Informed Consent and IRB Approval: Meaning, Process, Examples

Key Takeaways:

• IRB approval and informed consent are 2 separate obligations: approval authorizes the study to begin, while consent is an ongoing process renewed with every participant, not a signature collected once.
• The IRB, not the investigator, decides the review level. Risk and activity type determine whether a study is exempt, expedited, or full board; urgency, funding size, and publication deadlines do not.
• Most delays are for reasons the researcher can control: Consent forms written above an 8th-grade reading level, vague data-security plans, and recruitment materials that overstate benefit cause the majority of first-round deferrals.
• Approval is a starting point, not a finish line. Amendments, continuing review, prompt reporting of unanticipated problems, and records retention all continue until the study is formally closed.

Glossary of Key Terms

Term	Definition
Assent	Affirmative agreement by a child or other person who cannot give legal consent. Silence is not assent.
Belmont Report	1979 US report setting out 3 principles: respect for persons, beneficence, and justice.
Broad consent	Consent to unspecified future secondary research use of identifiable data or biospecimens.
Coercion	An explicit or implied threat of harm or penalty used to obtain participation.
Common Rule	45 CFR 46, the core US federal regulation on human subjects research, revised in 2018.
Continuing review	Periodic re-review of an approved study, historically annual, now limited to higher-risk studies.
De-identified data	Data from which identifiers have been removed so the individual cannot readily be identified.
EFIC	Exception from informed consent for emergency research under 21 CFR 50.24.
Expedited review	Review by 1 experienced member instead of the convened board, for listed minimal-risk activities.
Exempt research	Research that meets a listed category and is excused from ongoing IRB oversight, though not from a determination.
GCP	Good Clinical Practice; the ICH E6 quality standard for designing, conducting, and reporting trials.
Human subject	A living individual about whom a researcher obtains data through intervention or interaction, or identifiable private information or biospecimens.
IRB / IEC	Institutional Review Board or Independent Ethics Committee; the body that reviews and approves human research.
Key information summary	A concise, focused opening section of the consent form covering what a reasonable person would need to decide.
LAR	Legally authorized representative; a person empowered under applicable law to consent on a participant behalf.
Minimal risk	Risk no greater than that ordinarily encountered in daily life or in routine physical or psychological tests.
Protocol deviation	Any departure from the IRB-approved protocol, whether or not it affects participant rights or safety.
Reliance agreement	A written agreement under which 1 institution accepts the IRB review of another.
Research	A systematic investigation designed to develop or contribute to generalizable knowledge.
sIRB	Single IRB; 1 board of record for a multi-site study, required for most US federally funded cooperative research.
Unanticipated problem	An event that is unexpected, related to the research, and suggests greater risk than previously known.
Undue influence	An offer so attractive that it distorts a reasonable person judgment about risk.
Vulnerable population	A group with reduced autonomy or heightened risk of exploitation requiring additional safeguards.
Waiver of documentation	IRB permission to obtain consent without a signed form, while still conducting the consent process.

 

Why Do Informed Consent and IRB Rules Exist?

They exist because unsupervised research has repeatedly harmed people. Nuremberg, Tuskegee, Willowbrook, and Havasupai Tribe v. Arizona State University each produced rules that arrived only after the damage. The Belmont Report distilled 3 principles that still drive every IRB decision:

• Respect for persons: voluntary, informed choice, with added protection where autonomy is limited.
• Beneficence: minimize risk, then justify whatever risk remains.
• Justice: distribute burdens and benefits fairly across groups.

Which Regulations Apply to Your Study?

3 factors decide: your funding source, your location, and whether an FDA-regulated product is involved. Most studies answer to more than 1 framework at once.

Framework	Trigger	Key point
Common Rule, 45 CFR 46	US federal funding	Baseline review levels
FDA 21 CFR 50 and 56	Drugs, devices, biologics	No exempt categories
ICH-GCP E6(R3)	Clinical trials worldwide	Sponsor, monitoring duties
Helsinki and CIOMS	Global ethical norms	Ethical floor, not law
ICMR Guidelines; NDCT Rules 2019	Research in India	Needs CDSCO-registered committee
HIPAA, GDPR, DPDP Act	Identifiable personal data	Separate approval track

 

Do You Even Need IRB Review?

Only if your activity is both “research” and involves “human subjects” as the regulations define those terms. If the answer is “no” to either question, it means no submission is required. Critically, you rarely get to make that call yourself: most institutions require a written not-human-subjects-research determination from the IRB, and journals increasingly ask to see it.

The 2 Threshold Questions

• Question 1, is it research? A systematic investigation designed to develop or contribute to generalizable knowledge. “Systematic” points to a prospective plan; “generalizable” points to intent to apply findings beyond the immediate setting.
• Question 2, are there human subjects? A living individual about whom you obtain data through intervention or interaction, or whose identifiable private information or identifiable biospecimens you obtain, use, study, or generate.
• Deceased individuals are not human subjects under the Common Rule, though HIPAA and institutional policy may still apply.
• Data about organizations, policies, or products rather than about individuals generally falls outside the definition.
• Interviewing an expert about their field is usually information gathering; interviewing them about their own experiences is usually human subjects research.

