There are specific regulations related to the sharing of genomic data. See these NIH resources:
  • https://osp.od.nih.gov/scientific-sharing/genomic-data-sharing-faqs/ 
  • https://osp.od.nih.gov/scientific-sharing/genomic-data-sharing/ 

8.7 What is the regulation on cooperative research?  

45 CFR 46.114 states:

1. Cooperative research projects are those projects covered by this (45CFR46) policy that involve more than one institution. In the conduct of cooperative research projects, each institution is responsible for safeguarding the rights and welfare of human subjects and for complying with this policy.
2.  
   1. Any institution located in the U.S. that is engaged in cooperative research must rely upon approval by a single IRB for that portion of the research that is conducted in the U.S. The Reviewing IRB will be identified by the federal department or agency supporting or conducting the research or proposed by the lead institution subjects to the acceptance of the federal department or agency supporting the research. 
   2. The following research is not subject to this provision:
      1. Cooperative research for which more than single IRB review is required by law (including tribal law passed by the official governing body of an American Indian or Alaska Native Tribe); OR
      2. Research for which any federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular context.
3. For research not subject to paragraph b of this section, an institution participating in a cooperative project may enter into a joint review arrangement, rely on the review of another IRB, or make similar arrangements for avoiding duplication of effort. 

8.14 International Research

• If you plan to conduct a project outside of the US, plan for extra time for review. There is no guarantee of IRB approval by a given deadline.
• Any human subjects research that is conducted internationally must be reviewed and approved by the IRB. The protections offered to subjects must be at least equivalent to those stated in 45CFR46.
• A study is considered to be international if information is collected from participants that are outside of the US even if the investigators do not leave the US. For example, US based investigators conducting an online study in which the subjects live outside of the US is considered an international study.
• Research with international populations that occurs within US borders is not considered international research. 
• The study must also adhere to local laws, customs, and traditions that apply to human subjects research.
• International studies must consider management of non-English speaking populations. This includes a consent form and process that is understandable to subjects that do not speak English.  
• Investigators need to consider data laws such as UK-GDPR and GDPR.
• The IRB may consult with subject matter experts and may require investigators to do the same.
• Helpful information from OHRP is available at: https://www.hhs.gov/ohrp/international/index.html

1.1 The Office of Human Research Protection’s (OHRP) website offers a comprehensive list of Frequently Asked Questions-The topics include informed consent, the common rule, research with children, and investigator responsibilities.

1.2 KSU Policies

Policy on Compensating Research Subjects

Policy on Principal Investigator

Policy on Research Involving PHI

Policy on Students as Research Subjects

Policy on Continuing Review

Policy on Adverse Events

Policy on Non-compliant Events

Human Subjects Protection Program

1.3 IRB review of publicly available datasets:

• The IRB requires the review of publicly available data sets to ensure there is no intent to re-identify de-identified information, to help meet the terms of an agreement, including agreements related to restricted datasets, to support a grant proposal, and to ensure the request meets the criteria for exempt/level I review and any other supplemental regulations that may exist such as those related to FERPA and HIPAA.
• Datasets that must go through expedited review: research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for nonresearch purposes (OHRP website). 

 

 

 

Data  Standards

10.1.1: University Data Handling Guide. Review and adhere to the data handling guide, which establishes the University's expected minimum standards. The IRB may require stricter control.  

• Use KSU owned systems and software. Non-KSU software should only be used if absolutely necessary and be reviewed by IT Security. 
• Do not transmit non-public data via email; email is not secure. 
• Default to the strictest level of control based on your data type. 
• Proctor data access, when somebody leaves a study, revoke their access.
• Deidentify/code data as soon as allowed by the research. 
• Only those with "need to know" should have access to identifiers. 
• Limit the use of unnecessary indirect identifiers and avoid narrow subject pools. 
• Never leave data unattended or unsecured. 

Confidentiality and Privacy

10.2.1: Confidentiality refers to the research team’s agreement with participants about how identifiable, private information will be handled, managed, and disseminated. Privacy addresses behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public. You must consider how the study's location, tools, and planned interactions affect your ability to maintain an individual's privacy. The key question to ask yourself about your data collection procedures is “would a reasonable person being studied consider the information to be private.”

10.2.2: Identifiable information should only be collected if needed and only be retained for the minimum time necessary to complete the research. In some cases, it may be challenging or even impossible to maintain confidentiality. The use of direct and indirect identifiers must be carefully considered along with the uniqueness of the study population and the procedures used. The consent form must clearly state any limitations to confidentiality. 

• When planning provisions for confidentiality, consideration should be given to whether data are coded, de-identified or anonymous: 
  • Coded refers to data linked to individual subjects' identifiers using a code. Generally, the data is collected with a "Study ID" and a linkage file is maintained where the Study ID is associated with the subject's identifiers.
  • De-identified refers to data that are not associated with any direct or indirect identifiers or codes linking the data to the individual subject's identity. Data are de-identified when the linkage file has been destroyed or the code has been removed from the dataset and no data can be linked back to an individual. 
  • Anonymous refers to data that no one, not even the researcher or a third-party entity (e.g. Qualtrics), can connect to the individual subject through direct or indirect identifiers. 
  • Indirect identifiers is more than one data element that can be used to ascertain an individual's identity.   

