Which Types of Studies Are Covered — and Which Are Exempt—According to Federal Regulations?
Ever stared at a consent form, scratched your head, and wondered whether your project even needs IRB review? You’re not alone. Researchers, students, and even industry folks keep hitting that same wall: *“According to the federal regulations, which of the following studies actually require oversight?
Quick note before moving on Worth knowing..
The short answer is: it depends on the study’s design, the data you collect, and who you’re working with. The long answer? Day to day, a maze of definitions, exemption categories, and gray zones that most people only learn after a costly mistake. Below, I break down the key pieces of the federal human‑subjects protection rules (45 CFR 46, the “Common Rule”) and walk you through the decision‑making process step by step It's one of those things that adds up. But it adds up..
What Is “Human Subjects Research” Under Federal Law?
When the federal government talks about human subjects research, it’s not just any interaction with a person. The definition is narrow enough to keep most everyday surveys out of the paperwork nightmare, yet broad enough to pull in clinical trials, behavioral experiments, and even some data‑mining projects.
The Core Definition
A human subject is a living individual about whom a researcher obtains information through:
- Interaction – interview, questionnaire, physical exam, or any direct contact.
- Identifiable private information – medical records, genetic data, or any data that can be linked back to a person.
If you meet either of those, you’re likely dealing with human subjects research But it adds up..
What Counts as “Research”?
The term research means a systematic investigation designed to develop or contribute to generalizable knowledge. That’s the tricky part: a quality‑improvement project for a single hospital might feel like research, but if you intend to publish the findings or apply them elsewhere, the federal definition kicks in No workaround needed..
Why It Matters – The Real‑World Impact of Getting It Wrong
Missing the IRB requirement can cost you more than a delayed grant Small thing, real impact..
- Funding at risk – Federal agencies will pull money if they discover non‑compliance after the fact.
- Legal exposure – Violations can trigger audits, fines, or even civil lawsuits if participants are harmed.
- Reputation damage – A single breach can tarnish a lab’s credibility for years.
On the flip side, over‑reporting every tiny questionnaire can waste time, money, and morale. Knowing exactly which studies need review helps you allocate resources wisely and keep the paperwork to a manageable level.
How It Works – Deciding Whether Your Study Needs IRB Review
Below is the practical decision tree most institutions follow. Think of it as a mental checklist you run before you write the first line of your protocol And it works..
1. Identify the Study Type
| Study Category | Typical Examples | Federal Regs Reference |
|---|---|---|
| Exempt | Anonymous surveys, educational tests, public behavior observation | 45 CFR 46.Day to day, 104(d) |
| Expedited | Minimal risk procedures (e. So naturally, , blood draws < 500 µL) | 45 CFR 46. g.110 |
| Full Board | Clinical drug trials, invasive procedures, vulnerable populations | 45 CFR 46. |
If you land in the “Not Human‑Subjects” column, you can skip the IRB entirely.
2. Ask the “Identifiable Private Information” Question
Do you have a way—now or later—to link the data back to an individual?
- Yes → You likely have a human subject.
- No → You may be exempt, but keep reading.
3. Check the Exemption Categories
The Common Rule lists nine exemption categories. The most common ones are:
Category 1 – Educational Practices
Research conducted in established, educational settings involving normal classroom activities.
Example: Comparing test scores between two teaching methods in a public high school.
Category 2 – Surveys, Interviews, Public Behavior
Anonymous or confidential surveys/interviews where the risk is minimal and the topics are not sensitive.
Example: A campus-wide poll on cafeteria preferences.
Category 3 – Benign Behavioral Interventions
Interventions that pose no more than minimal risk and don’t involve deception that could affect participants’ rights.
Example: A study where participants watch a short video and then rate their mood And that's really what it comes down to. But it adds up..
Category 4 – Secondary Use of Identifiable Data
Using existing data collected for non‑research purposes, provided the data are de‑identified or the researcher has a limited data set agreement.
Example: Analyzing hospital discharge records after removing names and MRNs.
If your study fits any of these, you can request an exemption from the IRB. Remember: the IRB still has to confirm the exemption; you can’t self‑declare.
4. Determine Risk Level
Even if a study is exempt, the risk must be minimal. That means the probability and magnitude of harm are no greater than those encountered in daily life.
- Minimal risk → Likely exempt or expedited.
- More than minimal → Full board review.
5. Consider Vulnerable Populations
Children, prisoners, pregnant women, and individuals with diminished autonomy trigger extra safeguards. Even an otherwise exempt survey about drug use becomes a full board case if minors are involved.