What About Quality Improvement, Case Reports, and Class Projects?

Most fall outside the definition of research, but intent to publish does not by itself convert a QI project into research, and a classroom exercise can require review the moment data leave the classroom.

Activity	Usually needs IRB?	Deciding factor
Quality improvement or assurance	No	Aim is local improvement, not generalizable knowledge
Program evaluation	Usually no	Whether findings are designed to inform other settings
Single case report	No	Patient authorization for identifiable details is still needed
Case series of 3 or more	Often yes	Systematic collection with comparative intent
Public health surveillance	No	Explicitly excluded when conducted by a public health authority
Oral history and journalism	Usually no	Focus on specific individuals, not generalizable conclusions
Classroom exercise	Depends	Whether data are retained, published, or shared externally
Pilot or feasibility study	Yes	Intent to inform a later generalizable study

 

Secondary Data and Publicly Available Datasets

• Analysis of fully de-identified data with no access to the key is generally not human subjects research.
• If you hold, or can readily obtain, the re-identification key, the data remain identifiable and review applies.
• Public availability is not the test. Identifiability is. A public dataset containing identifiers still involves human subjects.
• Restricted-use datasets typically carry data-use agreements that impose obligations independent of IRB approval.
• Combining 2 or more de-identified datasets can re-create identifiability; assess the merged product, not each source.

Review Pathways

Every submission is routed to 1 of 3 pathways. The pathway determines who reviews the study, how long it takes, and what ongoing oversight applies. Investigators may propose a pathway; only the IRB can assign one.

Pathway	Risk level	Reviewer	Typical turnaround
Exempt	Minimal, listed categories	IRB staff or chair designee	1-3 weeks
Expedited	No more than minimal	1 or more experienced members	2-6 weeks
Full board	Greater than minimal	Convened quorum at a meeting	6-12 weeks
Not human subjects	Not applicable	IRB staff determination	3-10 days

 

Exempt Review

Exempt does not mean unreviewed. It means the study, once confirmed to fit a listed category, is excused from continuing review. Categories 2 and 3 may require limited IRB review of privacy and confidentiality safeguards.

Category	Covers
1	Normal educational practices in established educational settings
2	Surveys, interviews, and observation of public behavior, subject to identifiability limits
3	Benign behavioral interventions with adult participants who prospectively agree
4	Secondary research on identifiable data or biospecimens under defined conditions
5	Federal demonstration projects on public benefit or service programs
6	Taste and food quality evaluation and consumer acceptance studies
7	Storage or maintenance of data or biospecimens under broad consent
8	Secondary research use of data or biospecimens under broad consent

 

Expedited Review

Expedited review applies to minimal-risk research falling within published categories. The reviewer has full authority to approve or require modifications, but cannot disapprove; only the convened board can do that.

Category	Covers
1	Clinical studies of drugs or devices where an IND or IDE is not required
2	Blood collection by finger stick, heel stick, ear stick, or venipuncture within volume limits
3	Prospective collection of biological specimens by noninvasive means
4	Noninvasive clinical data collection using routinely employed procedures
5	Research on existing data, documents, records, or specimens
6	Voice, video, digital, or image recordings made for research purposes
7	Surveys, interviews, focus groups, and studies of individual or group behavior
8 and 9	Continuing review of previously approved studies in defined circumstances

 

Full Board Review

• Required whenever risk exceeds minimal, or when a protocol involves prisoners, an FDA-regulated intervention with meaningful risk, or a waiver the regulations reserve to the convened board.
• A quorum must be present, including at least 1 member whose primary concerns are nonscientific.
• Approval requires a majority vote of members present; members with a conflicting interest may answer questions but must leave before deliberation and voting.
• Possible outcomes are approval, approval with conditions, deferral pending substantive revision, or disapproval.
• Submission deadlines usually fall 2-3 weeks before the meeting date; missing one costs a full review cycle.

How Long Does IRB Approval Take?

Plan on 1-3 weeks for exempt, 2-6 weeks for expedited, and 6-12 weeks for full board, measured from submission to approval letter and assuming 1 round of revisions. Multi-site studies with reliance agreements routinely take longer.

• Add 2-4 weeks for any study requiring translated consent documents with certified back-translation.
• Add 4-8 weeks for reliance agreement execution across institutions.
• Add time for ancillary approvals that often run in parallel: radiation safety, biosafety, conflict of interest, data security, and scientific review.
• International sites may require host country ethics committee approval plus national regulatory clearance.
• The single largest controllable variable is submission quality; a clean first submission can save 3-6 weeks.

How Does an IRB Make Its Decision?

It applies 7 regulatory approval criteria. The board cannot approve a study that fails any of them, regardless of scientific merit, funding, or investigator seniority.

Composition and Quorum

• At least 5 members with varying backgrounds, including diversity of race, gender, and cultural background.
• At least 1 member whose primary concerns are in scientific areas and at least 1 whose primary concerns are nonscientific.
• At least 1 member unaffiliated with the institution and not part of the immediate family of an affiliated person.
• Additional expertise, including a prisoner representative or a child health specialist, must be present when relevant populations are involved.
• Members may not participate in review of a study in which they have a conflicting interest, except to provide requested information.