10.2.3: Data is a broad term that consists of information generated by a research study and includes data sets, interview transcripts, media files, field notes, and diaries. The Common Rule does not define information, but uses the term frequently. It is generally accepted that "information" includes data as well as other factors about individuals that may not be considered research data, this includes direct identifiers such as names or email addresses.   

Data Use Agreements

10.3.1 Important: University Counsel (U.C.) is the university’s authority for contractual matters, including data use agreements. U.C. has delegated limited authority to The Office of Research Compliance to help investigators execute most de-identified data use agreements.

10.3.2 Templates:

• De-Identified Data Use Agreement — This can be used if you plan to share de-identified data that is not already publicly available. 
• Data Use Agreement for data containing identifier (not for Limited Data Sets) — This form is to be used if you plan to send data that includes identifiers to another institution.
• Confidentiality agreement - This form is to be used when using non-research personnel (third party) translation or transcription services. 
• IS Secured Use & Confidentiality of University Records and Data — This is to acknowledge that investigators understand the rules associated with university records and data confidentiality. 

10.3.3 What are data use agreements?

• Data use agreements (DUA) are contractual documents that define limitations on a recipient’s use of non-public data or data that is otherwise restricted by the data provider or under applicable law.

10.3.4 When is a data use agreement required?

• Typically, you must use a DUA when sharing identifiable data with a party external to KSU. The terms of a DUA are under the purview of University Counsel. The IRB works with University Counsel to help facilitate DUAs for inter-institutional human subjects research.

10.3.5 When is a data use agreement not required?

• If another fully executed agreement (i.e., sponsored research agreement, grant agreement, or IRB inter-institutional authorization agreement) includes terms for data sharing and supersedes the need for a data use agreement. Data use agreements are not needed to share deidentified data unless the consent form or IRB application, or another agreement prohibit sharing.  

10.3.6 What if the data I am sending to an external party includes Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) or education records protected under the Family Education Rights and Privacy Act (FERPA)?

• You must get approval from the University’s Privacy Officer (PHI) or Registrar (FERPA) and follow their requirements.

10.3.7 Who can sign a DUA on behalf of the University?

• DUAs may only be signed by a University official with the appropriate delegated signature authority. Data use agreements related to research typically need to be signed by the Vice President for Research and Economic Development or an appointed designee. Contact University Counsel of the Division of Research and Economic Development for more information. 

10.3.8 What if I am asked to sign a DUA by an external party?

• Contact University Counsel.
• Once fully executed, abide by the terms and conditions of the agreement.

10.3.9 Do I need to contact the IRB prior to sharing data?

• If the data was collected under the approval of the KSU IRB, you must contact the Office of Research Compliance. The ORC will review your IRB application to ensure sharing of data is not disallowed.

10.3.10 What types of data use agreements exist?

• The two most common types are stand-alone de-identified data use agreements or confidentiality  agreements with data-use provisions. If sharing identifiable data (using a confidential agreement) you must justify to the IRB the need to share identifiers.

10.3.11 Other helpful federal information

• National Science and Technology Council - DESIRABLE CHARACTERISTICS OF DATA REPOSITORIES FOR FEDERALLY FUNDED RESEARCH
• NIH Data Management and Sharing Policies 
• National Institute for Standards and Technology - includes information about Cybersecurity 

 

11.1 What requires IRB approval?

•  See OHRP decision charts here. 
• Any systematic investigation that is designed to develop or contribute to generalizable knowledge via interaction (or obtaining identifiable data about) with living individuals.
• Determinations can be obtained by completing an online determination form that is available on our forms page or by contacting our office.
• Exempt reserch and not human subjects research are different. Exemptions are issued by the IRB and are to be conducted in accord with the Common Rule. It is the IRB's recommendation that any study involving "humans" abide by the Belmont Report.   

11.2 Do I need IRB approval if my grant proposal lacks definite plans for involvement of human subjects, but eventually will? 

• In consultation with Sponsored Programs we can issue what is known as a 118 determination; this is sometimes known as an approval in principle. More information: https://www.ecfr.gov/cgi-bin/retrieveECFR?gp=&SID=83cd09e1c0f5c6937cd9d7513160fc3f&pitd=20180719&n=pt45.1.46&r=PART&ty=HTML#se45.1.46_1118

11.3 Retroactive IRB approval

• There are no provisions in the federal regulations that allow the IRB to approve research that has already been conducted.

11.4 Does the IRB have a stance on scholarly and journalistic activities?

• Generally, scholarly and journalistic activities do not fall within the scope of the IRB.
• For more details on guidance from OHRP. 

11.5 Pilot study, do I need IRB review?

• Usually not. A pilot study is preliminary feasibility study or test that is conducted with a small number of people. They are to help investigators refine procedures and/or processes and are not designed to contribute to or create generalizable knowledge and are not considered human subjects research that requires IRB review. Data collected from a pilot must not be used as research data. If you are planning a pilot study that involves invasive or biomedical procedures or may involve more than minimal risk activities contact the Office of Research Compliance. Regardless of the need for IRB review, any pilot must be conducted according to sound and ethical research practices including those stated in the Belmont Report.    

