General Questions and Protocol Process Questions
Confidentiality, Privacy, and Data Storage
Collaborations, International and Indigenous Populations
Miscellaneous and Other Regulatory Considerations
There are several categories of research that may be exempt from the requirements of the Federal Policy for the Protection of Human Subjects (45 CFR 46). If research is found to be exempt, you must still submit a protocol application through ORahs. Although research that qualifies for exempt status is not subject to the federal regulations for human subjects research, researchers still have a responsibility to protect the rights and welfare of their subjects.
Back to top
There is a difference between exempt and a non-human subjects research determination. Exempt still means it is human subjects research, per the federal definition of research AND human subjects. In order to be exempt research it must fall under one of the federally defined categories of exemption.
Non-human subjects research (NHSR) means that the project does not qualify as research or it does not involve the collection of private identifiable information or biospecimens, or interaction or intervention with human subjects, "about whom" you are collecting information.
If you think your proposed research does not meet the requirements for human subjects research and you would like to receive documentation for your records, email your request for confirmation to the HSC Coordinator at firstname.lastname@example.org along with the HSC Research Determination Form for review.
Back to top
No. If you are conducting a classroom assignment that is purely for pedagogical (i.e., teaching) purposes, then the classroom activities are not subject to IRB review. Where data is collected from and about living individuals as part of a class exercise and/or assignment and is not intended for use outside of the classroom is not considered human subjects research. Course instructors are still expected to train students to conduct their project ethically with the three core principles of the Belmont Report in mind. Note: There may be instances where a student or instructor wishes to use data that was previously collected for non-research (i.e., educational) purposes. In these instances, an application should be submitted to the HSC when the intent of the project has changed and is intended to contribute to generalizable knowledge.
Back to top
The UCLA Office for Protection of Research Subjects (OPRS) contacted Dr. Michael Carome, HHS-OHRP Associate Director for Regulatory Affairs, to seek his guidance concerning the matter of whether qualitative research utilizing open-ended interviews, especially activities performed by oral historians and other social scientists, would require IRB review.
In short, Dr. Carome clarified that the decision concerning whether activities that consist of open-ended qualitative type interviews (such as oral history projects or ethnographies) require IRB review hinges upon whether the activity meets the above definition of research—specifically, whether the activity is an "investigation" and “designed to contribute to generalizable knowledge.” The purpose of these activities is often to create a record of specific historical events and, as such, is not to generalize findings to a broader population or group. However, activities involving similar characteristics may be “designed to contribute to generalizable knowledge.” Below are examples of qualitative interviews that are considered to be research and examples of qualitative interviews that are not considered to be research.
• An oral history video recording of interviews with Holocaust survivors is created for viewing in the Holocaust Museum. The creation of the videotape is not intended to prove a hypothesis, inform policy, or draw conclusions. The sole purpose is to create a historical record of specific personal events and experiences related to the Holocaust and provide a venue for Holocaust survivors to tell their stories. Open-ended interviews that only document a specific historical event or the experiences of individuals without the intent to draw conclusions or generalize findings would not constitute research.
• Open-ended interviews are conducted with surviving Gulf War veterans to document their experiences in order to draw conclusions about those experiences, inform policy, and generalize findings. This would constitute research.
• Open-ended interviews are conducted with surviving Negro Baseball League players in order to create an archive for others to analyze and generalize findings in the future. Since the intent of the archive is to create a repository of information for others to use in research, the creation of such an archive would constitute research.
Back to top
Yes. If the data is considered identifiable (even if recorded without direct or indirect identifiers) and not publicly available.
Projects that use an existing data set, which includes identifiable data gathered in earlier research projects, may require a new IRB protocol for review. Secondary analysis of existing data may include the review of medical records, student records, data collected from previous studies, audio/video recordings, etc. that were initially collected for another purpose. In order to be existing, the information must be "on the shelf" (i.e., it has already been collected) at the time that the current research is proposed.
Though such projects do not involve interactions or interventions with humans, they may still require IRB review, since the definition of "human subject" includes living individuals about whom an investigator obtains identifiable private information for research purposes.
In addition to being identifiable, the existing data must include "private information" in order to constitute research involving human subjects. Private information is defined as information that has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (e.g., a medical or school record). Information that contains identifiers and can be accessed freely by the public (without special permission or application) is not "private" and the research therefore does not therefore involve human subjects. For example, a study involving only analysis of the published salaries and benefits of public university presidents would not need IRB review since this information is not private.