6. Submit to Your Institution’s IRB
If you’re still unsure, submit a brief protocol (often called a “determination request”). Most IRBs will give you a quick yes/no on whether you need full review, expedited review, or an exemption Easy to understand, harder to ignore..
Common Mistakes – What Most People Get Wrong
Mistake #1: Assuming All Anonymous Surveys Are Exempt
Turns out, anonymity alone isn’t enough. If the survey asks about illegal behavior (e.g., drug use) or sensitive health information, the IRB may deem it more than minimal risk.
Mistake #2: Forgetting About “Identifiable” When Using Public Data
Just because data are publicly available doesn’t mean they’re not identifiable. A Twitter handle can be linked back to a real person, especially when combined with location tags.
Mistake #3: Mixing Up “Exempt” and “Expedited”
Exempt studies don’t undergo any IRB review beyond the exemption determination. Expedited studies still require IRB oversight, albeit a faster, less intensive review.
Mistake #4: Overlooking the “Generalizable Knowledge” Clause
A quality‑improvement project that stays within one department might be exempt, but as soon as you intend to publish or share the findings broadly, it becomes research.
Mistake #5: Ignoring Institutional Policies
Federal regulations set the floor, not the ceiling. Some universities apply stricter standards—like requiring IRB review for any study involving student participants, regardless of risk.
Practical Tips – What Actually Works
- Start with a “quick‑scan” worksheet before you write a grant. List interaction types, data sources, and participant groups.
- Consult your IRB’s FAQ early. Most offices have a “self‑assessment” tool that tells you whether a study is likely exempt.
- Document every decision—even a “we decided this is exempt” note. Audits love paper trails.
- De‑identify whenever possible. Stripping direct identifiers (names, SSNs) often moves a project from full review to expedited or exempt.
- Use a data‑use agreement for secondary data. It signals to the IRB that you respect privacy, even if the data are technically identifiable.
- Plan for the worst‑case scenario. If you’re on the fence, treat the study as full‑board. It’s better to have extra time than a compliance nightmare later.
FAQ
Q1: Do I need IRB approval for a dissertation survey that only I will see?
A: If the survey collects identifiable information (even just a name or email) and you intend to publish the results, you need at least an exemption determination.
Q2: What if I’m using a publicly available dataset that includes zip codes and ages?
A: Those are considered identifiable under HIPAA. You’ll need either a data‑use agreement or to de‑identify the dataset (remove zip codes, or aggregate them) before it can be exempt.
Q3: Are “crowdsourced” studies on platforms like Amazon Mechanical Turk exempt?
A: Not automatically. Even if the workers are anonymous to you, the platform may retain identifying info. Most institutions treat MTurk studies as expedited at minimum.
Q4: Can I combine an exempt survey with a small interview component and stay exempt?
A: Only if the interview is also minimal risk and doesn’t collect sensitive data. Adding a face‑to‑face interview often pushes the study into the expedited category.
Q5: Does “generalizable knowledge” mean I can’t do any internal audits?
A: You can conduct internal audits without IRB review as long as the findings stay within the organization and aren’t intended for broader dissemination And that's really what it comes down to. Practical, not theoretical..
When you finally file that determination request and hear “exempt” or “expedited” back from the IRB, it feels like a weight lifted. You’ve navigated the maze, avoided the common pitfalls, and kept your project on track.
So the next time someone asks, “According to the federal regulations, which of the following studies need IRB review?” you’ll have a clear, step‑by‑step answer—and the confidence to move forward without a hitch Not complicated — just consistent..
Happy researching!
7. When an “Exempt” Determination Isn’t Enough
Even after the IRB signs off on an exempt status, you still have responsibilities that extend beyond the signature line:
| Responsibility | Why It Matters | How to Satisfy It |
|---|---|---|
| Data Security | Federal and institutional policies require that any data—exempt or not—be stored securely. | |
| Record‑Keeping | Audits can happen years after the study ends. | |
| Publication Disclosure | Journals often require a statement about IRB review. Practically speaking, | |
| Reporting Unanticipated Problems | A seemingly benign study can uncover a privacy breach or an unexpected emotional reaction. | Follow your institution’s incident‑reporting protocol within 24‑48 hours of discovery. That's why |
| Informed Consent (or Its Equivalent) | Participants must still know what they’re agreeing to, even if the study is low risk. | Use a concise consent script or an online “click‑to‑agree” screen that outlines purpose, duration, risks (if any), and the voluntary nature of participation. 104(d)(4). |
8. A Quick Decision‑Tree You Can Print and Pin to Your Desk
Start → Does the study involve human subjects? (Yes/No)
No → No IRB needed (but still follow data‑privacy laws)
Yes → Are you collecting identifiable private info? (Yes/No)
No → Likely Exempt (complete self‑assessment)
Yes → Is the data “publicly available” and de‑identified? (Yes/No)
Yes → Exempt (verify with IRB)
No → Does the study involve more than minimal risk? (Yes/No)
No → Expedited review (submit minimal‑risk protocol)
Yes → Full Board review (prepare full application)
Print this flowchart, stick it on your lab door, and you’ll spend less time second‑guessing and more time collecting the data you need.
