Community Based Research

Community based research (CBR) is research that is conducted as an equal partnership between academic investigators and members of a community. In CBR projects, the community participates fully in all aspects of the research process. Community is often self-defined, but general categories of community include geographic community, a community of individuals with a common problem or issue, or a community of individuals with a common interest or goal.

Where research is being conducted in communities, investigators are encouraged to involve members of the community in the research process, including the design and implementation of research and the dissemination of results when appropriate. The HRPP Office will assist the investigator in developing such arrangements.

The most significant community involvement is in a subset of CBR called Community Based Participatory Research (CBPR) where there is an equal partnership between the academic investigators and members of a community, with the latter actively participating in all phases of the research process including the design and implementation of research and the dissemination of results when appropriate.

Questions to be considered as CBR studies are developed, and issues that the IRB will consider when reviewing CBR are as follows: 

• How was the community involved or consulted in defining the need for the proposed research (i.e., getting the community’s agreement to conduct the research)? 
• How was the community involved or consulted in generating the study research plan? 
• How will the research procedures, including recruitment strategies and consent processes be assessed to ensure sensitivity and appropriateness to various communities (e.g., literacy issues, language barriers, cultural sensitivities, etc.)? 
• How will the community be involved in the conduct of the proposed research? 
• How will community members who participate in the implementation of the research be trained and supervised? 
• How have “power” relationships between investigators and community members on the research team, and in subject recruitment strategies been considered to minimize coercion and undue influence? 
• What are the risks and benefits of the research for the community as a whole? 
• How will boundaries between multiple roles (e.g., investigator, counselor, peer) be maintained, i.e., what happens when the investigator/research staff is the friend, peer, service provider, doctor, nurse, social worker, educator, funder, etc.) 
• How will the research outcomes be disseminated to the community? 
• Is there a partnership agreement or memorandum of understanding to be signed by the University of Virginia investigator and community partners that describes how they will work together?

When CBR studies are proposed, the above information will be included in the submission materials. When the IRB reviews CBR studies, it will include, either as members or consultants, individuals with expertise in community-based research.

International (Transnational) Research

The IRB will review all International (transnational) research involving human participants to assure adequate provisions are in place to protect the rights and welfare of the participants.

Approval of research is permitted if “the procedures prescribed by the foreign institution afford protections that are at least equivalent to those provided in 45 CFR 46.”

All policies and procedures that are applied to research conducted domestically should be applied to research conducted in other countries, as appropriate.

For International research, the University of Virginia IRB seeks sufficient knowledge of the local research context by requesting approval for the project from local IRBs or ethics committees (which may or may not be OHRP-registered) and/or local letters of support. The source of this information will depend on the nature of the study, on the country and on the resources available to the investigator. Where there is a local IRB/IEC, University of Virginia IRB must receive the name and FWA# of each local IRB with the IRB submission. The PI will be responsible for obtaining the local IRB approval for each site prior to the enrollment of subjects at that site. The Office of Sponsored Programs will verify the IRB approval is on file prior to signing the sub-contract with each site.

In some circumstances where research may be performed internationally and/or in settings where there are no IRBs, the University of Virginia IRB may, prior to approval of the research, require additional verification and information from people outside the particular research project who are familiar with the customs, practices, or standards of care where the research will be taking place, such as local IRBs or ethics committees, other University of Virginia investigators with knowledge of the region, or a consultant who is an expert on the region.

These individuals may either provide a written review of a particular research plan or attend an IRB meeting to provide the University of Virginia IRB with recommendations based on his or her expertise.

For Federally funded research, approval of research for foreign institutions or sites “engaged” in research is only permitted if the foreign institution or site holds an Assurance with OHRP and local IRB review and approval is obtained.

Approval of research for foreign institutions or sites “not engaged” in research is only permitted if one or more of the following circumstances exist:

• When the foreign institution or site has an established IRB/IEC, the investigator must obtain approval to conduct the research at the "not engaged" site from the site’s IRB/IEC or provide documentation that the site’s IRB/IEC has determined that approval is not necessary for the investigator to conduct the proposed research at the site. 
• When the foreign institution or site does not have an established IRB/IEC, a letter of cooperation must be obtained demonstrating that the appropriate institutional or oversight officials permit the research to be conducted at the performance site. 
• Enrollment of subjects at the foreign institution or site is contingent upon the UVA PI receiving documentation of the performance site’s IRB/IEC determination, or letter of cooperation, as applicable.

IRB Responsibilities 

In addition to standard IRB review, the IRB will consider the following in the review of international research:

1. The investigator and research staff are qualified to conduct research in that country including knowledge of relevant laws, regulations, guidance and customs. 
2. The consent process and consent documents are appropriate for the languages of the subjects and communication with the subject population. Arrangements are considered to communicate with the subjects throughout the study (e.g., to answer questions). 
3. The IRB considers how modifications to the research will be handled. The IRB and investigators should consider as many contingencies (e.g., survey questions) as possible when research is reviewed and approved. 
4. The IRB considers how complaints, non-compliance, protocol/research plan deviations and unanticipated problems involving risks to participants or other are handled. 
5. The IRB considers how post-approval monitoring will be conducted. 
6. The IRB considers if the investigator has obtained the appropriate host country permissions to conduct research (e.g., institutional, governmental or ministerial, IRB, local or tribal). When appropriate, the IRB communicates and coordinates with the local institutions or ethics committees. 
7. The IRB considers mechanisms for communicating with the investigators and research staff when they are conducting the research in other countries.

Investigator Responsibilities

1. It is the responsibility of the University of Virginia investigator and the foreign institution or site to assure that the resources and facilities are appropriate for the nature of the research. 
2. It is the responsibility of the University of Virginia investigator and the foreign institution or site to confirm the qualifications of the investigators and research staff for conducting research in that country(ies). 
3. Investigators obtain all appropriate host country permissions to conduct research (e.g., institutional, governmental or ministerial, IRB, local or tribal). 
4. It is the responsibility of the University of Virginia investigator and the foreign institution or site to ensure that the consent process and consent document are appropriate for the languages of the subjects and communication with the subject population. Arrangements are considered to communicate with the subjects throughout the study (e.g., to answer questions). 
5. It is the responsibility of the University of Virginia investigator and the foreign institution or site to ensure that the following activities will occur. 
   1. Initial review, continuing review, and review of modification 
   2. Post-approval monitoring 
   3. Handling of complaints, non-compliance and unanticipated problems involving risk to subjects or others. 
6. The IRB will not rely on a local ethics committee that does not have policies and procedures for the activities listed above. 
7. Investigators will consider how complaints, non-compliance, protocol/research plan deviations and unanticipated problems involving risks to participants or other are communicated to the IRB. 
8. It is the responsibility of the University of Virginia investigator and the foreign institution or site to notify the IRB promptly if a change in research activities alters the performance site’s engagement in the research (e.g., performance site “not engaged” begins to obtain consent of research participants, etc.). 
9. Investigators cooperate with the IRB regarding how and when post-approval monitoring will be conducted. 
10. Investigators consider mechanisms for communicating with the IRB when they are conducting the research in other countries.

Consent Documents 

The informed consent documents must be in a language understandable to the proposed participants. Therefore, the IRB of Record may review either a document confirming the translation by a certified translator, a back translation of the consent, or review of the consent by an IRB member who is fluent in both languages confirming the accuracy of the translation. Any documents confirming the accuracy of the translation must be placed in the IRB file.

Monitoring of Approved International Research

If the overall PI of the protocol is a UVA faculty or staff member or the PI of the grant, the UVA IRB is responsible for the ongoing review of international research conducted under its jurisdiction in accordance with all applicable federal regulations. The IRB application will include a plan to monitor the study. This may include a plan from the UVA PI to monitor the study, monitoring to be performed by an outside sponsor or confirmation of a post approval monitoring plan from the research site. A summary of the monitoring activities will be submitted with the continuation status report.

Research Involving Data and/or Biological Specimens Overview

Storing data and/ or biological specimens for research and the use of data and/or biological specimens in research may require IRB approval (or exemption) and informed consent for any of the following: 

• Data and/or biological specimens collected for research purposes 
• Data and/or specimens collected, stored, and/or distributed for future research uses 
• Previously collected data/specimens used for secondary research.

Definitions 

Anonymous: Unidentified (i.e., personally identifiable information was not collected, or if collected, identifiers were not retained and cannot be retrieved); information or materials (e.g., data or specimens) that cannot be linked directly or indirectly by anyone to their source(s). 

Coded: Direct personal identifiers have been removed (e.g., from data or specimens) and replaced with words, letters, figures, symbols, or a combination of these (not derived from or related to the personal information) for purposes of protecting the identity of the source(s); but the original identifiers are retained in such a way that they can be traced back to the source(s) by someone with the code. Note: A code is sometimes also referred to as a “key,” “link,” or “map.” 

De-identified: All direct personal identifiers are permanently removed (e.g., from data or specimens), no code or key exists to link the information or materials to their original source(s), and the remaining information cannot reasonably be used by anyone to identify the source(s). Note: For purposes of HRPP SOP, protected health information (PHI) is de- identified when it does not contain any of the 18 identifiers specified by the Health Insurance Portability and Accountability Act (HIPAA) at 45 CFR Part 164 or has been determined to be de-identified by a statistician in accordance with the standards established by the Privacy Rule. 

