The Purpose of the IRB
An Institutional Review Board, or IRB, is a formally designated committee responsible for reviewing and monitoring research involving human subjects to ensure the rights, safety, and welfare of participants are protected. Federal regulations require IRB review for research conducted or funded by covered federal agencies and for research at institutions receiving federal research funding.
Levels of IRB Review
Exempt review applies to certain minimal-risk research categories defined by regulation, such as research involving existing, publicly available, de-identified data, and typically requires a determination that the research qualifies for exemption rather than full committee review. Expedited review applies to minimal-risk research that does not qualify for exemption but involves only minor procedures, and can be conducted by one or more experienced reviewers rather than the full board. Full board review is required for research involving more than minimal risk, requiring review and vote by the convened IRB membership.
Informed Consent
Informed consent is a cornerstone of human subjects protection, requiring that participants receive clear information about the study's purpose, procedures, risks, benefits, and their right to withdraw at any time without penalty, before voluntarily agreeing to participate. The IRB reviews consent documents to ensure they meet regulatory requirements and are written in language understandable to the target participant population.
HIPAA Research Provisions
HIPAA includes specific provisions applicable to research, including the option for an IRB or privacy board to grant a waiver of authorization when research meets specified criteria, such as posing minimal privacy risk and being impracticable to conduct without the waiver. Researchers may also access a limited data set under a data use agreement, or use fully de-identified data outside HIPAA's scope entirely.
Data Use Agreements
A data use agreement establishes the permitted uses and disclosures of a limited data set, which excludes direct identifiers but may retain dates and geographic information more granular than de-identified data allows. Data use agreements obligate the recipient to implement appropriate safeguards and prohibit re-identification attempts, providing an important compliance tool that facilitates research while protecting patient privacy.