Data analysis activities that meet the definition of research with human subjects may qualify for an exemption or require expedited or even full committee review. Any such project must receive IRB approval or a determination of exemption before the researcher accesses the data.
Back to top
Unanticipated problems or adverse events must be reported to IRB if they are: 1) unexpected; 2) related or possibly related to participation in the study; and 3) suggest that the research places subjects or others at a greater risk of harm than was previously known or recognized. The IRB will review the report to assess whether any corrective actions or substantive changes are needed in order to protect the safety, welfare, and rights of subjects or others.
An initial report should be made by mail/delivery, phone, or email to the Human Subjects office or Director of Research Integrity as soon as possible, but within no more than one week (7 calendar days) of the Principal Investigator (PI) learning of the incident. The initial report must be followed by a formal written report within no more than two weeks (14 calendar days) of the Principal Investigator learning of the incident. For more information on unanticipated problems or adverse events, see our HSC SOP 023.
Note: Other reporting requirements/deadlines may apply for certain research (e.g., involving the DoD, FDA).
To submit a formal report, email the IRB at email@example.com and include a brief summary of the incident including:
All faculty, students, staff, and external researchers proposing to use human participants in research under the auspices of the University are required to complete the human subjects research training. Approvals for proposed research projects will be not be granted until this training has been completed. Go to the ORahs 2.0 Tutorials webpage for instructions on how to complete the training.
Back to top
In general, individuals listed on the protocol should be the researchers in a supervisory role, the individuals who are ultimately responsibility for conducting the research in accordance with the protocol. The HSC recommends distinguishing between an undergraduate RA that is working in the lab for research credits vs an undergrad/grad/post-doc who is actually overseeing the project or has some oversight or responsibilities on the project. Regardless, all personnel are expected to complete the HS training requirements and conduct themselves ethically while conducting human subjects research (including recruitment, consenting, running subjects, analyzing identifiable data, etc.), but depending on the their roles in the research protocol, an individual may not necessarily need to be listed on the ORahs protocol.
Below are several scenarios for when an undergraduate should/should not be listed on a protocol:
A. Always list graduate students who run the study and/or supervise the undergraduates who help run the study.
B. List undergraduates only when the undergraduate is the primary researcher (e.g., when it's their honors thesis or independent research project), because the student in this case is a primary investigator.
C. Do NOT list undergraduates who are simply research assistants supervised by either A or B above. These RAs generally get class credit but some volunteer for research experience in preparation for graduate school. So, these students do not need to be listed because they are not primary researchers (they do not have a supervisory role in ensuring that proper procedures are followed - they simply follow procedures set up by supervisors/primary researchers).
Back to top
Privacy is control over the extent, timing, and circumstances of sharing oneself (physically, behaviorally, or intellectually) with others. Confidentiality pertains to the treatment of information that an individual has disclosed in a relationship of trust and with the expectation that it will not be divulged to others without permission in ways that are inconsistent with the understanding of the original disclosure. Examples of protecting subject privacy include conducting interviews in private areas or closing exam room curtains when conducting physical exams. Examples of minimizing the likelihood of a breach of confidentiality include sharing subject data only with other study team members, encrypting and password-protecting data files, and maintaining lists of subject names/study identification numbers in a separate, secure location from all other private study data.
Back to top
Anonymous data collection means that no identifiable information (e.g., name, address, student ID number, email address, phone number) is connected to the data either directly or through a coding system at any point in the study. In addition to videotapes and photographs, audio recordings are not considered to be anonymous. It is also possible that multiple pieces of information, none of which are identifiable on their own, may uniquely identify a person when brought together; in this case, the data would not be considered anonymous.
Back to top
Audio and video recordings, as well as photographs, are considered to be potentially identifiable private information. Informed consent must be obtained prior to audio or video recording and/or taking photographs of subjects, and it is important to disclose how the media will be used, who will have access to them, and when/if they will be destroyed. The subject should be given the opportunity to withdraw from the study after the recordings have been made.
Back to top
There are several points to consider when securing research records that may be identifiable or potentially sensitive in nature:
Consider on-line solutions like UCSB Box as an acceptable data storage solution. Great care must be taken when setting sharing permissions to ensure that the data are only shared with co-investigators and that data are not shared with wider audiences or outside of the organization, unless the participant has explicitly consented to their data being shared with other researchers during the consent process.