Repository: Also: bank, database. Collection of data and/or specimens obtained and stored for future research uses and/or distribution, including a collection not originally or primarily obtained for research purposes. 

Specimen: Also: sample. Human biological material includes sub-cellular components such as DNS or RNA, Gametes (e.g., ova and sperm), embryos and fetal tissue, breast milk, exhaled air, including solid material (e.g., tissue, organs), body products (e.g., teeth, hair, nail clippings , sweat, urine, feces, saliva, semen, cerebrospinal fluid), blood and blood fractions (e.g. plasma, serum, buffy coat, red blood cells) and cells. Exceptions include organisms, such as bacteria and viruses isolated from human specimens are not human biological specimens 

Leftover/Remnant Specimen: Remaining portion of a specimen obtained for clinical purposes that is no longer needed for its original purpose and that would otherwise be discarded. 

Secondary Research: Study of existing information or materials (e.g., data or specimens) that have been previously collected for a purpose (including non-research purposes) other than the currently proposed activity.

General Information 

Prospective collection of data and/or specimens for research purposes (e.g., additional questions added to routine surveys being performed for non-research purposes, an extra tube of blood taken at the time of clinical blood drawing, etc.) is “research involving human subjects,” and IRB review and approval is required. Informed consent (and HIPAA authorization for data that include PHI) must also be obtained.

Collection and storage of data and/or specimens for future research uses and/or distribution (i.e., rather than using data/specimens only for pre-defined analyses as described in a specific IRB-approved protocol) are activities that meet the definition of “research involving human subjects;” and IRB review and approval is required (see “Repositories – Collection, Storage, and/or Distribution of Data/Specimens” below). Informed consent (and HIPAA authorization for data that include PHI) is also required.

When the data and/or specimens to be stored for future research uses are generated as part of another research study (e.g., clinical trial), a separate protocol describing repository activities must generally be submitted for IRB review and approval before the protocol that collected the data and/or specimens is closed, unless the bank is externally controlled (see “Repositories – Collection, Storage, and/or Distribution of Data/Specimens” below). Note: Sponsor-mandated data sharing may not require a stand-alone repository submission.

In some cases, secondary uses of previously collected data and/or specimens meet the definition of “research involving human subjects,” and IRB approval or exemption is required (see “Secondary Uses of Previously Collected Data/Specimens” below).

Certain activities involving data and/or specimens do not meet the definition of “research involving human subjects” and do not require IRB approval or exemption, as described below.

Activities That Are Not Human Subjects Research

Laboratory research with commercially available tissue specimens, cell lines, or other human cells does not meet the definition of “research involving human subjects” and may be performed without IRB approval or exemption as long as the work is not FDA-regulated (see “Research Subject to FDA Regulations” below).

Research with autopsy specimens does not meet the definition of “research involving human subjects” and may be performed without IRB approval or exemption. Research involving decedents’ PHI is subject to HIPAA regulations. HIPAA authorization (or waiver) is generally not required for use or disclosure of PHI for research involving decedents only, with appropriate representations from the researcher. For more information, contact the UVA Health System Privacy Officer at 434-924-5024.

Research with previously collected anonymous (see “Definitions” above) data and/or specimens does not meet the definition of “research involving human subjects” and may be performed without IRB approval or exemption only when the data/specimens to be studied were not collected specifically for the current research. Note: An investigator may not de-identify data and/or specimens under his or her control (e.g., data collected by the investigator for another study) for future research uses without IRB review.

Research with previously collected coded data and/or specimens does not meet the definition of “research involving human subjects” and may be performed without IRB approval or exemption only when all the following conditions are met:

• The data and/or specimens to be studied were not collected specifically for the current research.
• Investigator(s) cannot “readily ascertain” the identity of the source(s) of the coded data or specimens because one or more of the conditions below is met: • The investigators and the holder of the “key” enter into an agreement prohibiting the release of the key to the investigators under any circumstances (until the source individuals are deceased). 
• IRB-approved written policies and procedures for the repository or data coordinating center prohibit the release of the key to the investigators under any circumstances (until the source individuals are deceased).

Research with leftover specimens does not meet the definition of “research involving human subjects” and may be performed without IRB approval or exemption only when their use meets the conditions for anonymous or coded specimens above. Note: An investigator may not de-identify data and/or specimens under his or her control (e.g., specimens generated by the investigator from a clinical procedure) for future research uses without IRB review.

The research uses of previously collected data and/or specimens described above may be defined as “research involving human subjects” under FDA regulations and may require IRB approval and participant informed consent, depending on the nature of the research (see “Research Subject to FDA Regulations” below).

Exempt Research

Research involving existing data and/or specimens is exempt when all the following conditions are met: 

• All data and/or specimens are available, or “on the shelf,” at the time the research is submitted for an exempt determination. 
• The sources of the data and/or specimens are publicly available, or the information is recorded by the investigator in a way that participants cannot be identified, directly or through identifiers linked to the participants. 
• The research is not subject to FDA regulations.

Note: An investigator may not de-identify data and/or specimens under his or her control (e.g., data collected by the investigator for another purpose or study) for future research uses without IRB review.

Prospective collection of biological specimens is not exempt from IRB review. Prospective data collection may be exempt in certain cases (e.g., some research qualifying under exempt category #1), depending on the nature of the data and population from whom the information is collected (for more information see Section 6).

Secondary Uses of Previously Collected Data/Specimens

IRB approval or exemption is required for secondary research uses of previously collected data and/or biological specimens, unless only anonymous or coded data/specimens are used as described above (see “Activities That Are Not Human Subjects Research”).

Secondary research uses of non-research collections of data/specimens (e.g., data or specimens that are retained for purposes other than research, such as clinical or educational records, archived pathology specimens, etc.) require IRB approval or exemption, as such collections have not been established as repositories with IRB-approved procedures for releasing materials that consider human subjects protection requirements.

Secondary (i.e., “new”) uses of data/specimens obtained for primary research purposes by an investigator with IRB approval (or exemption) require IRB review of an amendment or a new protocol describing the proposed secondary use, depending on the previous approval (or exemption) and the new research objective(s). Informed consent may also be required for this new use (as described below), depending on the scope of the original consent and the newly proposed research.

Research using previously collected data and/or specimens must be consistent with the scope and terms described in the original informed consent process/document, as applicable. If consent was not obtained (e.g., data/specimens obtained for non-research purposes) or the original consent does not adequately include the proposed secondary use, specific informed consent for the new research may be required. De-identification or coding of data/specimens should not be used as a means for circumventing the original terms of consent. Except in unusual circumstances, informed consent is required when identifiable data and/or specimens are used.

Informed consent (and HIPAA authorization, when applicable) can be waived by the IRB for minimal risk non-exempt research with previously collected data and/or specimens when the research meets the regulatory criteria for waiver (see “Informed Consent Requirements” below).

Protocols for using previously collected data and/or biological specimens for research purposes should include the following information, as applicable: 

• Purpose of using data/specimens 
• Type(s) of data/specimens to be studied 
• Source(s) and circumstances under which the data/specimens were collected 
• State of the data/specimens to be obtained (i.e., identifiable or coded) 
• If the data include individually identifiable protected health information 
• Whether informed consent (and HIPAA authorization, when applicable) was obtained for collection and future use of data/specimens 
• Physical location/equipment and security provisions for data/specimen storage
• Plan for destruction or de-identification of identifiable or coded data/specimens at the end of the retention period.

Investigators may not share data and/or specimens with collaborators (internal or external to UVA) for secondary research purposes without IRB approval. Distribution of data and/or specimens for secondary research uses beyond a single transfer described in a specific IRB- approved protocol generally requires approval for a repository (see “Repositories – Collection, Storage, and/or Distribution of Data/Specimens” below).

Confidential disclosure agreements (CDAs), data use agreements (DUAs), or material transfer agreements (MTAs) may be required for sharing research data or specimens with non-UVA collaborators. For more information and signatory authority, see or contact the UVA OSP office or the School of Medicine Grants and Contracts Office if within the School of Medicine.

Access to and/or use of identifiable patient information from medical records or clinical databases for research purposes must comply with the requirements of the HIPAA Privacy and Security Rules and university policy (e.g., University Hospital Policy 09-11: Use of Patient Information by Hospitals and Medical Staff). For more information, contact the UVA Health System Privacy Officer at 434-924-5024.

The proposed use of student education records in research must comply with the requirements of the Family Educational Rights and Privacy Act (FERPA). For information about the release of student records at UVA, see Privacy and Release of Student Education Records or contact the Office of the IRB for Social & Behavioral Research at 434-243-2915 or the Office of the University Registrar at 434-924-4122.

Repositories – Collection, Storage, and/or Distribution of Data/Specimens

Data and specimen repositories/banks may range from materials held by a single investigator in his/her office or laboratory to large networks with central coordinating centers. Although the size, purpose, types of information and materials stored, and populations from whom the data/specimens are collected may also vary widely, creating a data and/or specimen bank for future research purposes (i.e., rather than using data/specimens only for pre-defined analyses as described in a specific IRB-approved protocol) is defined as “research involving human subjects;” and IRB review and approval is required.

Informed consent is required for collection of data and/or biological specimens to be stored for future research (see “Informed Consent Requirements” below). HIPAA authorization is also required when the data includes protected health information.