11.6 Do Public Health Surveillance activities require IRB review?

• Generally, public health surveillance activities do not fall within the scope of the IRB.
• For more details on guidance from OHRP.

11.7 Is my study regulated by the FDA and does it invoke 21 CFR 50?

• The FDA defines a human subject as an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient.
• A test article is defined as any drug (including a biological product for human use), medical device for human use, human food additive, color additive, electronic product, or any other article subject to regulation under the act or under sections 351 and 354-360F of the Public Health Services Act.
• A clinical investigation is any experiment that involves a test article and one or more human subjects and that either is subject to requirements for prior submission to the FDA under section 505(i) or 520 (g) of the act, or is not subject to requirements for prior submission to the FDA under these sections of the act, but the results of which are intended to be submitted later to, or held for inspection by, FDA as part of an application for a research or marketing permit. The term does not include experiment that are subject to the provisions of part 58 (21CFR) of this chapter, regarding nonclinical laboratory studies.
•  To know more about 21 CFR 50   
• KSU IRBs are not able review FDA-regulated and KSU cannot serve as a sponsor at this time.  
  • Review can be coordinated with Advarra. There is a cost associated with this service. Please contact researchcompliance@kent.edu if you have quesitons about FDA regulations or to coordinate Advarra review. 

11.8 Practicum and Internship Guidance 

Practicums and internships are required by many academic programs and offer students an excellent opportunity to gain firsthand experience in their field of study.  The majority of practicums and internships do not involve human subjects research. However, practicums and internships that include systematic investigations that are designed to develop or contribute to generalizable knowledge may require IRB review.

Common internship and practicum activities and scenarios are listed below along with guidelines for IRB review. In all circumstances, students are to adhere to the principles of the Belmont report and abide by relevant professional ethics. The faculty person overseeing the practicum or internship is responsible for obtaining an IRB determination/review from the host site or KSU as necessary.

If a project is determined to not be research by another institution and includes obtaining PHI, KSU student data, or will occur on KSU property please contact the Office of Research Compliance. If determined to be QI by another institution and does not include PHI submit via self-determination.

The following is a list of common activities and typical review requirements. 

• Activity: An experience that falls within the business activities of the hosting agency and data is collected, but research (as defined in the federal regulations) is not the intent.
  • KSU IRB Review: No
• Activity: Student conducts a unique project that involves data collection in order to inform business processes, measures quality initiatives, or similar and the results will not develop or contribute to generalizable knowledge.  
  • KSU IRB Review: No
• Activity: An experience where no data of any kind is collected.
  • KSU IRB Review: No
• Activity: Serving as an engaged* investigator on a KSU IRB-approved project.
  • KSU IRB Review: Yes
• Activity: Serving as a research associate on a human-subjects research project approved by a non-KSU IRB. A written determination from the external PI/IRB should be maintained in the faculty files.
  • KSU IRB Review: An IRB reliance agreement if required by the external institute. Call the ORC for more information.
• Activity: Independent research project that meets the federal definition of human-subjects research regardless of performance site.
  • KSU IRB Review: Yes, if reviewed by a non-KSU IRB please contact the Office of Research Compliance.

11.9 Is my study evaluation, research or both? 

Program Evaluation	Research
Assessment of how well a process, product or program is working in a specific context	Aims to produce new knowledge to contribute to a broader societal endeavor
Focus on Process, product or program	Focus on population (human subjects)
Designed to improve a process, product, or program via: needs assessment process, outcome or impact evaluation cost-benefit or cost-effectiveness analyses	Same as at left, but adds procedures, component(s) or analyses aimed to generalize (e.g., combining data with other projects, randomization, expanded sites, literature review)
Assessment of program or product as it would exist regardless of the evaluation	May include an experimental or non-standard intervention
If publication results, has no impact on how the project is designed or analyzed	The desire to disseminate impacts the choice of procedures or analyses, in order to strengthen generalizability
Activity will rarely alter the timing or frequency of standard procedures	Standard procedures or normal activities may be altered by an experimental intervention

11.10 Class Projects 

• Class projects are designed for educational purpose in support of the University’s pedagogical mission. They are not designed to create or contribute to generalizable knowledge and do not meet the definition of human subjects research. They are not subject to the Common Rule. IRB review is not required.
• Class Projects should be registered via the Exempt and Class Projects self determination form. 
• Class projects are intended as a learning exercise. The results are not considered generalizable but may be shared during classroom activities or other KSU sponsored events or programs. De-identified information may be presented during these activities.
• The course instructor is responsible for the responsible conduct of the projects. This includes training students and requiring the use of the Class Project Consent form or a similar information sheet.     
• Class projects must be minimal risk, may not enroll populations that may need additional protections, and in most cases may not be conducted with support of external research funds. If you plan to use external research funds to conduct a class project, please contact researchcompliance@kent.edu.