The 7 Approval Criteria

Criterion	What the board is checking
Risks minimized	Sound design; procedures already being performed for diagnosis or treatment are used where possible
Risks reasonable	Risks are justified by anticipated benefits and the importance of the knowledge expected
Equitable selection	Recruitment neither targets convenient vulnerable groups nor excludes them without justification
Consent sought	Consent obtained from each participant or a legally authorized representative
Consent documented	Documentation meets requirements, or a valid waiver of documentation is granted
Data monitored	Where appropriate, a plan exists for monitoring data to ensure participant safety
Privacy protected	Adequate provisions protect participant privacy and maintain data confidentiality

 

Single IRB and Reliance Agreements

• Most US federally funded cooperative research must use 1 IRB of record; FDA-regulated multi-site studies commonly follow the same model.
• A reliance agreement transfers review authority, not local responsibility. Site-level obligations for staff training, conflict of interest, and local context persist.
• Local context review typically covers state law on age of majority, mandatory reporting duties, available medical and counseling resources, and community norms.
• Common exceptions include tribal nation research, VA facilities, and studies where a federal agency directs otherwise.
• Start the reliance process before, not after, the protocol is finalized; execution is frequently the critical path.

Building the Submission

A submission is a package, not a form. The board reads the protocol, the consent documents, and every participant-facing material as 1 unit, and inconsistencies among them are the most common reason for revision requests.

Core Documents

Document	Must include
Protocol	Objectives, design, population, sample size justification, procedures, risks, analysis plan
Consent and assent forms	All required elements, key information summary, version number and date
Recruitment materials	Flyers, emails, scripts, and social posts; no promise of benefit, no “free treatment” framing
Instruments	Full surveys, interview guides, and scales, including validated instrument permissions
Data management and security plan	Storage locations, encryption, access list, retention period, destruction method
Site permissions	Signed letters of support from schools, clinics, employers, or community organizations
Training records	Human subjects protection certification and, for trials, GCP training for all key personnel
Conflict disclosures	Financial interests of investigators and, where applicable, the management plan

 

Data Management and Security Plan

• State exactly which direct identifiers you collect and why each is necessary; drop any you cannot justify.
• Describe where data live at each stage: collection device, transfer method, working storage, and archive.
• Specify encryption at rest and in transit, and name the access control mechanism rather than asserting that data are “secure.”
• List every person with access by role, and state how access is revoked when someone leaves the team.
• Give a retention period and a destruction method; “indefinitely” invites a deferral unless a repository plan justifies it.
• Address use of third-party platforms, since survey tools, transcription services, and cloud storage each create a data processor relationship.
• Consider a Certificate of Confidentiality where data are sensitive enough that compelled disclosure is a realistic threat.

Why Do IRB Submissions Get Deferred?

Because of avoidable drafting problems, not scientific weakness. Reading level, mismatched documents, and vague data-security plans account for the majority of first-round deferrals.

Deferral reason	Fix
Consent form above 8th-grade reading level	Rewrite in short sentences; replace technical terms; test readability before submitting
Protocol and consent form disagree	Reconcile procedures, visit counts, time burden, and compensation across all documents
Compensation described inconsistently	State amount, schedule, prorating rule, and tax handling identically everywhere
Recruitment implies benefit	Remove “free,” “cure,” “improve,” and any language promising therapeutic gain
Risks understated or generic	Name specific risks including psychological distress, breach of confidentiality, and legal exposure
No plan for incidental findings	State whether findings are returned, by whom, and with what counseling
Vague data security	Replace adjectives with mechanisms: named platform, encryption standard, access roles
Sample size unjustified	Provide a power calculation or a saturation rationale for qualitative work

 

The Informed Consent Document

The form is the record of a conversation, not a substitute for it. Under the revised Common Rule it must be organized to facilitate comprehension, which means the structure of the document is itself a regulatory requirement.

Required and Additional Elements

Required element	What it must state
Research statement	That the activity is research, its purpose, expected duration, and procedures, identifying those that are experimental
Risks	Reasonably foreseeable risks and discomforts, physical, psychological, social, legal, and financial
Benefits	Benefits reasonably expected, with an explicit statement where no direct benefit is expected
Alternatives	Appropriate alternative procedures or treatments, including the option of no participation
Confidentiality	How records are kept confidential and who may access them, including regulators and sponsors
Compensation for injury	For greater-than-minimal-risk research, whether treatment or compensation is available
Contacts	Whom to contact about the research, about injury, and about participant rights, as 2 or 3 distinct contacts
Voluntariness	That participation is voluntary and withdrawal carries no penalty or loss of entitled benefits

 

6 additional elements apply when relevant:

Additional element	Applies when
Unforeseeable risks	Risks to the participant, embryo, or fetus may be currently unforeseeable
Investigator-initiated termination	Participation may be ended without participant consent
Additional costs	Participation carries costs to the participant
Withdrawal procedures	Orderly withdrawal requires specific steps for participant safety
New findings	Significant new findings may affect willingness to continue
Number of subjects	The approximate number enrolled is material to the decision

 

The 2018 revisions added further disclosures: whether identifiers may be stripped and the data used for future research without additional consent, whether biospecimens may be used for commercial profit and whether the participant shares in it, whether clinically relevant results will be returned, and whether whole genome sequencing may be performed.