Banking should be understood as the collection and storage of biological samples for future undefined research.

Caution should be taken when requiring participants to agree to the banking of their tissue for future undefined research or for research unrelated to the study at hand as a condition for entry into a trial that offers the potential participant the prospect of some direct benefit. Mandatory banking may be more acceptable if the type of future research will be related to disease process under study.

The final determination as to whether the proposed mandatory banking for future unrelated research is acceptable will be made by the IRB on a case-by-case basis.

Protocols for creating data and/or biological specimen repositories for research purposes should include the following information, as applicable: 

• Purpose of collecting and storing data/specimens 
• Type(s) of data/specimens to be collected and stored 
• Source(s) and circumstances of data/specimen collection (i.e., obtained directly from participants or from a secondary source) 
• How the data/specimens will be stored (i.e., identifiable, coded, or de-identified) 
• If the data include individually identifiable protected health information 
• Physical location/equipment and security provisions for data/specimen storage
• Length of time data/specimens will be stored 
• Any limits on data/specimens’ intended future use (e.g., for cancer research only) 
• With whom data/specimens may be shared (including non- UVA researchers) Process for requesting and releasing data/specimens 
• How data/specimens will be released (i.e., identifiable, coded, or de-identified) 
• Procedures to withdraw participants’ data/specimens from future research 
• Plan for continuing repository operations in the absence (or departure) of the principal investigator 
• Process for destruction or de-identification of identifiable or coded data/specimens at the end of the retention period.

Consideration should be given to obtaining a National Institutes of Health (NIH) Certificate of Confidentiality to protect the confidentiality of banked identifiable or coded data/specimens. Certificates of Confidentiality are intended to protect information that, if disclosed, could have adverse consequences for research participants or damage their financial standing, employability, insurability, or reputation. Examples include information about the following:

• Sexual or gender preferences or practices, 
• Misuse of alcohol, drugs, or other addictive products, 
• Illegal conduct 
• Sensitive information pertaining to mental illness, 
• Sensitive genetic information.

For more information about Certificates of Confidentiality, see Section 25.4.

Methods for handling and storing data (including the use of personal computers and portable storage devices) must comply with university policies. Restricted data, including protected health information, must be encrypted if stored or used on portable devices, if removed from a secure university location, or if electronically transmitted. For more information, see the UVA Electronic Data Removal Policy and UVA Electronic Storage of Highly Sensitive Data Policy.

Investigators and IRBs should consider when research involving the collection and storage of personally identifiable information (i.e., information that can be used to distinguish an individual’s identity, such as name, social security number, date of birth, etc., or information linked to an individual, such as medical, financial, or employment information) might expose research participants to the risk of fraud or identity theft. This is especially important in research linked to “fee-for-service” activities, where federal financial regulations for protecting consumers against identity theft may apply. In such cases, plans for handling and storing personally identifiable information must comply with university policy and Federal Trade Commission rules. For more information, see the UVa Data Protection Standards.

Medical Center Policy stipulates that unless specifically exempted from evaluation by the Operating Room Committee, all human tissue and objects/ devices obtained by surgical procedure, traumatic excision, or disease associated sequelae (e.g., vascular auto- amputation) from a patient in any area of the Medical Center, including the Main Operating room, the Outpatient Surgery Center, ambulatory clinics, the Emergency Department, and any procedural area shall be sent to the University of Virginia Department of Pathology for evaluation prior to any substantive treatment, including but not limited to, surgical procedures or radiation therapy. The Operating Room Committee does exempt the requirement for pathology examination of diagnostic surgical tissue/specimens prior to collection of these materials for research purposes if the subject has signed consent.

Informed Consent Requirements

Informed consent must be obtained for collection and storage of data and/or biological specimens for future research and should generally be obtained separately from consent to other research participation. HIPAA authorization is also required when the data include protected health information.

Investigators and IRBs should balance the ethical obligation to provide sufficient information regarding possible future research uses of stored data and/or specimens during the consent process for banking with the practical issues of trying to anticipate and describe all possible research uses of these materials. However, the consent process for collecting and banking data and/or specimens should be as specific as possible regarding the circumstances and any risks associated with data/specimen collection, as well as the procedures for maintaining the security and confidentiality of the stored materials.

In addition to the required elements of informed consent, the consent process should include the following information, as applicable: 

• Description of the data/specimens to be collected and how they will be obtained 
• Any risks associated with obtaining the data/specimens 
• How the data/specimens will be used (to the extent known) • Any limits on data/specimens’ intended future use (e.g., for cancer research only) 
• Whether any identifying information will be retained, and if so, how it will be stored 
• Certificate of Confidentiality information (when a Certificate is obtained) 
• Description of the repository, including physical location, security procedures, etc. 
• Who will have access to the data/specimens 
• How long the data/specimens will be stored 
• With whom data/specimens may be shared (including non-UVA researchers) 
• How to withdraw data/specimens from future research 
• Whether or not participants may be re-contacted in the future (e.g., for consent to future research, to return research results, etc.).

HIPAA allows UVA to provide identifiable patient data or specimens (PHI) to a sponsor/granter (with appropriate consent/authorization or waiver) in return for payments in the form of grants or contracts for UVA to perform research activities, because any provision of PHI to the sponsor/granter is a byproduct of the service being provided to the sponsor/granter. However, a disclosure of PHI to an outside entity where no research is being performed by UVA in exchange for the payment would be considered a “sale of PHI,” for which UVA must have a signed authorization from the patient that discloses the payment, unless the payment is only a reasonable cost-based fee to cover the cost to prepare and transmit the data and the PHI consists only of a “Limited Data Set” covered by a Data Use Agreement or is provided under a waiver of authorization granted by an IRB. For questions, contact the UVA Office of University Counsel at 434-924-3586.

When identifiable specimens and/or genetic information are stored and may be released for future research, the consent process/document should also include language describing the protections provided by the Genetic Information Nondiscrimination Act. For specific language, see the consent form templates from Protocol Builder.

The informed consent process/document must not include any exculpatory language through which subjects are made to waive or appear to waive any legal rights regarding the collection or use of their data and/or specimens.

Research using previously banked data and/or specimens should be consistent with the scope and terms described in the original informed consent process/document, as applicable. If consent was not obtained (e.g., data/specimens obtained for non-research purposes) or the original consent does not adequately include the proposed secondary use, specific informed consent for the new research may be required. Except in unusual circumstances, informed consent is required when identifiable data and/or specimens are used.

Informed consent (and HIPAA authorization, when applicable) can be waived by the IRB for minimal risk non-exempt research with previously collected data and/or specimens when the research meets the regulatory criteria for waiver. Waiver of HIPAA authorization can also be granted (when applicable) by the Privacy Board for secondary uses of existing data and/or specimens in exempt research. For more information on waiver of informed consent, see HRPP SOP sections 11.9: Waiver of Informed Consent and 23: Health Insurance Portability and Accountability Act (HIPAA).

Research Subject to FDA Regulations

Activities involving data and/or specimens that do not require IRB approval under DHHS regulations (see “Activities That Are Not Human Subjects Research” above) must still receive IRB approval if the activities are subject to FDA regulations (e.g., involving FDA- regulated products or submission of data/results to FDA). Activities with data and/or specimens defined by FDA as “research involving human subjects” include testing of in vitro diagnostic devices using biological specimens and the use of clinical data for historical “controls” in investigational drug studies.

FDA regulations do not permit waivers of the informed consent requirements in research, except for emergencies (i.e., emergency use of a test article or emergency research) or in certain types of military research. However, under specific circumstances in vitro diagnostic device studies may be performed with biological specimens without informed consent, as described below.

FDA intends to exercise “enforcement discretion” regarding the requirements for informed consent in an in vitro diagnostic device study involving biological specimens when all the following criteria are met: 

• The study meets the IDE exemption criteria 
• The study uses leftover/remnant specimens, specimens obtained from repositories, or unused specimens that were previously collected for other research purposes 
• The specimens are not individually identifiable 
• Clinical information accompanying the specimens does not make the specimen source identifiable Individuals caring for the patients from whom the specimens were obtained do not share information with the investigator(s) 
• Specimens are provided to the investigator(s) without identifiers, and the supplier has established policies to prevent the release of personal information 
• The study has been reviewed and approved by an IRB.

For more information see the FDA’s document titled, “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable.”

Applicable Regulations/Guidance

• FDA “Guidance on Informed Consent for In Vitro Diagnostic Device Studies Using Leftover Human Specimens that are Not Individually Identifiable” (04/25/06); 
• National Bioethics Advisory Commission “Research Involving Human Biological Materials: Ethical Issues and Policy Guidance” (08/99); 
• NIH “Research Repositories, Databases, and the HIPAA Privacy Rule” (07/02/04); 
• OHRP “Guidance on Research Using Coded Private Information or Specimens” (10/16/08); 
• OHRP “Guidance on the Genetic Information Nondiscrimination Act: Implications for Investigators and Institutional Review Boards” (03/24/09); 
• OHRP “Issues to Consider in the Research Use of Stored Data or Tissues” (11/07/97); 
• “Report of the Public Responsibility in Medicine and Research (PRIM&R) Human Tissue/Specimen Banking Working Group” (03/07); 
• The Secretary’s Advisory Committee on Human Research Protections (SACHRP) “FAQs ,Terms, and Recommendations on Informed Consent and Research Use of Biospecimens” (07/20/11)

Certificates of Confidentiality (COC)

Certificates of Confidentiality are issued by the National Institutes of Health (NIH) or the Food and Drug Administration (FDA) to protect identifiable research information from forced disclosure. Researchers will need to apply for a COC for non-federally funded research.