If recording (e.g., audio, video) participants, using a computer has advantages. First, the data can be encrypted from the moment that they are recorded. Second, backup of the data is possible. Encryption must be enabled for all devices used in the field including phones, tablets, and laptops.
The process of transmitting data is often overlooked as a risk. The plan to protect confidentiality should describe the methods to protect the data during collection and sharing both internally and externally to the University. It is advisable to utilize a secure transmission process even if the data is anonymous, coded, or non-sensitive information. If the research team develops a best practice on using a secure data transmission process, then it is less likely a data breach will occur.
Email notifications are generally not secure, except in very limited circumstances, and should not be used to share or transmit research data. Some email programs have encryption available and plug-in software based on GNU Privacy Gard (GPG) is widely available. Text messages and messages sent using many instant messaging programs are stored by the telecommunications provider and therefore are not secure.
Data should be encrypted when “in-transit.” Terms such as Secure Sockets Layer, Transport Layer Security (SSL. TLS, and HTTPS) or Secure File Transfer Protocol (SFTP) are indications that the data is being encrypted during transmission.
Back to top
Payment for participation in a study is not considered to be a benefit for research participants. Rather, it is considered compensation for time, travel, and inconvenience. The amount and schedule of all payments must be described in the ORahs protocol and informed consent document(s) at the time of initial review, including a summary of both the amount of payment and the proposed method and timing of disbursement to assure that neither are coercive or present undue influence. Procedures for prorating payment should the participant withdraw, must also be described in the ORahs protocol application and informed consent document(s).
When offering course credit, a non-research alternative must be offered that provides the same amount of course credit for similar time & effort. Care must be taken to ensure that the credit offered would not negatively affect students who do not participate in the research study.
Back to top
If social security numbers are required to process payments to research subjects, this should be explained in the application for HSC review and the following safeguards should be implemented:
California law requires that individuals included in a lottery or raffle must be 18 years or older. Payment/lottery chance cannot be withheld due to a participant withdrawing from a study. Lotteries must be prorated in some manner if the subject withdraws early from the study. However, the timing of the lottery can certainly be after the study has been completed.
Some researchers provide multiple entries into the lottery, 1 for starting the study, another for every X days they participate, 1 for completing the study; alternatively the researcher may just give everyone who joins 1 entry whether they withdraw or not.
Approximate odds of winning lottery need to be included in the Consent form. For example, if a researchers would like to have 30-50 subjects and each gets one entry, then simply 1 in 30-50 chances is fine. If multiple entries, estimate the low & high and include in the consent form.
Online survey: Keeping the email name participants may enter into the survey separate from their data: Create a second survey asking for participants' email address if they want to be entered into the lottery (this question will *not* be located in the first survey).This will redirect respondents from the first survey to this survey.
If participants quit an internet study by closing out of their browser, it is not possible to direct them to the final page (due to closed internet browser). However, researchers can update the information sheet (consent form) so that participants are told the following prior to providing consent to participate: "If you choose to withdraw from the survey before you complete it, you may contact XXX at XXX@XXX.ucsb.edu to be entered into the lottery and/or if you would like more information about the purpose of the study."
Back to top
If you would like to offer extra credit in a course as compensation for participation in research and are NOT recruiting subjects through an established subject pool, then the following information must be described in your protocol application to ensure that the incentive is not coercive:
PIs conducting human subjects research at another UC campus must either get IRB approval from UCSB or have an active reliance under the UC MOU.
PIs conducting human subjects research at a non-UC institution must either get IRB approval from UCSB or enter into an IRB Authorization Agreement (IAA), which allows for a reliance agreement between the institutions..
If you are a non-UCSB researcher who wishes to recruit from the UCSB community but are not collaborating with a UCSB PI, then UCSB is would likely not be considered “engaged” in the research and UCSB IRB review may not be required. The non-UCSB researcher is responsible for contacting the UCSB IRB office to assess whether UCSB is considered “engaged” in the research project and should submit copies of the IRB-approved materials from their home institution. Non-UCSB researchers are required to abide by the policies of his/her home institution’s IRB and for obtaining appropriate permission to recruit from UCSB groups and organizations. The UCSB IRB Office may issue a letter of engagement determination for the non-UCSB researcher’s records.