The Key Information Summary

• It must appear at the beginning of the form and present the information a reasonable person would want in order to decide whether to participate.
• Target 1 page or less. If it runs past 2 pages, it has become a second consent form.
• Cover 5 things: that this is research, why someone might or might not want to join, the purpose, the procedures, and the key risks and benefits.
• Write it last, after the full form is complete, so that it summarizes rather than duplicates.
• Do not simply lift the first paragraph of the protocol; the summary is written for the participant, not the sponsor.

What Reading Level Should a Consent Form Be?

Aim for 6th to 8th grade for the body of the form and no higher than 8th grade for the key information summary. Many IRBs test with Flesch-Kincaid and return anything above the threshold.

• Keep sentences under 20 words and paragraphs under 5 sentences.
• Use the second person consistently: “you will,” not “the subject will.”
• Define any technical term at first use, in parentheses, in plain words.
• Prefer active voice; passive constructions hide who is doing what to whom.
• Break procedures into a table or a numbered list rather than a narrative paragraph.
• Read the form aloud. Anything you stumble over will stop a participant entirely.

Translation and Certification

• Translate only the IRB-approved English version, and resubmit translations whenever the English version is amended.
• Use a qualified translator, then obtain independent back-translation into English for comparison.
• Submit a certificate of translation accuracy naming the translator and their qualifications.
• Match version numbers and dates across all language versions so that document control remains auditable.
• For a language you did not anticipate, most IRBs permit a short form consent plus an oral presentation with a witness, followed by a full translation for future enrollments.

Annotated Consent Form Skeleton

Section	What goes here
Header	Study title in plain language, protocol number, sponsor, principal investigator, version and date
Key information	The 1-page summary: research, purpose, procedures, key risks, key benefits, alternatives
Why you are being asked	Eligibility criteria stated as inclusion in ordinary language
What will happen	Visit-by-visit table with procedures, time required, and location
Risks	Grouped by likelihood and seriousness; confidentiality breach listed explicitly
Benefits	Direct benefits, or a clear statement that none are expected; societal benefit stated separately
Alternatives	Including the alternative of receiving standard care outside the study
Costs and payment	What participants pay, what they receive, prorating rule, and tax implications
Confidentiality	Who sees the data, how it is stored, retention period, and limits such as mandatory reporting
Future use	Whether data or specimens will be retained, shared, or used for unspecified future research
Voluntariness and withdrawal	How to withdraw, what happens to already-collected data, and any safety steps required
Contacts	Investigator, 24-hour medical contact where relevant, and the IRB office for rights questions
Signature block	Participant, person obtaining consent, and where required a witness or legally authorized representative

 

The Informed Consent Process

Consent is a conversation held under conditions that permit a real choice. A signed form obtained in a hallway, in 2 minutes, from a person in pain is legally documented and ethically void.

Capacity, Comprehension, and Voluntariness

Element	What to assess	How to assess it
Capacity	Ability to understand, appreciate, reason, and express a choice	Structured capacity assessment; reassess if condition fluctuates
Comprehension	Actual understanding of purpose, risks, and voluntariness	Teach-back: ask the participant to explain the study in their own words
Voluntariness	Freedom from pressure by clinicians, employers, family, or community leaders	Consent by a neutral person; private setting; explicit permission to decline

 

• Allow adequate time to consider, and permit the participant to take the form away and discuss it with family.
• Separate the treating clinician from the consenting researcher wherever therapeutic misconception is a risk.
• State plainly that declining will not affect care, grades, employment, or immigration status, whichever applies.
• Document the process in the study record: who consented the participant, when, where, and what questions were asked.

Is Paying Participants Coercive?

No. Payment is not coercion, which requires a threat of harm. The real concern is undue influence: an offer so large that it overrides a reasonable person judgment about risk. Fair compensation for time is ethically expected.

• Benchmark payment against local wage rates for the time and inconvenience involved, not against the study budget.
• Prorate payment across visits so that no one is financially trapped into completing a study they want to leave.
• Avoid large completion bonuses, which convert withdrawal into a financial penalty.
• Describe payment as compensation for time and travel, never as a benefit of participation.
• Disclose tax reporting thresholds and any impact on public benefits, which can matter more to participants than the amount.
• For vulnerable populations, the IRB will scrutinize the amount relative to household income, not in absolute terms.

Documentation Methods

Method	When used	Requirements
Wet signature	Default for most research	Participant signs and dates; copy provided to the participant
LAR signature	Participant lacks capacity	Authority defined by applicable state or national law; assent of participant still sought
Impartial witness	Participant cannot read	Witness observes the entire process and attests that information was accurately conveyed
Thumb impression	Illiterate participant, permitted in many jurisdictions	Requires an impartial witness signature alongside
Electronic consent	Remote or digital studies	Identity verification, tamper-evident record, and participant access to a copy
Audio-visual recording	Required for certain trials in India and for some vulnerable populations	Recorded with consent; stored with the same protections as clinical data
Short form	Language barrier not anticipated in advance	Short form in participant language plus written summary in English, with a witness

 

When Can Informed Consent Be Waived?