Research being conducted under an IND or IDE should submit an application to the FDA for the COC. A study funded as a whole or in part by the NIH is automatically covered by a certificate of confidentiality and involves identifiable, sensitive information.

The application for a study that is not funded by the NIH or being conducted under an IND or IDE should be submitted to the NIH. The following are examples of research that is automatically covered by a COC: 

• Biomedical, behavioral, clinical or other research, including exempt research, except where the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects. 
• The collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual. 
• The generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified, or the identity of the human subjects can readily be ascertained. 
• Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual.

A COC will allow the investigator and others who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. A COC does not protect against voluntary disclosures by the investigator, but those disclosures must be specified in the informed consent form. An investigator may not use the COC to withhold data if the participant consents in writing to the disclosure.

If a study has a COC, researchers:

• May not disclose or provide, in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding, the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, unless such disclosure or use is made with the consent of the individual to whom the information, document, or biospecimen pertains; or 
• May not disclose or provide to any other person not connected with the research the name of such an individual or any information, document, or biospecimen that contains identifiable, sensitive information about such an individual and that was created or compiled for purposes of the research. 
• May disclose information only when: 
  • Required by federal, state, or local laws (e.g., as required by the Federal Food, Drug, and Cosmetic Act, or state laws requiring the reporting of communicable diseases to state and local health departments), excluding instances of disclosure in any federal, state, or local civil, criminal, administrative, legislative, or other proceeding. 
  • Necessary for the medical treatment of the individual to whom the information, document, or biospecimen pertains and made with the consent of such individual. 
  • Made with the consent of the individual to whom the information, document, or biospecimen pertains; or 
  • Made for the purposes of other scientific research that is in compliance with applicable federal regulations governing the protection of human subjects in research. 
• Written materials require that when research is covered by a certificate of confidentiality, researchers must inform subjects (for example, in the consent document) of the protections and limitations of certificates of confidentiality: 
• For studies that were previously issued a Certificate, and subjects were notified of the protections provided by that Certificate, NIH does not expect subjects to be notified that the protections afforded by the Certificate have changed, although IRBs may determine whether it is appropriate to inform subjects. 
• If part of the study cohort was recruited prior to issuance of the Certificate, but are no longer actively participating in the study, NIH does not expect subjects consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that subjects who were previously consented to be re-contacted to be informed of the Certificate, although IRBs may determine whether it is appropriate to inform subjects.

Statutory Basis for Protection

Protection against compelled disclosure of identifying information about subjects of biomedical, behavioral, clinical, and other research is provided by the Public Health Service Act §301(d), 42 U.S.C. §241(d):

"The Secretary may authorize persons engaged in biomedical, behavioral, clinical, or other research (including research on mental health, including research on the use and effect of alcohol and other psychoactive drugs) to protect the privacy of individuals who are the subject of such research by withholding from all persons not connected with the conduct of such research the names or other identifying characteristics of such individuals. Persons so authorized to protect the privacy of such individuals may not be compelled in any Federal, State or local civil, criminal, administrative, legislative, or other proceedings to identify such individuals."

Usage

Certificates of Confidentiality (COC) may be granted for studies collecting information that, if disclosed, could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation. By protecting investigators and institutions from being compelled to disclose information that would identify research subjects, COCs help achieve the research objectives and promote participation in studies by assuring confidentiality and privacy to subjects.

Any investigator engaged in research in which sensitive information is gathered from human subjects (or any person who intends to engage in such research) may apply for a COC. Research can be considered "sensitive" if it involves the collection of:

• Research on HIV, AIDS, and STDs; 
• Information about sexual attitudes, preferences, practices; 
• Information about personal use of alcohol, drugs, or other addictive products; 
• Information about illegal conduct; Information that could damage an individual's financial standing, employability, or reputation within the community; 
• Information in a subject's medical record that could lead to social stigmatization or discrimination; or 
• Information about a subject's psychological well‐being or mental health. 
• Genetic studies, including those that collect and store biological samples for future use; 
• Research on behavioral interventions and epidemiologic studies.

This list is not exhaustive. Investigators contemplating research on a topic that might qualify as sensitive should contact the IRB Office for help in applying for a COC.

Per NIH Grants Policy Statement the NIH considers research in which identifiable, sensitive information is collected or used, to include:

• Human subjects research as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46), including exempt research except for human subjects research that is determined to be exempt from all or some of the requirements of 45 CFR 46 if the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects; 
• Research involving the collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual; 
• Research that involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of the human subjects can readily be ascertained as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46); or 
• Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual, as defined in subsection 301(d) of the Public Health Service Act. 

In the consent process and form, investigators should tell research subjects that a COC is in effect. Subjects should be given a fair and clear explanation of the protection that it affords, including the limitations and exceptions noted above. Every research project that includes human research subjects should explain how identifiable information will be used or disclosed, regardless of whether or not a COC is in effect.

Limitations

The protection offered by a Certificate of Confidentiality (COC) is not absolute. A COC protects research subjects only from legally compelled disclosure of their identity. It does not restrict voluntary disclosures by subjects or investigators.

For example, a COC does not prevent investigators from voluntarily disclosing to appropriate authorities such matters as child abuse, a subject's threatened violence to self or others, or from reporting a communicable disease. However, if investigators intend to make such disclosures, this should be clearly stated in the consent process and the form which research subjects are asked to sign.

In addition, a Certificate of Confidentiality does not authorize the person to whom it is issued to refuse to reveal the name or other identifying characteristics of a research subject if 

• The subject (or, if he or she is legally incompetent, his or her legal guardian) consents, in writing, to the disclosure of such information; 
• Authorized personnel of the Department of Health and Human Services (DHHS) request such information for audit or program evaluation, or for investigation of DHHS grantees or contractors and their employees; or 
• Release of such information is required by the federal Food, Drug, and Cosmetic Act or regulations implementing that Act.

Application Procedures

Any person engaged in research collecting sensitive information from human research subjects may apply for a Certificate of Confidentiality (COC). For most research, a COC is obtained from NIH. If NIH funds the research project, the investigator may apply through the funding Institute. However, even if the research is not supported with NIH funding, the investigator may apply for a COC through the NIH Institute or Center funding research in a scientific area similar to the project.

If the research is conducting a sensitive research project that is covered by the Agency for Healthcare Research and Quality (AHRQ) confidentiality statute (42 U.S.C. section299a-1(c) entitled “Limitation on Use of Certain Information”) or the Department of Justice (DoJ) confidentiality statute (42USC section 3789g), then a COC is not required. 

If there is an Investigational New Drug Application (IND) or an Investigational Device Exemption (IDE), the sponsor can request a COC from the FDA. 

For more information, see the NIH Certificates of Confidentiality Kiosk website.

Mandatory Reporting

While any person may make a report if they have reasonable cause to believe that a child or elder was abused or neglected, Virginia law mandates that certain persons who suspect child or elder (60 or older) or incapacitated adult abuse or neglect report this to the Department of Social Services in the locality in which the child or elder/incapacitated adult lives or where the alleged abuse has occurred. Those designated by law as “mandated reporters” of child abuse or neglect include any person employed by a public or private institution of higher education, any person licensed, certified or registered by Virginia’s health regulatory boards, any professional staff person employed by the Medical Center or another hospital, and certified emergency medical services personnel.

Those designated by law as mandated reporters of elder/incapacitated abuse or neglect include any person licensed, certified or registered by Virginia’s health regulatory boards, any mental health services provider whether that individual is licensed or certified, certified emergency medical services personnel and any person working with adults in an administrative, supportive or direct care capacity. University of Virginia policy requires the solicitation of informed consent from all adult research subjects and, where appropriate, assent from children involved as research subjects, in addition to the permission of their parents. In situations where conditions of abuse or neglect might be revealed, mandated reporters should make themselves known to parents of children under age 18, to subjects who are children, and to subjects who are potential victims of abuse or neglect.

Children: 

• § 63.2-1509. Requirements that certain injuries to children be reported by physicians, nurses, teachers, etc.; penalty for failure to report
• § 63.2-1606. Protection of aged or incapacitated adults; mandated and voluntary reporting.
• § 63.2-1603 Protection of adults; definitions.

The UVA Medical Center policy on abuse and neglect reporting may be found here.

Investigators should consult these sources to determine if potential subjects should be advised of mandatory reporting requirements during the informed consent process.

University of Virginia Students and Employees as Subjects

When University of Virginia students and/or employees are being recruited as potential subjects, investigators must ensure that there are additional safeguards for these subjects. The voluntary nature of their participation must be primary and without undue influence on their decision. Investigators must emphasize to subjects that neither their academic status or grades, or their employment, will be affected by their participation decision.

To minimize coercion, investigators should avoid direct recruiting, whenever possible, students currently enrolled in a course that they teach, students or employees that they supervise in procedures which are neither therapeutic nor diagnostic. In these latter situations, investigators should solicit subjects through means such as bulletin board notices, flyers, advertisements in newspapers, and announcements in classes or laboratories other than their own. When entering a classroom to recruit students and conduct research, e.g., administer a survey, investigators must do so at the end of the class period to allow non-participating students the option of leaving the classroom, thereby alleviating pressure to participate.