Note that additional institutional specific approvals not subject to UCSB IRB oversight may be applicable to the non-UCSB researcher and the UCSB IRB Office is not responsible for determining which specific approvals (if any) are required.
Non-UCSB researchers who wish to collaborate on research at UCSB must have an eligible UCSB Principal Investigator to serve as the faculty who will submit a protocol to UCSB’s IRB for approval. In order to avoid duplication of IRB review, the researchers should contact the IRBs at their respective institutions to determine if ceding IRB review is appropriate for the proposed research study.
Human subjects research conducted outside the United States must conform to the same ethical and regulatory standards to which research conducted in the United States is held, and must conform to applicable local laws and norms of the host country. International human research must be conducted in accordance with applicable UCSB policies for the conduct and review of human research, including those concerning informed consent and participation of vulnerable populations. All human research conducted outside the United States must receive approval from the UCSB Human Subjects Committee (HSC) and, where available, from the Institutional Review Board (IRB) or Independent Ethics Committee (IEC) used by the international site.
If IRB review is not available at the international site, then local ethical review needs to be sought to ensure research is appropriate for its locale. The review should assess whether the project is culturally insensitive or offensive and whether participation could place the subjects at risk. The reviewer should be from the country or area targeted. The reviewer should also be able to understand the research and should be independent of the research.
If an international institution or site is considered to be "engaged" in research supported by UCSB and involves receipt of federal funding, the international institution must obtain and maintain compliance with a Federal-wide Assurance (FWA) from the US Department of Health and Human Services (DHHS). The site also must receive approval for the research from an IRB familiar with the local context and registered with the Office of Human Research Protections of DHHS, or obtain DHHS approval as an equivalent host country entity.
For specific details regarding international human subjects review requirements, go to the DHHS International Compilation of Human Research Standards webpage.
A certification that the local reviews will be submitted to HSC before research begins will need to be included in the Location Tab of the ORahs protocol. See the UCSB SOP on International Research and the For Researchers section on International Research for additional information that should be included in your submission.
Back to top
Research involving Native American populations requires additional time from submission to protocol approval. Research that takes place in Indian Country, conducted in Indian Health Service (IHS) facilities, using IHS staff or resources, and/or recruitment of Native American populations, or research involving specimens which may result in research implications specific to a tribe or class of individuals are considered research involving Native American populations and protocols may need to be reviewed by the UCSB IRB as well as the appropriate Tribal IRB, or IHS IRB. Since each tribe handles human subjects research requests differently, the researcher should contact the specific tribe to determine what requirements are needed in order to conduct research with the tribal population. Copies of Tribal authorization or IHS IRB approval will be required to be submitted before the UCSB IRB can approve the research.
For more information on working with Native American populations, visit the Indian Health Services website.
Research involving subjects residing in the European Union or European Economic Area may be subject to the General Data Protection Regulation (GDPR). This new European Privacy law provides additional protections to individuals, for example, notification of when researchers "process" (e.g., collect, record, disseminate, etc.) Personal Data. Under GDPR, Personal Data refers to any information that relates to an identified or identifiable natural person located in the EU/EEA. In terms of human subjects research, notification of data processing can be met through the informed consent process with GDPR-compliant language. The HS staff will work with researchers on identifying and when a research activity may be subject to GDPR and the steps necessary for ensuring the appropriate language is inserted into consent forms.
“Internet research” is a broad term that includes both the Internet as a tool for research and as a research location. Internet-based research may be used for surveys because it is a quick way to gain access to a large number of respondents. Observations, interventions, and analysis of existing data are also commonly used methods of internet-based research. Internet-based research brings up difficult issues concerning human subject protections in the application of federal regulations 45 CFR 46 and the ethical principles of the Belmont Report. Topics such as privacy, confidentiality, recruitment, and informed consent can become complicated when research is conducted online.
Special considerations for survey researchers:
Back to top
Particular care must be taken when UCSB students are used as research subjects, as there is an inherent power differential between the students and the faculty members who serve as Principal Investigators or members of research teams. No matter how well intentioned the teacher, students may feel compelled to participate, believing that failure to do so will negatively affect their grades and the attitude of the teacher (and perhaps other students) toward them. For this reason, the HSC will not, in general, permit a teacher to use his/her own students as subjects in the teacher's research project. The HSC will review whether collection of data by a third party or a student's consent to use his/her own data be obtained after grades are entered, as possible ways to mitigate concerns regarding this type of research. However, consent should be obtained before research data is used.