9. Common Misconceptions Debunked
| Myth | Reality |
|---|---|
| “If it’s a short online poll, I don’t need any IRB paperwork.” | Even a five‑question poll can be non‑exempt if it asks for identifiers (e.That said, g. , email, student ID). |
| “Exempt means no consent is required.On top of that, ” | Exempt studies still need a concise consent process; the difference is that the consent form can be brief and may be presented electronically. |
| “Because my advisor approved the project, the IRB will too.” | Faculty endorsement does not replace formal IRB determination. Worth adding: the board’s role is independent and legally required. On top of that, |
| “If the data are stored on a secure university server, I’m automatically compliant. ” | Secure storage is necessary but not sufficient; you must also meet de‑identification standards and have the appropriate IRB classification. Because of that, |
| “I can reuse data from a previous study without re‑checking the IRB. That said, ” | Only if the original consent covered secondary analysis and the data remain de‑identified. Otherwise, you need a new determination. |
10. Putting It All Together: A Mini‑Case Study
Scenario: Maya, a graduate student in public health, wants to study the relationship between campus housing type (dorm vs. off‑campus) and self‑reported stress levels. She plans to:
- Pull housing status from the university registrar (contains student IDs).
- Send an online survey asking participants to rate stress on a 1‑10 scale and provide their age and gender.
Step‑by‑step application of what we’ve covered:
- Identify the data elements – Student IDs are direct identifiers; stress scores are not sensitive health data but are linked to a potentially vulnerable population.
- Determine risk level – Minimal risk, but the combination of identifiers + demographic data could re‑identify a student.
- Choose the pathway – Because she will receive identifiable information from the registrar, the study cannot be exempt. It qualifies for expedited review (Category 2: research involving non‑invasive surveys).
- Prepare documentation –
- A brief protocol describing purpose, recruitment, and data‑handling steps.
- A concise consent script that explains the link between housing data and survey responses, the voluntary nature, and the right to withdraw.
- A data‑use agreement with the registrar specifying that IDs will be stripped after linking and that the final analytic file will contain only a random study ID, housing type, age, gender, and stress score.
- Submit to the IRB – Use the institution’s online expedited submission portal, attach the protocol, consent script, and data‑use agreement.
- Follow through – Once approved, Maya encrypts the data, limits access to her advisor and a statistician, and retains the IRB approval letter for three years after publication.
By following the checklist, Maya avoids a common pitfall (assuming that “survey = exempt”) and secures a smooth, compliant path to her dissertation results.
Conclusion
Navigating the IRB landscape doesn’t have to feel like decoding an ancient manuscript. The key is to break the process into bite‑size questions, apply the “identifiable + risk” matrix, and lean on the resources your institution already provides—self‑assessment tools, FAQ pages, and seasoned IRB staff And that's really what it comes down to..
Easier said than done, but still worth knowing.
- If you’re not collecting identifiers and the activity is low‑stakes, you’ll most likely land in the exempt zone.
- If you have identifiers but pose only minimal risk, aim for an expedited review.
- If the study involves more than minimal risk (sensitive health information, vulnerable populations, or potential for coercion), prepare for a full‑board review.
Remember that even “exempt” studies come with obligations: secure data handling, concise informed consent, and meticulous record‑keeping. Treat every determination as a checkpoint, not a finish line.
By internalizing the decision‑tree, keeping a running log of your IRB interactions, and treating each project as a unique puzzle rather than a one‑size‑fits‑all scenario, you’ll spend less time scrambling for approvals and more time generating the knowledge that drives your field forward No workaround needed..
So the next time you hear, “According to the federal regulations, which of the following studies need IRB review?Consider this: ”—you’ll be ready to answer with confidence, clarity, and a well‑documented plan that keeps both your research and your conscience clear. Happy researching, and may your IRB journey be swift and uneventful.