The University of Virginia allows for the creation of participant pools. Participant pools are a convenient way for researchers to access individuals (generally students) who are ready to participate in research. Student participants are generally organized around a particular discipline and help to facilitate students’ access to research as part of their educational experience. It is acceptable to offer course credit for participating, but researchers are required to offer other opportunities to earn equivalent course credit. Researchers accessing students through a participant pool should offer educational insight to the student participating in their research.

Student Research

Human Subject Research and Course Projects

Learning how to conduct ethical human subject research is an important part of a student’s educational experience. Research activities that are designed as part of a course requirement for purposes of learning experience only and are not “designed to develop or contribute to generalizable knowledge” may not require IRB review and approval if all of the following conditions are true:

• Results of the research are viewed only by the course instructor for teaching purposes and discussed within the classroom for teaching and learning purposes. 
• Results of the research are not made public through presentation (outside of the classroom) and are not published in paper or electronic format (e.g., cannot be made available on the internet, cannot be published in a journal, etc.). 
• Research procedures are no more than minimal risk. 
• Vulnerable populations are not targeted (e.g., children under age 18, prisoners, persons who are cognitively impaired, etc.). 
• Data collected are recorded in such a manner that the subjects are not identifiable (images in videotapes and photographs and voices on audiotape are identifiable). 
• When appropriate, an informed consent process is in place.

Responsibility of the Course Instructor

The course instructor is responsible for communicating to the students the ethics of human subject research, for ensuring the protection of human subjects (including a process is in place for obtaining voluntary informed consent from research subjects when appropriate), and for monitoring the students’ progress. When designing a project, students should be instructed on the ethical conduct of research and on the preparation of the IRB application when such is required. In particular, instructors and students should:

• Understand the elements of informed consent; 
• Develop appropriate consent documents or processes; 
• Plan appropriate strategies for recruiting subjects; 
• Identify and minimize potential risks to subjects; Assess the risk-benefit ratio for the project; 
• Establish and maintain strict guidelines for protecting privacy and confidentiality, and 
• Allow sufficient time for IRB review (if necessary) and completion of the project.

In making a determination of whether or not a class research project requires IRB review, the instructor is encouraged to contact the IRB office for assistance.

Individual Research Projects Conducted by Students

Independent study projects, senior theses, undergraduate research projects, Masters and advanced degree research, and similar exercises must be independently submitted for IRB review if they meet the definition of human subject research requiring IRB review. It is important to keep in mind that any human subject research activity that will ultimately contribute to part or all of a thesis, dissertation, or other type of publication or presentation must go through the IRB review process prior to enrolling subjects and collecting data. IRB review/approval cannot occur after a study has begun. Students and advisors should contact the IRB Office with any questions.

Independent Study, Theses and Dissertations

These research activities are considered to meet the federal definition of human subject research and must be independently submitted to the IRB by the student-investigator. However, when students conduct research as part of a course of study, a faculty member ultimately is responsible for the protection of the subjects, even if the student is the primary investigator and actually directs the project. The faculty adviser assumes the responsibility for students engaged in independent research, and instructors are responsible for research that is conducted as part of a course. Students may serve as the principal investigator for social, behavioral or education research as long as they are able to secure a faculty advisor with expertise in their area of study.

Department of Education

Research funded through the Department of Education must comply with additional regulatory requirements under 34 CFR 98.3, 34 CFR 98.4, 34 CFR 99, 34 CFR 356.3

The Protection of Pupil Rights Amendment (PPRA) and the Family Educational Rights and Privacy Act (FERPA)

Protection of Pupil Rights Amendment (PPRA)

The Protection of Pupil Rights Amendment (PPRA) (20 U.S.C. § 1232h; 34 CFR Part 98) applies to programs that receive funding from the U.S. Department of Education (ED). PPRA is intended to protect the rights of parents and students.

No student shall be required, as part of any research project, to submit without prior consent (parental permission and assent) to surveys, psychiatric examination, testing, or treatment, or psychological examination, testing, or treatment, in which the primary purpose is to reveal information concerning one or more of the following:

• Political affiliations 
• Mental and psychological problems potentially embarrassing to the student or his or her family 
• Sex behaviors and attitudes 
• Illegal, anti-social, self-incriminating and demeaning behavior 
• Critical appraisals of other individuals with whom the student has close family relationships 
• Legally recognized privileged & analogous relationships, such as those of lawyers, physicians & ministers 
• Religious practices, affiliations, or beliefs of the student or student’s parent 
• Income, other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under a program

Prior consent means: 

• Prior consent of the student, if the student is an adult (age 18 or older) or emancipated through a court order 
• Prior written consent (permission) of the parent or legal guardian, if the student is an un-emancipated minor.

The University of Virginia IRB does not consider waivers under PPRA.

PPRA also requires parental notification and the opportunity to opt their child out of any non- emergency, invasive physical exam or screening required as a condition of attendance, administered by the school or its agent, and not necessary to protect the immediate health and safety of the student. There is an exception for State mandated exams.

For certain research not directly funded by the ED and conducted in a school that receives funding from the ED:

The IRB must verify compliance with the ED regulations that schools are required to develop and adopt policies in conjunction with parents regarding the following:

• The right of a parent of a student to inspect, upon the request of the parent, a survey created by a third party before the survey is administered or distributed by a school to a student including any applicable procedures for granting a request by a parent for reasonable access to such survey within a reasonable period of time after the request is received. 
• Arrangements to protect student privacy that are provided by the agency in the event of the administration or distribution of a survey to a student containing one or more of the topics covered under PPRA. 
• The right of a parent of a student to inspect, upon the request of the parent, any instructional material used as part of the educational curriculum for the student. 
• Any applicable procedures for granting a request by a parent for reasonable access to instructional material received. 
• The administration of physical examinations or screenings that the school or agency may administer to a student. 
• The collection, disclosure, or use of personal information collected from students for the purpose of marketing or for selling that information (or otherwise providing that information to others for that purpose), including arrangements to protect student privacy that are provided by the agency in the event of such collection, disclosure, or use. 
• The right of a parent of a student to inspect, upon the request of the parent, any instrument used in the collection of personal information before the instrument is administered or distributed to a student. 
• Any applicable procedures for granting a request by a parent for reasonable access to such instrument within a reasonable period of time after the request is received.

PPRA also requires parental notification and the opportunity to opt their child out of any non- emergency, invasive physical exam or screening required as a condition of attendance, administered by the school or its agent, and not necessary to protect the immediate health and safety of the student. There is an exception for State mandated exams.

Family Education Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students.”

Definitions

Research or experimentation program or project means any program or project in any research that is designed to explore or develop new or unproven teaching methods or techniques.

Children are persons enrolled in research not above the elementary or secondary education level, who have not reached the age or majority as determined under state law.

Conditions for Which Student Records Can Be Disclosed without Consent for Research Purposes

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.

For research purposes, FERPA allows schools to disclose students’ educational records, without consent, to the following parties or under the following conditions (34 CFR § 99.31), 

• The Researcher will receive a completely de-identified data set from the educational institution. Personal identifiers include: 
  • Student’s name and other direct personal identifiers, such as the student’s social security number or student number. 
  • Indirect identifiers, such as the name of the student’s parent or other family members; the student’s or family’s address, and personal characteristics or other information that would make the student’s identity easily traceable; date and place of birth and mother’s maiden name. 
  • Biometric records, including one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, including fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting. 
  • Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. 
• An educational agency or institution may disclose personally identifiable information from an education record of a student without consent if the disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to: 
  • Develop, validate, or administer predictive tests.
  •  Administer student aid programs. 
  • Improve instruction. 
• A school district or post-secondary institution that uses this exception is required to enter into a written agreement with the organization or researcher conducting the research that specifies: 
  • The determination of the exception. 
  • The purpose, scope, and duration of the study.
  • The information to be disclosed. 
  • That information from education records may only be used to meet the purposes of the study stated in the written agreement and must contain the current requirements in 34 CFR 99.31(a)(6) on re-disclosure and destruction of information. 
  • That the study will be conducted in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests. 
  • That the organization is required to destroy or return all personally identifiable information when no longer needed for the purposes of the study. 
  • The time period during which the organization must either destroy or return the information.

Requests for Waivers of Consent

It is important that researchers apply FERPA and human subject protection regulations when accessing educational records. Generally, FERPA and IRB requirements are met if a student or parent signs a consent form to participate in a study and authorizes release of his/her educational records for research purposes.

Research on University of Virginia Student Records

If records are being requested from the University of Virginia, the researcher must secure the appropriate approvals from the University Registrar, the Office of Institutional Research and Analytics, or Student Health. This permission must be attached be submitted with the IRB protocol application. The University Registrar or the Office of Institutional Research and Analytics will make the final determination if the study meets the FERPA criteria to release educational information without a signed consent form.

Research on Student Records at Institutions other than the University of Virginia

Where researchers are conducting a study on behalf of the school district or other educational institution or setting to improve instruction or to develop or validate a predictive test, the school district may provide FERPA protected records without consent under specific conditions and pursuant to a written agreement between the school district and the researcher. If researchers are proposing to access student records at institutions other than the University of Virginia, utilizing a waiver of consent then the researchers should contact that institution and follow that institution’s FERPA policy.

