The federal regulations that apply to all OU human subject research.
- Department of Health and Human Services (DHHS) 45 CFR 46: Subparts A, B, C, D
- Regulations that are applicable to select protocols:
- Food and Drug Administration regulations
- Health Insurance Portability Accountability Act (HIPAA), Family Educational Rights and Privacy Act (FERPA) or General Data Protection Regulation (GDPR)
- Funding agency requirements
- Oklahoma state law
The ethical principles set forth in the Belmont Report.
- Respect for persons: Recognition of the personal dignity and autonomy of individuals and special protection of those persons with diminished autonomy.
- Beneficence: An obligation to protect persons from harm by maximizing anticipated benefits and minimizing possible risks of harm.
- Justice: Requires that the benefits and burdens of research be distributed fairly.
- Identify applicable requirements and/or protections for the international site:
- For research conducted at an international location, the investigator identifies local regulations, laws, or ethics review requirements for human subject protection. If local Ethics Committee or IRB review is required, the investigator provides the OU IRB with a copy of that review and approval.
- Cultural consultation.
- The investigator inform the IRB of any relevant cultural norms or customs particularly regarding recruitment or informed consent.
- The IRB may obtain a cultural consultant to assist in the review of issues which require expertise beyond or in addition to that available on the IRBs. Cultural consultants provide comments, concerns, and translations in writing to the IRB on protocols involving non-English speaking subjects, and/or subjects from a foreign culture.
For research conducted at a non-OU facility: a letter of support is required from the outside facility approving the conduct of research on the premises. This is required before the OU IRB will approve the research study at a non-OU location/facility.
For research reviewed by an external (non-OU) IRB: a reliance agreement is required between OU and the external IRB's organization. The agreement defines the roles and responsibilities of each organization and investigators, as well as the methods of communication between the reviewing, external IRB and the relying site (OU). The OU investigator must also register the study with OU by submitting a 'Relying on an External IRB' application in iRIS.
Activities that meet the federal regulatory definition of “research” with a “human subject” require IRB review. Secondary Research involves “re-using identifiable information and identifiable biospecimens that are collected for some other ‘primary’ or ‘initial’ activity.”
If investigators are unsure whether their proposed activity must be submitted to the IRB, investigators are strongly encouraged to create and submit a Determination of Human Subject Research Worksheet to the IRB.
The IRB website provides general information on IRB review types, IRB meeting dates, IRB membership rosters, etc.
Researchers are encouraged to contact the IRB for consultation and a preliminary interpretation of the most appropriate application type. Ultimately, the IRB will choose the type of review based on the full application relative to the regulatory and ethical framework.
Submit a modification to the IRB via the Modification/Notification form in iRIS. Changes may not be initiated without IRB review and approval, except where necessary to eliminate immediate hazard. Such incidents must be reported to the IRB within 30 calendar days. Changes may also be requested as part of the continuing review submission.
At a minimum, research records should be maintained for six (6) years after completion of the study. Longer retention may be required by sponsors or for studies that fall under the authority of other agencies.
Ex. Responsibility log, ICFs (no PHI), records submitted to IRB with evidence of approval, data collection forms, records of disposition of drug/device, participant enrollment log, signed/dated CVs, monitoring reports
45 CFR 46.115(b) – three years after research completion
HIPAA forms, DUAs, BAAs, and any communication, action, activity, designation required by Privacy Regs to be documented.
45 CFR 164.530(j) – six years from the date of creation or the date when it was last in effect (whichever is later)
Researchers should also consult with the study sponsor or funding agency, when applicable.
- Health Insurance Portability and Accountability Act (HIPAA) is a federal regulation designed to protect the use and disclosure of Protected Health Information or PHI. PHI is defined as any of the 18 HIPAA identifiers in combination with health information transmitted or maintained in any form (electronic, paper, or oral) that relates to the past, present or future physical or mental health or conditions of an individual.
- Family Educational Rights and Privacy Act (FERPA) isa federal law that protects the privacy of personally identifiable information contained within a student’s educational record.
- General Data Protection Regulation (GDPR) is a regulation affecting the way data is processed in the European Economic Area (EEA). This regulation increases the rights afforded to research participants and reshapes the way organizations handle and process personal data from individuals located in the EEA.
Privacy concerns people.
The following are considerations and strategies for respecting the privacy of potential participants:
- Consider the methods used or setting where potential participants are identified. What is the targeted study population's expectation of privacy, both in person and online?
- Only approach individuals known to you or make contact on behalf of someone the individual knows.
- Comply with privacy guidelines of applicable professional associations and scholarly disciplines (e.g., oral history, anthropology, psychology).
- Access the minimum amount of information necessary.
Confidentiality concerns data.
Confidentiality refers to the researcher’s agreement with the participant about how the participant’s identifiable private information will be handled, managed, and disseminated. In the IRB application, investigators describe their plan to preserve the confidentiality of identifiable data, including:
- controls on storage, handling, and sharing of data;
- physical security measures (e.g., locked facility, limited access);
- data security (e.g., password-protection, data encryption) see IRB Data Security Guidance ;
- safeguards to protect identifiable research information (e.g., coding, certificate of confidentiality);
- procedures employed when sharing material or data, (e.g., honest broker (if applicable), written agreement with recipient not to re-identify); and
- measures that you will take to secure and safeguard confidentiality if protocol involves storing or sharing information or tissue/specimens/data for use in current or future research.