When 4 conditions are all met: the research is no more than minimal risk, the waiver will not adversely affect participant rights and welfare, the research could not practicably be carried out without it, and participants receive pertinent information afterward where appropriate.

Waiver type	What it removes	Typical use
Waiver of consent	The consent process itself	Retrospective chart review; large-scale registry analysis
Alteration of consent	One or more required elements	Deception studies where full disclosure would invalidate the design
Waiver of documentation	The signature, not the process	Online surveys; research where the signature is the only identifiable record
Broad consent	Study-specific consent for future use	Biobanks and data repositories; cannot be applied retroactively
Screening waiver	Consent for eligibility screening only	Obtaining information to determine eligibility before full consent

 

• For identifiable data or biospecimens, a fifth condition applies: the research must be impracticable without using them in identifiable form.
• Waiver of documentation is available where the only record linking participant to research would be the consent form and the principal risk is breach of confidentiality, or where the research is minimal risk and involves no procedures requiring written consent outside the research context.
• FDA-regulated research has narrower waiver provisions; do not assume Common Rule flexibility transfers.

Assent, Parental Permission, and Re-consent

Age group	Typical approach	Documentation
Under 7 years	Verbal explanation; assent often waived as developmentally inappropriate	Parental permission only
7-12 years	Simplified written assent form, roughly 3rd-grade reading level	Child signature or mark, plus parental permission
13-17 years	Assent form close to adult form in content, simplified in language	Adolescent signature plus parental permission
18 and over	Full consent	Participant signature

 

• Permission from both parents is required for research involving greater than minimal risk without direct benefit, unless 1 parent is deceased, unknown, incompetent, or not reasonably available.
• A child dissent should be honored where the research offers no prospect of direct benefit.
• Re-consent is required when a participant reaches the age of majority during a study and data collection continues.
• Re-consent is also required when significant new risk information emerges, when procedures change materially, or when a participant regains capacity previously lost.
• Assent waivers are permitted where the intervention holds out a prospect of direct benefit available only in the research context.

Populations Requiring Additional Protection

Additional protections do not mean exclusion. Reflexively barring a group from research denies it the benefits of evidence, which is itself a justice failure. The obligation is to add safeguards, not to avoid the population.

Children, Pregnant Participants, Neonates, and Prisoners

Population	Governing subpart	Core requirement
Pregnant participants and fetuses	Subpart B	Preclinical and clinical data must precede; risk to the fetus minimized
Prisoners	Subpart C	Full board review with a prisoner representative; permissible categories are limited
Children	Subpart D	Risk-benefit category determines whether 1 or 2 parents must give permission
Neonates of uncertain viability	Subpart B	Additional restrictions; no added risk from the research itself

 

• The 4 permissible risk categories for pediatric research are: minimal risk; greater than minimal risk with prospect of direct benefit; minor increase over minimal risk without direct benefit but likely to yield vital knowledge about the condition; and research otherwise not approvable that requires federal panel review.
• Prison research must fit 1 of the permitted categories, and advantages of participation must not be so great relative to prison conditions that judgment is impaired.
• A participant who becomes a prisoner mid-study triggers immediate notification to the IRB and suspension of that participant enrollment pending Subpart C review.

Impaired or Fluctuating Capacity

• Assess capacity at the time of consent, not by diagnosis. Many people with dementia, psychiatric illness, or intellectual disability retain decisional capacity for low-risk research.
• Where capacity fluctuates, consent during a lucid interval and reassess at each subsequent contact.
• Consider advance research directives and prospectively identified surrogates for progressive conditions.
• Seek assent even when a legally authorized representative provides consent, and treat sustained dissent as refusal.
• Confirm who qualifies as a legally authorized representative under local law; the hierarchy for research often differs from the hierarchy for clinical care.

Students, Employees, and Hierarchical Relationships

• The concern is voluntariness: a participant who depends on the researcher for grades, evaluations, references, or shifts cannot freely decline.
• Use a neutral third party to recruit and consent, and shield participation status from the person holding authority.
• Where course credit is offered, provide an equivalent non-research alternative of comparable time and effort.
• Recruit broadly rather than from your own classroom, clinic, or team where the science permits.
• Report results in aggregate so that individuals cannot be identified within a small unit or cohort.

Low-literacy and Economically Vulnerable Participants

• Low literacy affects the consent method, not the person’s right to participate.
• Use oral presentation with a witness rather than a simplified 1-page form that omits material risk.
• Use visual aids, illustrated flip charts, and locally recorded audio for complex procedures.
• Watch for therapeutic misconception in settings where research participation is the only route to medical care.
• Ensure compensation covers real costs of travel, childcare, and lost wages without becoming the reason for participation.
• Address post-trial access explicitly where an effective intervention would otherwise be unavailable locally.

Harder Contexts

The standard framework assumes a competent adult consenting in advance to a defined set of procedures. The situations below break that assumption in different ways, and each has developed its own set of accommodations.

Emergency Research and Exception From Informed Consent

• EFIC under 21 CFR 50.24 permits enrollment without prior consent when the condition is life-threatening, available treatments are unproven or unsatisfactory, and obtaining consent is not feasible.
• It requires community consultation and public disclosure before the study begins, plus public disclosure of results afterward.
• An independent data monitoring committee is mandatory.
• The investigator must attempt to contact a legally authorized representative within a defined therapeutic window before enrolling.
• Consent for continued participation must be obtained from the participant or representative as soon as feasible.
• A process for honoring opt-out, such as a community-wide bracelet or registry, is expected.