Researchers must provide the school district with a copy of their research proposal outlining all research procedures. Written permission must be secured by the researcher from the proper authority such as the District Superintendent or Head of School. This permission must be uploaded with the IRB protocol application.

Additional considerations include: 

• In accordance with FERPA, an educational institution has the authority to determine what information may be accessed from an educational record. If an institution denies an investigator access to information in an educational record, the IRB cannot overrule the decision. 
• According to the IRB federal regulations, for non-exempt studies, an IRB cannot waive informed consent or documentation of informed consent unless specific conditions are met. Consequently, researchers should include rationale for waiver requests in the IRB application even in circumstances where FERPA allows access without prior consent. 
• FERPA and the Health Insurance Portability and Accountability Act (HIPAA) regulations provide conflicting requirements for medical records. In some situations, FERPA is more restrictive than HIPAA for researchers. Researchers should contact each educational institution and follow that institution’s applicable policies, whether FERPA and/or HIPAA policy when accessing student medical records.

Other Department of Education Requirements

For research funded by the Department of Education, the researcher must allow access to instructional material used in a research or experimentation program including:

• Teachers' manuals, films, tapes, or other supplementary instructional material--which will be used in connection with any research or experimentation program, or project must be available for inspection by the parents or guardians of the children engaged in such research.

Oral History

A decision whether oral history or other activities solely consisting of open ended qualitative type interviews are subject to the policies and regulations outlined in an institution's FWA and DHHS regulations for the protection of human research subjects (45 CFR 46) is based on the prospective intent of the investigator and the definition of "research" under DHHS regulations at 45 CFR 46.102(d): "a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge."

Specifically, for the purposes of this policy, the evaluation of such activities hinges upon whether:

• The activity involves a prospective research plan that incorporates data collection, including qualitative data, and data analysis to answer a research question; and 
• The activity is designed to draw general conclusions (i.e., knowledge gained from a study may be applied to populations outside of the specific study population), inform policy, or generalize findings. 

In order to be subject to the University of Virginia human research protections policies, the activity must meet both of the above standards. This determination will be made according to the procedures described in Section 5 above.

General principles for evaluating Oral History activities:

• Oral history activities, such as open ended interviews, that ONLY document a specific historical event or the experiences of individuals without intent to draw conclusions or generalize findings do not constitute "research" as defined by DHHS regulations 45 CFR 46. 
  • Example: An oral history video recording of interviews with holocaust survivors is created for viewing in the Holocaust Museum. The creation of the video tape does not intend to draw conclusions, inform policy, or generalize findings. The sole purpose is to create a historical record of specific personal events and experiences related to the Holocaust and provide a venue for Holocaust survivors to tell their stories. 
• Systematic investigations involving open-ended interviews that are designed to develop or contribute to generalizable knowledge (e.g., designed to draw conclusions, inform policy, or generalize findings) would constitute "research" as defined by DHHS regulations at 45 CFR 46. 
  • Example: An open ended interview of surviving Gulf War veterans to document their experiences and to draw conclusions about their experiences, inform policy, or generalize findings. 

Investigators are advised to consult with the IRB Office regarding whether their oral history project requires IRB review.

Genetic Studies

Genetic research studies may create special risks to human subjects and their relatives. These involve medical, psychosocial, legal and economic risks, such as the possible loss of privacy, insurability, and employability, change in immigration status and limits on education options, and may create a social stigma. Knowledge of one's genetic make-up may also affect one's knowledge of the disease risk status of family members.

In studies involving genetic testing, several questions need to be addressed, including: 

1. Will test results be given? 
2. Will disease risk be quantified, including the limits on certainty of the testing? 
3. Will a change in a family relationship be disclosed, such as mistaken paternity? 
4. Does the subject or family member have the option not to know the results? How will this decision be recorded? 
5. Could other clinically relevant information be uncovered by the study? How will disclosure of this added information occur? 
6. Do any practical limitations exist on the subject's right to withdraw from the research, withdraw data, and/or withdraw DNA? 
7. Is the subject permitted to participate in the study while refusing to have genetic testing (such as in a treatment study with a genetic testing component)? 

For DNA banking studies, several questions need to be addressed, including: 

1. Will DNA be stored or shared? If shared, will the subject's identity be known by the new recipient investigator? 
2. Will the subject be contacted in the future by the investigator to obtain updated clinical information? 
3. How can the subject opt out of any distribution or subsequent use of his/her genetic material?

Case Reports Requiring IRB Review

In general, an anecdotal report on up to three patients seen in one’s own practice and a comparison of these patients to existing reports in the literature is not research and does not require IRB approval. Going beyond one’s own practice to seek out and report cases seen by other clinicians creates the appearance of a systematic investigation with the intent to contribute to generalizable knowledge and therefore is considered research and would require IRB approval.

Definitions

Single Case Report. The external reporting (e.g., publication, poster or oral presentation) of an interesting clinical situation or medical condition of a single patient. Case reports normally contain detailed information about an individual patient and may include demographic information and information on diagnosis, treatment, response to treatment, follow-up after treatment, as well as a discussion of existing relevant literature. The patient information used in the report must have been originally collected solely for non-research purposes as the result of a clinical experience. 

Case Series. The external reporting (e.g., publication, poster or oral presentation) of an interesting clinical situation or medical condition in a series of up to three patients (i.e., more than one patient). Case series usually contain detailed information about each patient and may include demographic information and information on diagnosis, treatment, response to treatment, follow-up after treatment, as well as a discussion of existing relevant literature. The information used in the report must have been originally collected solely for non-research purposes as the result of a clinical experience.

Research supported by the Department of Defense (DOD)

Research supported by the Department of Defense (DOD) is reviewed and conducted in compliance with part 219 of title 32 CFR, part 980 of title 10 USC, applicable parts of title 21 CFR (50, 56, 312, 600, 812), DOD Instruction 3216.02, DOD Directive 3210.07, and applicable additional requirements from respective DOD component(s). 

DOD Components refers collectively to the organizational entities within the DOD that are subject to the human subjects protections laid out in Department of Defense Directive.

Application and Scope

The following additional requirements apply to all biomedical and social/behavioral research involving human research participants conducted under the jurisdiction of University of Virginia when it: 

• Conducts, reviews, approves, oversees, supports manages otherwise is contractually subject to regulation by the DOD; and/or 
• Human subject research performed under the jurisdiction of University of Virginia using DOD property, facilities, or assets. 

In most cases, protocols covered by these requirements also will have review, approval and oversight by the DOD Human Research Protections Program. University of Virginia assures that DOD supported research complies with all relevant DOD human subjects protection requirements, including but not limited to: 

• The Belmont Report 
• Title 32 Code of Federal Regulations Part 219 (32 CFR 219), Department of Defense Regulations, “Protection of Human Subjects” (DOD adoption of the “Common Rule”) 
• Title 45 Code of Federal Regulations Part 46, (45 CFR 46) Department of Health and Human Services Regulations, “Protection of Human Subjects,” Subparts B, C, and D as made applicable by DOD Directive (DODD) 3216.02 
• Title 21 Code of Federal Regulations 50, 56, 312, and 812, Food and Drug Administration (FDA) Regulations 
• DODD 3216.02, “Protection of Human Subjects and Adherence to Ethical Standards 
• Title 10 United States Code Section 980 (10 USC 980), “Limitation on Use of Humans as Experimental Subjects” 
• DODD 3210.7, “Research Integrity and Misconduct” 
• DODD 6200.2, “Use of Investigational New Drugs in Force Health Protection” in DOD-supported Research” 
• Key Additional Requirements Not Covered by Title 45 CFR 46, Subparts B, C and D; 21 CFR 50, 56, 312, and 812

Minimal Risk – [DODI 316.02, enclosure 3, para 6b]

The definition of minimal risk based on the phrase “ordinarily encountered in daily life or during the performance of routine physical or physiological examination or tests” shall not be interpreted to include the inherent risks certain categories of human subjects face in their everyday life. For example, the risks imposed in research involving human subjects focused on a special population should not be evaluated against the inherent risks encountered in their work environment (e.g., emergency responder, pilot, soldier in a combat zone) or having a medical condition (e.g., frequent medical tests or constant pain.)

Undue Influence – [DODD 3216.2, enclosure 3, para 7e1]

Service members shall follow their command policies regarding the requirement to obtain command permission to participate in research involving human subjects while on-duty and for approving off-duty employment or activities. Superiors (e.g., military and civilian supervisors, unit officers, and noncommissioned officers (NCOs)) are prohibited from influencing the decisions of their subordinates (e.g., junior enlisted personnel and equivalent civilians) regarding participation as subjects in research involving human subjects. Unit officers and senior NCOs in the chain of command shall not be present at the time of research subject solicitation and consent during any research recruitment sessions in which members of units under their command are afforded the opportunity to participate as research subjects. When applicable, officers and NCOs so excluded shall be afforded the opportunity to participate as research subjects in a separate recruitment session. During recruitment briefings to a unit where a percentage of the unit is being recruited to participate as a group, an ombudsman not connected in any way with the proposed research or the unit shall be present to monitor that the voluntary nature of individual participants is adequately stressed and that the information provided about the research is adequate and accurate.