The Department of Health and Human Services defines minimal risk to mean “the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests” [45 CFR 46.102(2)(i)].
Research risks may be categorized as physical, psychological, sociological, economic, occupational, and legal.
In order to approve human research, the IRB must determine that potential risks to subjects are reasonable in relation to anticipated benefits to subjects, science, and society.
- Using procedures already being conducted for non-research reasons
- Incorporating criteria to exclude “at risk” subjects
- Implementing safeguards to protect the rights and welfare of protected groups vulnerable to coercion or undue influence
- Choosing the least intrusive design that yields valid data (outcomes vs. randomized intervention; comparative drug vs. placebo)
- Conducting safety monitoring including safety labs and other assessments
- Planning for responding to clinically significant abnormalities including withdraw of study product and re-challenge with product, if appropriate
- Including provisions for medical services or professional intervention (e.g., counseling) in the event of adverse events
- Adopting strategies for research with a focus on, treatment for, or potential for suicidal ideation or behaviors.
- Ensuring protections to secure confidential or private identifiable information
- Establishing data and safety monitoring
- Implementing routine quality improvement assessments to ensure the conduct of the study is consistent with the IRB-approved protocol
- Obtaining a Certificate of Confidentiality to protect against compulsory legal demands such as subpoena
Institutional conflicts of interest can occur whenever the external financial interests or business relationships of the University or one of its officials are such that their actions could affect, or could reasonably appear to affect, the conduct review or oversight of the University’s research. It is the policy of the University that all institutional conflicts of interest, whether real or perceived, must be fully disclosed.
The reported conflict must be properly identified and either managed or eliminated prior to initiating any contract, sponsored project, dedicated gift, or transaction that might appear to be influenced by the conflict. The institutional policy is implemented using a three-step approach: 1) disclose always, 2) assess the potential for institutional conflicts of interest, and 3) manage the conflict in most cases, and prohibit the activity when necessary to preserve the University’s mission or protect the public’s interest.
A COI management plan must be approved by the VPR for HSC or the university official for Norman campus. It must then be submitted to the IRB to be reviewed with the study submission.
Major or minor protocol deviations or unanticipated problems.
A protocol deviation is any change, divergence, or departure from the research study approved by the IRB.
Findings documented in for-cause or routine QI evaluation reports.
A UP is any incident, experience, or outcome that meets all three (3) of the following criteria:
- is unanticipated or unexpected;
- is related or possibly related to the research; and
- places participants or others at greater risk of harm than previously known or recognized.
Investigators are required to submit to the IRB within five (5) University business days of discovery any UP, both internal and external, involving risks to participants or others.
- The deviation has harmed or posed a significant or substantive risk of harm to a research participant (this is also an unanticipated problem).
• A research participant received the wrong treatment or incorrect dose.
• A research participant met withdrawal criteria during the research project but was not withdrawn.
• A research participant received an excluded concomitant medication.
- The deviation compromises the scientific integrity of the data collected for the research project.
• A research participant was enrolled but does not meet the protocol's eligibility criteria.
• There was a failure to treat research participants per protocol procedures that specifically relate to primary efficacy outcomes (if it involves patient safety, it meets the first category above).
• There was a change the protocol without prior IRB approval (except where necessary to eliminate an apparent immediate hazard to the participant).
• Inadvertent loss of samples or data.
- The deviation is a willful or knowing breach of human participants research protection regulations, policies, or procedures on the part of the investigator(s).
• Failure to obtain informed consent prior to initiation of research project-related procedures.
• Research or medical records were falsified.
• Tests or procedures were performed beyond the individual's professional scope or privilege status (credentialing).
- The deviation involves a serious or continuing noncompliance with federal, state, local, or University human subjects research protection regulations, policies, or procedures.
• Work conducted under an expired professional license or certification.
• Failure to follow federal and/or local regulations and intramural research or University policies.
• Repeated minor deviations.
- The deviation is inconsistent with the HRPP’s research, medical, or ethical principles.
• A breach of confidentiality.
• Inadequate or improper informed consent procedure.
Prior to describing delegation, the Principal Investigator should indicate his/her [your?] direct involvement in the conduct of the study including recruitment, obtaining consent, assessing eligibility criteria, events, and protocol procedures.
For example, an investigator may delegate many tasks to study staff, if the tasks is within their scope of practice. Anyone delegated a task must be qualified by education, training, and experience (and state licensure where relevant). In addition, the investigator must ensure that the delegation is consistent with any specifications in the research protocol or stipulations by the IRB. Medical procedures and assessments (including adverse event causality, un-blinding, treatment decisions) should not be inappropriately delegated to unqualified staff. Using task delegation logs is a best practice for clinical research, to define roles and indicate who serves in the PI’s absence.