Deception and Debriefing

• Deception requires an approved alteration of consent and a showing that the research could not be conducted without it.
• It is permitted only for minimal-risk research; deception about physical risk is not approvable.
• Debrief promptly after participation, disclosing the deception, its purpose, and why it was necessary.
• Offer participants the option to withdraw their data after debriefing, and record that choice.
• Where immediate debriefing would compromise the study, the IRB may permit delayed debriefing at the end of data collection with a justification.
• Distinguish deception from incomplete disclosure; withholding the specific hypothesis is usually acceptable and is not deception.

Biobanking, Genomics, and Incidental Findings

• Decide and disclose in advance whether the biobank operates on broad consent, tiered consent, or study-specific consent for each future use.
• State whether specimens may be used commercially and whether participants share in any resulting profit.
• Address whether whole genome sequencing may be performed, which is now an explicit required disclosure.
• Set a return-of-results policy covering 3 categories: no return, return of medically actionable findings only, or return on request.
• Where results are returned, specify who delivers them, what counseling is available, and whether confirmation in a clinical laboratory is required.
• Recognize that genomic data implicate biological relatives who never consented, and address family implications in the form.
• State the withdrawal policy honestly: destroying specimens is possible, but retracting data already shared with a repository or published is not.

Online and Platform-recruited Research

• Waiver of documentation is common, but the consent process still applies; a click-through must present the same substantive information.
• Verify eligibility, particularly age, with a mechanism more robust than a self-report checkbox where risk warrants it.
• Disclose all data collected automatically, including IP address, device metadata, and platform identifiers.
• Name the survey platform and its data location, since a US-hosted tool collecting EU or Indian participant data triggers separate privacy obligations.
• Address bot and fraudulent-response detection in the protocol, since screening out fraudulent submissions involves handling participant data.
• For crowdwork platforms, treat compensation as labor: below-minimum-wage rates for extended tasks raise both ethical and IRB concerns.

Community-based and Cross-cultural Research

• Community consultation is not a substitute for individual consent, and individual consent is not a substitute for community permission where local norms require it.
• Obtain permission from recognized authorities where appropriate, then obtain individual consent privately so that community assent does not become community pressure.
• Engage a community advisory board early, with a defined role in protocol design, recruitment, and dissemination.
• Address group harms explicitly: research on a small or identifiable community can stigmatize the group even when no individual is identified.
• Negotiate data ownership, secondary use, and publication review in writing before data collection begins.
• The Havasupai case turned on secondary use beyond the consented purpose; specify permitted uses narrowly and honor those limits.

Is Scraped Data Fair Game for AI Research?

Not automatically. Public availability is a legal question; identifiability and a reasonable expectation of privacy are the regulatory ones. Platform terms of service add a third, independent constraint.

• Content posted in a semi-private forum may carry an expectation of privacy even if technically accessible; the test is contextual, not just technical.
• Quoting a post verbatim can be traced back to its author through search, which makes an otherwise de-identified analysis identifiable.
• Training a model on identifiable data creates a re-identification risk that persists in the model itself, which a data destruction plan does not address.
• Aggregate reporting and paraphrased rather than verbatim examples materially reduce identifiability.
• Terms of service violations are not IRB determinations, but institutions increasingly treat them as compliance matters in their own right.
• Where the corpus concerns a vulnerable group, expect the board to ask about group-level harm even where no individual is identifiable.

After Approval

Approval authorizes the protocol as written, on the date written. Every subsequent departure, discovery, or change carries a reporting obligation, and lapses in this phase are what audits most often find.

Continuing Review, Amendments, and Deviations

• Under the 2018 revisions, continuing review is no longer required for most minimal-risk expedited studies or for studies that have progressed to data analysis only, though many institutions still require an annual status check.
• Submit amendments and obtain approval before implementing any change, except where an immediate change is necessary to eliminate an apparent hazard to a participant.
• Report immediate hazard-driven changes promptly after the fact, typically within 5 working days.
• Distinguish minor deviations, which are logged and reported at continuing review, from major deviations affecting participant rights, safety, or data integrity, which are reported promptly.
• A lapse in approval means all research activity stops, including data analysis, until the study is reapproved; enrolled participants may continue only where stopping would harm them.

What Must Be Reported to the IRB, and How Fast?

Unanticipated problems involving risks, serious adverse events, and serious or continuing non-compliance. Most IRBs allow 5-10 working days, but deaths and safety-critical events commonly require notification within 24-72 hours.