Education and Training – [DODD 3216.2, enclosure 3, para 5]

For initial and continuing research ethics education for all personnel who conduct, review, approve, oversee, support, or manage human participant research is required. The DOD component may evaluate the education policies to ensure the personnel are qualified to perform the research, based on the complexity and risk of the research.

Appointment of a Research Monitor – [DODI 3216.02, enclosure 3, para 8]

The IRB considers the appointment of a research monitor:

• Required for research involving greater than minimal risk, although the IRB or organizational official can require this for a portion of the research or studies involving no more than minimal risk if appropriate. 
• The research monitor is appointed by name and shall be independent of the team conducting the research. 
• There may be more than one research monitor (e.g. if different skills or experience are needed. 
• The monitor may be an ombudsman or a member of the data safety monitoring board. 
• The IRB staff shall communicate with research monitors to confirm their duties, authorities, and responsibilities. 
• The duties of the research monitor are determined on the basis of specific risks or concerns about the research. 
• May perform oversight functions (e.g. observe recruitment, enrollment procedures, and the consent process, oversee study interventions and interactions, review monitoring plans and unanticipated problems involving risks to participants or others, oversee data matching, data collection and analysis). 
• May discuss the research protocol with researchers, interview human subjects, and consult with others outside of the study. 
• Report observations and findings to the IRB or a designated official. 
• The research monitor has the authority to: 
  • Stop a research study in progress. 
  • Remove individuals from study. 
  • Take any steps to protect the safety and well-being of participants until the IRB can assess.

Additional protections for pregnant women, prisoners, and children (Subparts B, C and D) of 45 CFR 46) – [DODI 3216.02, enclosure 3 para 7]

• Research involving pregnant women, prisoners, and children are subject to the DHHS Subparts B, C. and D. 
  • For purposes of applying Subpart B, the phrase “biomedical knowledge” shall be replaced with “generalizable knowledge.” 
  • The applicability of Subpart B is limited to research involving pregnant women as participants in research that is more than minimal risk and included interventions or invasive procedures to the woman or the fetus or involving fetuses or neonates as participants. 
  • Fetal research must comply with the US Code Title 42, Chapter 6A, Subchapter III, Part H, 289g.
  • The exemption for research involving survey or interview procedures or observation of public behavior, does not apply to research with children, except for research involving observations of public behavior when the investigator(s) do not participate in the activities being observed. 
  • Research involving a detainee as a human participants is prohibited. 
• Research involving prisoners cannot be reviewed by the expedited procedure. 
• When the IRB reviews research involving prisoners, at least one prisoner representative must be present for quorum. 
• In addition to allowable categories of research on prisoners in Subpart C, epidemiological research is also allowable when: 
  • The research describes the prevalence or incidence of a disease by identifying all cases or studies potential risk factor association for a disease. 
  • The research presents no more than minimal risk 
  • The research presents no more than an inconvenience to the participant. 
• When a prisoner becomes a participant, if the researcher asserts to the IRB that it is in the best interest of the prisoner-participant to continue to participate in the research while a prisoner, the IRB Chair may determine that the prisoner-participant may continue to participate until the convened IRB can review this request to approve a change in the research protocol and until the organizational official and DOD Component office review the IRB’s approval to change the research protocol. 
• Otherwise, the IRB Chair shall require that all research interactions and interventions with the prisoner-subject (including obtaining identifiable private information) cease until the convened IRB can review this request to approve a change in the research protocol. The convened IRB, upon receipt of notification that a previously enrolled human participant has become a prisoner, shall promptly re-review the research protocol to ensure that the rights and wellbeing of the human subject, now a prisoner, are not in jeopardy. The IRB should consult with a subject matter expert having the expertise of a prisoner representative if the IRB reviewing the research protocol does not have a prisoner representative. If the prisoner-participant can continue to consent to participate and is capable of meeting the research protocol requirements, the terms of the prisoner-participant’s confinement does not inhibit the ethical conduct of the research, and there are no other significant issues preventing the research involving human participants from continuing as approved, the convened IRB may approve a change in the study to allow this prisoner-participant to continue to participate in the research. This approval is limited to the individual prisoner-participant and does not allow recruitment of prisoners as participants.

Limitation of Waivers and Exceptions from Informed Consent - [DODI 3216.02, enclosure 3 para 13; 10 U.S.C. 980]

The requirements of title 10 United States Code 980 which are applicable to DOD sponsored research must be considered. 10 USC 980 requires that “Funds appropriated to the Department of Defense may not be used for research involving a human being as an Experimental Subject unless 1) the informed consent of the subject is obtained in advance; or 20 in the case of research intended to be beneficial to the subject, the informed consent may be obtained from a legal representative of the subject.

The definition of experimental subject is found in DODI 3216.02 and has a much narrower definition than human subject under 45CFR46. Research with experimental subjects must involve an intervention or interaction where the primary purpose of the research is to collect data regarding the effects of the intervention or interaction.

An individual not legally competent to provide informed consent (e.g. , incapacitated individuals, cognitively impaired, minors) may not be enrolled as an experimental subject in a DOD –supported experiment unless participation in the research is intended to benefit each subject enrolled in the study, to include subjects enrolled in study placebo arms. Studies designed in a manner that permits all subjects to potentially benefit directly from medical treatment or enhanced surveillance beyond the standard of care can meet the 10 USC 980 requirements.

10 USC 980 is only applicable to certain intervention studies. It does not apply to retrospective studies, observational studies, blood draws, and tissue collections.

If the research participant meets the definition of “experimental subject,” policies and procedure prohibit a waiver of the consent process unless a waiver is obtained from the Assistant Secretary of Defense for Research and Engineering. The Assistant Secretary of Defense for Research and Engineering may waive the requirements for consent when all of the following are met:

• The research is necessarily to advance the development of a medical product for the Military Services. 
• The research may directly benefit the individual experimental subject. 
• The research is conducted in compliance with all other applicable laws and regulations. 

For classified research, waivers of consent are prohibited.

Limitations on Compensation for U.S. Military Personnel - [Dual Compensation Act and 24 U.S.C. 30]

The Dual Compensation Act prohibits an individual from receiving pay from more than one position for more than an aggregate of 40 hours of work in one calendar week. This prohibition applies to employees paid from either appropriated or non-appropriated funds, or a combination thereof, and includes temporary, part-time and intermittent appointments. This law if not applicable to enlisted off-duty military personnel in relation to their military duty.

When research involves U.S. military personnel, limitations on dual compensation include:

• Federal employees while on duty and non-Federal persons may be compensated for blood draws for research up to $50 for each blood draw. 
• Non-Federal persons may be compensated for research participation other than blood draws in a reasonable amount, as approved by the IRB according to local prevailing rates and the nature of the research. 
• Prohibit an individual from receiving pay of compensation for research during duty hours. 
• U.S. military personnel may be compensated for research if the participant is involved in the research when not on duty.

Requirement for Reporting - DODO 3216.02, enclosure 3 para 4(b)(4)

The Institution shall promptly (no longer than within 30 days) notify the HRPO of the following: when significant changes to the research protocol are approved by the IRB, the results of the IRB continuing review, if the IRB used to review and approve the research changes to a different IRB, when the institution is notified by any Federal department or agency or national organization that any part of its HRPP is under investigation for cause involving a DOD- supported research protocol, and all UPIRTSOs, suspensions, terminations, and serious or continuing noncompliance regarding DOD-supported research involving human subjects.

Recordkeeping Requirements - [DODD 3216.2, para. 5.3.2; SECNAVINST 3900.39D, para. 8c(18)]

Recordkeeping requirements for DOD-supported research with human subjects are longer than the Common Rule’s requirement. DOD may require submitting records to DOD for archiving.

Records maintained that document compliance or non-compliance with DOD requirements shall be made accessible for inspection and copying by representatives of the DOD at reasonable times and in a reasonable manner as determined by the supporting DOD component.

Addressing and Reporting Allegations of Non-Compliance with Human Research Protections - [DODD 3216.2, para. 4.10; SECNAVINST 3900.39D, para. 8d(2) and 6k]

• Report the initiation of all investigations and report results regardless of the findings to the Navy Secretary General and appropriate sponsors.

Addressing and Reporting Allegations of Research Misconduct - [DODD 3216.2, para. 4.8; DODD 3210.7; SECNAVINST 3900.39D, 8d(2) para. 6l]

• All findings of serious research misconduct under this section shall be reported to the Director, Defense Research and Engineering.

Provisions for Research with Human Subjects using Investigational Test Articles (Drugs, Device and Biologics) - [DODD 3216.2, para 4.9; DODD 6200.2; SECNAVINST 3900.39D, para. 6h] 

• Principal investigators may not be sponsors for INDs and IDEs.

Prohibition of Research with Prisoners of War (POW) and Detainees - [DODD 3216.2, para 4.4.2; SECNAVINST 3900.39D, para. 6a(8)]

• Research involving any person captured, detained, held or otherwise under the control of DOD personnel (military and civilian, or contractor employee) is prohibited.

Classified research[DODI 3216.02, enclosure 3 para 13]

The involvement of classified information may be limited to information needed for IRB approval and oversight of the research; information needed to inform the human subjects during the consent process; and information provided by the human subjects during the course of the research. Secretary of Defense approval is required for all classified non-exempt research involving human subjects.