Investigators designate which study personnel should be authorized to obtain informed consent on the IRB application for review by the IRB. The investigator must assure that the study personnel are informed regarding their obligations and commitments.
- Respect Privacy – consider time and setting for recruitment activities, including online settings
- Equitable Selection - Proportionate Distribution; not targeting or excluding based on convenience
- Avoid Undue Influence – No finders fees or recruitment bonus to study staff; appropriate IRB-approved ads; use of third party if investigator is an authority figure
- No Cold Contacts – contact by personnel with legitimate access or through individuals with established relationships
- Compensation – appropriate amount, method, and timing
Please contact the IRB for additional provisions that can be applied to your study design.
Be prepared to describe the consent process for your research keeping the following in mind:
- The informed consent process involves the “who”, “what”, “when’, “where”, and “how” that result in a valid, effective informed consent. Investigators indicate in the IRB application which study personnel will obtain consent and describe the proposed process in the research description.
- In developing a robust process, consider techniques to ensure comprehension and voluntary participation, such as:
- plain language documents; visuals, graphics;
- steps to minimize coercion or undue influence; &
- teach-back questions to assess understanding.
- Potential participants must be allowed ample time to read, review, discuss and consider participation.
- While the informed consent process is prospective and takes place prior to any research activity, consent should also be an ongoing educational interaction between the investigator and the research participants that continues throughout the study. Enrolled participants must be provided any new information which may affect their willingness to continue to participate.
Because children and some adults with impaired consent capacity are not legally considered capable of providing consent, regulations do allow a parent to give “permission” for the individual to participate when assent to participate is obtained from the child (or adult with impaired consent capacity). Depending on the risk level of the study, provisions may be necessary for permission of both parents.
One of the new regulatory requirements from the Revised Common Rule states that:
“Informed consent must begin with a concise and focused presentation of the Key Information that is most likely to assist a prospective subject in understanding the reasons why one might or might not want to participate.” [45CFR 46.116(a)(5)(i)]
Key Information is not defined in the Common Rule, but the regulation indicates that it should be brief, presented first, and zero-in on the key pros and cons a reasonable person would weigh rather than having that information buried deep in a detailed consent document.
It is generally NOT inclusion or exclusion criteria except when the criteria affect choice. For instance, if a key factor involves criteria that may be undesirable to the reasonable person (e.g., “you might not want to participate if you would be unable or unwilling to abstain from alcohol for the next 30 days.”).
The regulation is not prescriptive or rigid about the format or content of Key Information. The intent is to allow consent documents (and the process) to be tailored to the particular research. The Preamble to the Revised Common Rule acknowledges that, for some relatively simple studies, the entire document will be brief. In such cases, the key information may fit within a paragraph vs. an entire page given the context of the study. Alternately, the shorter consent form as a whole may take the place of the separate key information section if such information is presented succinctly and in lay language.
Some research projects would not be possible if informed consent were required. The IRB may approve a consent procedure that does not include, or which alters, some or all of the elements of informed consent, or may waive the requirements to obtain informed consent, if it finds and documents that the research meets the Common Rule Regulatory conditions:
- The research involves no more than minimal risk to the subject.
- The rights and welfare of subjects will not be adversely affected.
- The research could not practicably be carried out without the requested waiver or alteration.
- Whenever possible, the subjects or legally authorized representatives will be provided with additional pertinent information after they have participated in the study.
- If the research involves using or accessing identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format. Private information/specimens are “identifiable” if the investigator may ascertain the identity of the subject or if identifiers are associated with the information (e.g., medical records). This could be any of the 18 HIPAA identifiers including dates of service.
NOTE: FDA also allows waiver of informed consent for FDA-regulated minimal risk research. Where HIPAA applies to the research, a HIPAA waiver of Authorization may also be required.
IRB regulations allow the IRB to waive the requirement to obtain a signed consent document for some or all the subjects if certain conditions are met.
The IRB waives the signature requirement but may require the investigator to provide participants with a document or written statement regarding the research.
The following are options for waiving documentation:
- The only record linking the subject and the research would be the consent document and the principal risk would be harm resulting from breach of confidentiality. Under this option, each participant (or legally authorized representative) must be asked whether (s)he wants to sign a consent document; if the participant agrees to sign a consent document, only an IRB approved version should be used.
- The research presents no more than minimal risk and involves no procedures for which written consent is normally required (i.e., a cover letter on a mailed survey or phone script)
- Subject or LAR is a member of a distinct cultural group or community in which signing forms is not the norm. The research is no greater than minimal risk and there is an alternative mechanism for documenting that informed consent was obtained.
· Randall Hewes, Ph.D., Senior Associate Vice President for Research and Partnerships, serves as the Institutional Official for the Norman Campus.
· Jason Sanders, M.D., Senior Vice President & Provost, serves as the Institutional Official for the Health Sciences Center Campus.
The procedures to satisfy this should offer a safe, confidential, and reliable channel for current, prospective, or past research subjects (or their designated representative) allowing them to discuss problems, concerns and questions, or obtain information.
The IRB recommends the consent document(s) include a reliable, dedicated pager or phone number for the principal investigator and after-hours emergencies.