Event	Definition	Typical timeline
Unanticipated problem	Unexpected, related to the research, and suggesting greater risk than previously known	5-10 working days
Serious adverse event	Death, life-threatening event, hospitalization, disability, or congenital anomaly	24-72 hours if related and unexpected
Serious non-compliance	Departure affecting participant rights, welfare, or data integrity	5 working days
Continuing non-compliance	A pattern of departures indicating systemic failure	5 working days
Complaint from a participant	Any complaint that cannot be resolved at study level	10 working days
Breach of confidentiality	Unauthorized access, disclosure, or loss of identifiable data	Immediately, often 24 hours
New risk information	Interim results or external findings affecting the risk-benefit balance	Promptly, with a re-consent plan

 

Audits, Closure, and Records Retention

• Maintain a regulatory binder containing the approved protocol and every version, all approval letters, delegation of authority logs, training certificates, and signed consent forms.
• Consent forms are the single most audited document; check that every signature is dated, that the version used matches the version approved on that date, and that a copy was provided.
• Submit a closure report when data collection and analysis are complete; a study left open indefinitely accumulates continuing review obligations.
• Retain records for at least 3 years after study completion under the Common Rule, 2 years after marketing approval or investigation discontinuation under FDA rules, and 6 years under HIPAA, so apply the longest applicable period.
• Plan post-trial access to a beneficial intervention where participants would otherwise lose it, and state the plan in the consent form rather than deciding at the end.
• Disseminate results to participants and communities where feasible; this is an ethical expectation under Helsinki, not merely a courtesy.

Do I need ethics approval for using AI in my study?

Using an AI tool does not automatically trigger ethics review. What triggers review is whether your project meets your institution’s definition of human subjects research: a systematic investigation designed to produce generalizable knowledge, involving interaction with living individuals or their identifiable private information. AI usually changes how the work is done, not whether the work counts. The practical question is therefore where the AI sits in your workflow.

Common scenarios

What committees actually ask about

• Data flow: which vendor, which servers, which jurisdiction, what retention period, and whether inputs are used to train future models
• Consent: whether existing language covers automated processing and disclosure to an external provider
• Oversight: who reviews AI outputs before they affect a participant or a reported finding
• Bias: whether tool performance varies across subgroups in your sample
• Transparency: whether participants will be told an AI is involved, and whether they can opt out
• Security: deidentification before input, access controls, and an institutional agreement with the provider

Practical guidance

• Ask early, ideally before data collection begins. Retrospective approval is rarely granted, and unapproved processing can render data unusable.
• If your protocol is already approved and you add an AI tool later, file an amendment. Do not assume it is a minor procedural change.
• Prefer institutionally licensed AI services. Consumer accounts often lack the contractual terms committees require, particularly around data retention and training.
• Where you are uncertain, submit a short determination request. Most offices will confirm in writing that a project is not human subjects research, which is useful evidence later.
• Check obligations beyond the IRB. Data protection law, the EU AI Act, funder conditions and journal policy operate independently of ethics approval, and satisfying one does not satisfy the others.

Institutional policy in this area is moving quickly. Treat your own committee’s current guidance as authoritative, and confirm the version in force rather than relying on what applied to your last study.

Working Tools

Pre-submission Checklist

• Threshold determination documented: is it research, are there human subjects, which pathway do you propose.
• Protocol and consent form reconciled line by line on procedures, visits, duration, risks, and compensation.
• Consent form readability tested and confirmed at 8th grade or below.
• Key information summary present, 1 page or less, written after the full form.
• All 8 required elements present, and each of the 6 additional elements either included or knowingly excluded.
• Recruitment materials free of benefit language, with IRB approval version stamps.
• Data security plan naming platforms, encryption, access roles, retention period, and destruction method.
• Every instrument attached in full, with permissions for any copyrighted scale.
• Site permission letters signed and current.
• Training certificates valid for all key personnel; GCP where the study is a trial.
• Conflict of interest disclosures filed and any management plan attached.
• Vulnerable population safeguards addressed, or an explicit statement that none are enrolled.
• Ancillary reviews identified and started in parallel: biosafety, radiation, privacy, scientific review.

Plain-language Substitution Table

Instead of	Write
Randomized	Assigned by chance, like flipping a coin
Placebo	An inactive substance that looks like the study drug but has no medicine in it
Double-blind	Neither you nor your doctor will know which group you are in
Adverse event	An unwanted or unexpected medical problem
Efficacy	How well the treatment works
Venipuncture	A blood draw using a needle in your arm
Subject or participant	You
Discontinue	Stop
Prior to	Before
Utilize	Use
Anonymous	We will not collect your name or anything that could identify you
Protocol	The study plan
Investigational	Still being tested and not yet approved
Withdraw consent	Change your mind and leave the study

 

Common Pitfalls

Pitfall	Why it matters
Starting recruitment before approval	Data collected before approval are typically unusable and cannot be retroactively approved
Treating consent as a signature event	Comprehension and voluntariness are the substance; the form is only evidence
Using an outdated form version	The most common audit finding; version control failures invalidate consent records
Copying a consent form from a prior study	Carries over procedures, risks, and contacts that no longer apply
Promising anonymity while collecting emails	Confidential is not anonymous; the distinction is material and frequently misstated
Ignoring platform and vendor terms	A compliant protocol can still breach a data processor agreement
Skipping local context in reliance	State law on age of majority and mandatory reporting varies and overrides assumptions
Leaving a study open after completion	Generates continuing review obligations and audit exposure with no benefit

 

Frequently Asked Questions

How long does IRB approval take for a student research project?