Informed consent procedures shall include:

• Identification of the Department of Defense as the supporting institution of the research, unless the research involves no more than minimal risk. The Secretary of Defense may grant an exception to this requirement on the grounds that providing this information could compromise intelligence sources or methods. 
• A statement that the research involving human subjects is classified and an explanation of the impact of the classification. 

The IRB shall determine whether potential human subjects need access to classified information to make a valid, informed consent decision. IRB review shall be conducted using a full board review. Use of an expedited review procedure is prohibited. 

Additional Requirements for DOD Sponsored Research 

• New research and substantive scientific amendments to approved research shall undergo scientific review and the review is considered by the IRB. The IRB may rely on outside experts to provide an evaluation of scientific merit. 
• When conducting research with international populations, additional safeguards for research conducted with international populations include: The Organization or Researcher has permission to conduct research in that country by certification or local ethics review and the Researcher follows all local laws, regulations, customs, and practices. 
• Disclosure regarding the provisions for research-related injury follow the requirements of the DOD component. 
• Surveys performed on Department of Defense personnel must be submitted, reviewed, and approved by the Department of Defense after the research protocol is reviewed and approved by the IRB. 
• When conducting multi-site research, a formal agreement between organizations is required to specify the roles and responsibilities of each party. 
• The following shall be promptly (no longer than within 30 days) reported to the DOD human research protection officer: 
  • When significant changes to the research protocol are approved by the IRB. 
  • The results of the IRB continuing review. 
  • Change of reviewing IRB. 
  • When the organization is notified by any Federal department, agency or national organization that any part of the HRPP is under investigation for cause involving a DOD-supported research protocol. 
• If consent is to be obtained from the research participant’s LAR, the research must intend to benefit the individual participant. The determination that research is intended to be beneficial to the individual research participant must be made by the IRB. 
• Civilian researchers attempting to access military volunteers should seek collaboration with a military researcher familiar with service-specific requirements.

Responsibilities

It is the responsibility of the principal investigator to ensure compliance with all additional Department of Defense (DOD) requirements for human subject protection. It also is the responsibility of the IRB to ensure that all additional requirements by Department of Defense components for human subject protection have been met before IRB approval of the research project.

Research Supported by the Department of Justice (DOJ)

To ensure that human subjects are adequately protected from unreasonable risks and properly informed of the potential harms and benefits from their participation in research, the National Institute of Justice (NIJ) and recipients of its funds are required to comply with 28 CFR Part 46 (Protection of Human Subjects) or the “Common Rule.”

All projects funded under NIJ are required to submit a NIJ Privacy Certificate. Submission of a Privacy Certificate as part of an IRB application is required regardless of whether the project involves the collection of identifiable data. In cases where no personally identifiable information will be collected, the Privacy Certificate should contain a statement to this effect and a brief project description. The Privacy Certificate assures that the applicant understands his responsibilities to protect the confidentiality of research and statistical information and has developed specific procedures to ensure that this information is only used or revealed in accordance with the requirements of 42 USC §3789g and 28 CFR Part 22. The Privacy Certificate is signed by the Principal Investigator(s), submitted with the IRB application, and is then signed by the IO upon successful completion of the IRB processes. The principal investigator is responsible for submitting the completed Privacy Certificate to NIJ. Privacy Certificate instructions and guidelines can be found at the NIJ website.

All researchers and research staff are required to sign employee confidentiality statements, which are maintained by the responsible researcher.

It is the responsibility of the principal investigator to ensure compliance with any additional NIJ requirements for human subject protection. It also is the responsibility of the IRB to ensure that additional requirements for human subject protection have been met prior to IRB approval of the research project.

For research conducted within the Bureau of Prisons: Implementation of Bureau programmatic or operational initiatives made through pilot projects are not considered to be research.

Additionally, for all research conducted within the Bureau of Prisons, UVA, the IRBs, and researchers and research staff must follow the requirements of 28 CFR 512, including:

• The project must not involve medical experimentation, cosmetic research, or pharmaceutical testing. 
• The research design must be compatible with both the operation of prison facilities and protection of human subjects. The researcher must observe the rules of the institution or office in which the research is conducted. 
• Any researcher who is a non-employee of the Bureau must sign a statement in which the researcher agrees to adhere to the provisions of 28 CFR 512. 
• All research proposals will be reviewed by the Bureau Research Review Board.

Further considerations include: 

• A non-employee of the Bureau may receive records in a form not individually identifiable when advance adequate written assurance that the record will be used solely as a statistical research or reporting record is provided to the agency. 
• Except as noted in the consent statement to the subject, the researcher must not provide research information that identifies a subject to any person without that subject’s prior written consent to release the information. For example, research information identifiable to a particular individual cannot be admitted as evidence or used for any purpose in any action, suit, or other judicial, administrative, or legislative proceeding without the written consent of the individual to whom the data pertain. 
• Except for computerized data records maintained at an official DoJ site, records that contain non-disclosable information directly traceable to a specific person may not be stored in, or introduced into, an electronic retrieval system.
• If the researcher is conducting a study of special interest to the Office of Research and Evaluation (ORE) but the study is not a joint project involving ORE, the researcher may be asked to provide ORE with the computerized research data, not identifiable to individual subjects, accompanied by detailed documentation. These arrangements must be negotiated prior to the beginning of the data collection phase of the project.

The research protocol submitted to the IRB must address the following:

• Research conducted within the Bureau of Prisons must have an adequate research design and contribute to the advancement of knowledge about corrections. 
• The selection of subjects within any one organization must be equitable 
• Incentives may not be offered to help persuade inmate subjects to participate; however soft drinks and snacks to be consumed at the test setting may be offered. 
• Reasonable accommodations such as nominal monetary recompense for time and effort may be offered to non-confined research subjects who are both no longer in Bureau of Prisons custody and participating in authorized research being conducted by Bureau employees or contractors. 
• The researcher must have academic preparation or experience in the area of study of the proposed research. 
• The researcher must assume responsibility for actions of any person engaged to participate in the research project as an associate, research coordinator, sub investigator or subcontractor to the researcher. 
• The researcher must include the following in the application to the IRB: 
  • A summary statement, which includes: 
    • Names and current affiliations of the researchers 
    • Title, purpose and location of the study 
    • Methods to be employed 
  • Anticipated results 
  • Duration of the study 
  • Number of subjects (staff or inmates) required, and amount of time required from each 
  • Indication of risk or discomfort involved as a result of participation 
  • A comprehensive statement, which includes: 
    • Review of related literature 
    • Detailed description of the research method 
    • Significance of anticipated results and their contribution to the advancement of knowledge 
    • Specific resources required from the Bureau of Prisons 
    • Description of all possible risks, discomforts, and benefits to individual subjects or a class of subjects, and a discussion of the likelihood that the risks and discomforts will actually occur. 
    • Description of steps taken to minimize any risks 
    • Description of any anticipated effects of the research study on organizational programs and operations 
    • Relevant research materials such as vitae, endorsements, sample consent statements, questionnaires, and interview schedules.
    • A statement regarding assurances and certification required by 28CFR46, if applicable. 
• The following consent elements are required: 
  • For National Institute of Justice (NIJ)-funded research the consent document must disclose:
    • The name(s) of the funding agency(ies). 
  • For research conducted within the Bureau of Prisons required elements of disclosure include: 
    • The identity of the researchers. 
    • Anticipated uses of the results of the research. 
  • The extent to which confidentiality of records identifying the subject will be maintained. For studies sponsored by NIJ, the subject should be informed that private, identifiable information will be kept confidential and will only be used for research and statistical purposes. If, due to sample size or some unique feature, the identity of the individual cannot be maintained, the subjects need to be explicitly notified. If the researcher intends to disclose any information, the subject needs to be explicitly informed what information would be disclosed, under what circumstances, and to whom. The subject must be informed of any risks that might result from this disclosure and must explicitly provide written consent prior to participating in the research. 
  • A statement that participation is completely voluntary and that the subject may withdraw consent and end participation in the project at any time without penalty or prejudice (the inmate will be returned to regular assignment or activity by staff as soon as practicable). 
  • A statement regarding the confidentiality of the research information and exceptions to any guarantees of confidentiality required by federal or state law. For example, a researcher may not guarantee confidentiality when the subject indicates intent to commit future criminal conduct or harm himself or herself or someone else, or, if the subject is an inmate, indicates intent to leave the facility without authorization. 
• A statement that participation in the research project will have no effect on the inmate subject's release date or parole eligibility.

For National Institute of Justice-funded research, a copy of all data must be de-identified and sent to the National Archive of Criminal Justice Data, including copies of the informed consent document, data collection instruments, surveys, or other relevant research materials. 

• At least once a year, the researcher shall provide the chief, Office of Research and Evaluation, with a report on the progress of the research. 
• At least 12 working days before any report of findings is to be released, the researcher shall distribute one copy of the report to each of the following: the chairperson of the Bureau Research Review Board, the regional director, and the warden of each institution that provided data or assistance. The researcher shall include an abstract in the report of findings. 
• In any publication of results, the researcher shall acknowledge the Bureau's participation in the research project. 
• The researcher shall expressly disclaim approval or endorsement of the published material as an expression of the policies or views of the Bureau.

Prior to submitting for publication the results of a research project conducted under this subpart, the researcher shall provide two copies of the material, for informational purposes only, to the Chief, Office of Research and Evaluation, Central Office, Bureau of Prisons.