The researcher should ensure that procedures are not likely to adversely impact students’ opportunity to learn required educational content.
Although students often provide a ready source of potential participants, they are not always as representative or appropriate to the research as other subject pools. Attention should be given to whether they are being solicited solely for convenience.
For research proposals utilizing recruitment of students by the teacher/researcher, the HSC may require contacting the Department Chair for approval of the proposed subject population and recruitment method.
Back to top
Research conducted in grade schools may require school district approval, principal of school approval, or district IRB or review board approval, depending on the requirements of a particular school district. Depending on the nature or design of the research, teacher consent may also be required. Note that parental permission and child assent must always be obtained, unless the UCSB HSC has granted a waiver. All such school approvals shall be submitted to the HSC for inclusion in the protocol file. The HSC may require district approval as a condition of UCSB approval, or may permit the researcher to obtain district approval at a later time, as long as proof of school approval is submitted as required by the HSC.
Back to top
California’s Child Abuse and Neglect Reporting Act (“CANRA”) requires employers, including the University, to identify “Mandated Reporters” (individuals required to report observed or suspected child abuse or neglect to designated law enforcement or social service agencies) and secure, as a condition of employment, acknowledgement of their status and reporting obligations. Visit the UCSB Human Resources webpage for more information on mandated reporting.
Employees of the university that have been identified in their official university capacity as a mandated reporter are also considered mandated reporters of child abuse on research protocols. Typically, student researchers (who are not also employees) are not considered mandated reporters.
In situations where conditions of child abuse or neglect might be revealed to UCSB researchers, mandated reporters are required to make themselves known as such to participants. This can be accomplished through the informed consent process.
In situations where conditions of suspected child abuse or neglect might be revealed to UCSB researchers and the researchers have not been identified as mandated reporters by the University, the IRB may require that the informed consent process include a statement or warning about the researcher’s ethical responsibility to report suspected or known incidents of child abuse or neglect to the appropriate authorities, including law enforcement.
Separate from CANRA, the California Penal Code requires any person who reasonably believes he or she has observed murder, rape, or certain lewd or lascivious acts where the victim is a child under the age of 14 years to notify a peace officer of the potential crime. This reporting mandate applies whether or not the witness is a mandated reported and regardless of his or her affiliation with the University.
Back to top
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA stipulates that an educational institution has the authority to determine what information may be accessed from an Education Record. If an institution denies an investigator access to information in an Education Record, the IRB cannot overrule the decision.
FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."
Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. As a general rule, schools must have written permission from the parent or eligible student to release information from a student's education record. Unless research that falls within FERPA qualifies for an exception under FERPA to the general rule of parental/eligible student consent, the IRB cannot waive consent.
FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):
a) School officials with legitimate educational interest;
b) Other schools to which a student is transferring;
c) Specified officials for audit or evaluation purposes;
d) Appropriate parties in connection with financial aid to a student;
e) Organizations conducting certain studies for or on behalf of the school;
f) Accrediting organizations;
g) To comply with a judicial order or lawfully issued subpoena;
h) Appropriate officials in cases of health and safety emergencies; and
i) State and local authorities, within a juvenile justice system, pursuant to specific State law.
Unless one of the above applies to your research, if you are collecting student records that fall under FERPA laws, you must obtain a release form signed by the student which must include the following information:
a) Printed Student Name;
b) Perm # , and DOB ;
c) exact records to be released;
d) Name of person or entity receiving records and IRB protocol number;
e) specific description of the records to be released, include a date/time frame if applicable (e.g., 2016-2017 academic year);
f) Students signature and date
Additional information on FERPA may be found at the website of the Department of Education.
Under federal law, research involving deceased persons generally is not human subjects research and does not require review IRB review and approval.
However, there are three exceptions:
Research involving State of California-produced death data files that do not contain personal identifying information does not need to be approved by an IRB.
Note: Access to State of California-produced death data files that include personal identifying information also requires review by the State of California Committee for the Protection of Human Subjects (CPHS). Researchers apply for CPHS review when ordering the data from the State of California. The State of California requires that researchers have a “valid scientific interest” in order for the IRB to approve such a study.