Typically 1-3 weeks if exempt and 2-6 weeks if expedited, which covers most student work. Build in an extra 2-4 weeks for faculty advisor review and 1 round of IRB revisions, so plan on 6-8 weeks from a finished protocol to a green light. Submitting during summer or winter breaks usually adds time, since boards meet less frequently.

Do I need IRB approval for a survey of my own employees?

Yes, if you intend to generalize or publish the findings. Employee surveys raise a specific voluntariness problem: staff may fear that declining, or answering honestly, will affect their standing. Expect the board to require a neutral recruiter, anonymous responses, aggregate-only reporting, and an explicit statement that participation has no bearing on employment. Purely internal workplace surveys used only to improve local operations usually qualify as quality improvement instead.

What is the difference between exempt and expedited IRB review?

Exempt research fits a listed low-risk category and is excused from continuing review once the determination is made. Expedited research is minimal risk but remains under active IRB oversight, with amendments and reporting obligations continuing throughout. Both are reviewed by 1 person rather than the full board. The practical difference is ongoing burden, not the speed of the first decision.

Can I get retroactive IRB approval for research already conducted?

No. IRBs cannot approve research retroactively, and data collected without approval generally cannot be used. If it has already happened, disclose it to the IRB immediately rather than waiting. Boards can sometimes issue an acknowledgment permitting analysis of already-collected data where participants were not harmed, but this is discretionary, is recorded as non-compliance, and many journals will still decline the manuscript.

Do I need IRB approval to publish a case report?

Usually not. A single case report is not a systematic investigation designed to produce generalizable knowledge, so it falls outside the definition of research. You do still need written authorization from the patient to publish identifiable details, including images, and most journals require it. A case series of 3 or more patients, especially with comparative intent, often crosses into research and needs a determination.

What is the difference between informed consent and assent?

Consent is a legally effective agreement given by someone with the authority to make the decision. Assent is affirmative agreement by someone who cannot legally consent, most often a child, and it supplements rather than replaces parental permission. Silence or failure to object does not count as assent, and a child sustained dissent should generally be honored where the research offers no prospect of direct benefit.

Do online surveys need a signed consent form?

Rarely. Most online surveys receive a waiver of documentation, because the signature would create the only identifiable record and the principal risk is a confidentiality breach. The consent process itself is not waived: the survey must open with an information page covering purpose, procedures, risks, voluntariness, and contacts, with an affirmative action to proceed. A checkbox is preferable to a bare “continue” button.

Is IRB approval required for research using publicly available datasets?

It depends on identifiability, not public availability. A dataset with all direct identifiers removed and no access to a re-identification key is generally not human subjects research, so no approval is needed. A public dataset containing identifiers, or one that can be re-identified by combining it with another source, does involve human subjects. Request a formal determination in writing; journals increasingly ask for it.

Do I need IRB approval to use ChatGPT to analyze my research data?

Not separate approval, but almost certainly an amendment. Pasting participant data into a commercial AI tool is a transfer to a third-party processor, and if that tool is not named in your approved data security plan, you have deviated from the protocol. 3 things the board will ask about:

• Whether inputs are retained or used for model training. Consumer tiers often permit both; enterprise and zero-retention agreements usually do not. The tier matters more than the vendor.
• Whether the data are genuinely de-identified. Free-text interview responses frequently carry indirect identifiers that a redaction pass misses.
• Whether the tool’s data residency conflicts with GDPR, DPDP Act, or a data-use agreement you signed.

Does using AI transcription for research interviews require participant consent?

Yes, in substance. Consent to be recorded is not consent to send that recording to a vendor. Services like Otter, Rev, and Fireflies are subprocessors and belong in both the consent form and the data security plan by name.

• Voice is biometric and identifiable, so de-identifying the transcript does not de-identify the audio file.
• For PHI, confirm a business associate agreement exists before uploading anything.
• Check the retention default. Several platforms keep audio indefinitely unless deletion is configured.
• Meeting platforms with automatic AI note-taking create the same exposure without anyone choosing to use a transcription service.

Do I have to tell participants that AI is being used in the study?

Disclose whenever a reasonable person would want to know, which is the same standard governing the key information summary. The test is materiality, not whether AI is technically involved.

Disclosure is expected when AI determines eligibility or assignment, drives an adaptive intervention, generates content the participant reads or interacts with, or sends participant data outside the study team. Disclosure is generally unnecessary for back-end statistical tooling that touches no identifiable data and changes nothing about the participant experience. Where an AI system produces clinically relevant output, address accuracy limits and human oversight explicitly rather than describing the tool as assistive.

Can I use AI to write my IRB application or consent form?

Yes, and no regulation forbids it, but you remain fully accountable for every claim in the submission. Boards have grown adept at spotting AI-drafted text, and it tends to fail in predictable ways.

• Fabricated or misattributed regulatory citations, particularly to CFR subsections and ICH sections that do not exist.
• Generic risk language that never names the specific risks of your procedures.
• Reading level creep, since default output usually lands at 11th-12th grade rather than 8th.
• Internal contradictions between the protocol and the consent form when the 2 were generated separately.

Separately, avoid pasting an unpublished protocol into a consumer tool: sponsor confidentiality terms and institutional IP policy often prohibit it. A growing number of institutions now require disclosure of AI assistance on the submission form itself.