Association for the Accreditation of Human Research Protection Programs (AAHRPP)

AAHRPP Accreditation
Page last updated 09/23/2020

9/23/2020: University of Oklahoma HRPP Awarded Full Accreditation

We are pleased to announce that the University of Oklahoma HRPP was awarded Full Reaccreditation by AAHRPP on September 15, 2020. The accreditation process involves evaluation of all aspects of the HRPP, including the IRB, conflict of interest, Office of Research Administration, education, research teams, and many other research administration and review bodies on campus. 

We would like to thank the faculty and staff on the OU-Norman, OUHSC, and OU-Tulsa campuses, as well as our many affiliate partners from the OKC and Eastern Oklahoma VA Health Care Systems, Dean McGee Eye Institute, Rogers State University, Cameron University, and more, who were involved in providing support and participating in the AAHRPP site visit in July 2020. 

Thank you for your dedication to protecting the rights and welfare of research participants. 

5/14/2020: Remote Site Visit Announced for AAHRPP Reaccreditation

A site visit will be conducted remotely Wednesday, July 29 through Friday, July 31.

Hold these dates on your calendar to ensure availability because AAHRPP will randomly select and interview investigators, research staff, IRB members, and other individuals involved in human subjects research. Individuals selected will be expected to attend and participate in these interviews.

The HRPP Office will notify individuals directly that are selected for an interview as soon as we receive this information and provide other logistical information.

Please contact your respective campus HRPP Office if you have any questions.
HSC: 405-271-2045 | Norman: 405-325-8110

What is AAHRPP? 

The Association for the Accreditation of Human Research Protection Programs, Inc. (AAHRPP) promotes high-quality research through an accreditation process that helps organizations worldwide strengthen their human research protection programs (HRPPs).

An independent, non-profit accrediting body, AAHRPP uses a voluntary, peer-driven, educational model to ensure that HRPPs meet rigorous standards for quality and protection. To earn accreditation, organizations must provide tangible evidence—through policies, procedures, and practices—of their commitment to scientifically and ethically sound research and to continuous improvement.

What is the value of accreditation? 

AAHRPP-accredited organizations

  • Earn the respect and meet the expectations of their peers. 
  • Play a leadership role in collaborative efforts. 
  • Gain a competitive edge with sponsors and funders. 
  • Reduce the risk of non-compliance. 
  • Enhance their standing with U.S. federal agencies. 
  • Benefit from a common commitment to continuous quality improvement. 

Why is accreditation important? 

Through accreditation, an Organization can demonstrate the overall excellence of its research program by providing the most comprehensive protections for research participants. The accreditation process includes application preparation, on-site evaluation, council review, and notification of accreditation status.  As the "gold seal," AAHRPP accreditation offers assurances—to research participants, researchers, sponsors, government regulators, and the general public—that an HRPP is focused first and foremost on excellence.

Content Source: AAHRPP website


Accredited since 2007

Reaccreditation awarded 2010

Reaccreditation awarded 2015

Reaccreditation awarded 2020


AAHRPP Site Visit Guide - Interview Prep

What rules or guidelines are you expected to follow?

The federal regulations that apply to all OU human subject research.

-        Department of Health and Human Services (DHHS) 45 CFR 46: Subparts A, B, C, D

-        Regulations that are applicable to select protocols:

-        Food and Drug Administration regulations

-        Health Insurance Portability Accountability Act (HIPAA), Family Educational Rights and Privacy Act (FERPA) or General Data Protection Regulation (GDPR)

-        Funding agency requirements

-        Oklahoma state law

What ethical standards or guides do you follow?

The ethical principles set forth in the Belmont Report.

-        Respect for persons: Recognition of the personal dignity and autonomy of individuals and special protection of those persons with diminished autonomy.

-        Beneficence: An obligation to protect persons from harm by maximizing anticipated benefits and minimizing possible risks of harm.

-        Justice: Requires that the benefits and burdens of research be distributed fairly.

What information is required for IRB review of international research?

-        Identify applicable requirements and/or protections for the international site:

  •       For research conducted at an international location, the investigator identifies local regulations, laws, or ethics review requirements for human subject protection. If local Ethics Committee or IRB review is required, the investigator provides the OU IRB with a copy of that review and approval.

-        Cultural consultation. 

  •        The investigator inform the IRB of any relevant cultural norms or customs particularly regarding recruitment or informed consent.  
  •        The IRB may obtain a cultural consultant to assist in the review of issues which require expertise beyond or in addition to that available on the IRBs. Cultural consultants provide comments, concerns, and translations in writing to the IRB on protocols involving non-English speaking subjects, and/or subjects from a foreign culture.

How does OU ensure the rights and welfare of participants are protected when the investigator is operating at a non-OU facility, or when relying on an external IRB for review?

For research conducted at a non-OU facility: a letter of support is required from the outside facility approving the conduct of research on the premises. This is required before the OU IRB will approve the research study at a non-OU location/facility. 

For research reviewed by an external (non-OU) IRB: a reliance agreement is required between OU and the external IRB's organization. The agreement defines the roles and responsibilities of each organization and investigators, as well as the methods of communication between the reviewing, external IRB and the relying site (OU). The OU investigator must also register the study with OU by submitting a 'Relying on an External IRB' application in iRIS. 

When does secondary research with specimens or data require IRB review?

Activities that meet the federal regulatory definition of “research” with a “human subject” require IRB review.  Secondary Research involves “re-using identifiable information and identifiable biospecimens that are collected for some other ‘primary’ or ‘initial’ activity.” 

What is the process when determining whether an activity is under the purview of the IRB?

If investigators are unsure whether their proposed activity must be submitted to the IRB, investigators are strongly encouraged to create and submit a Determination of Human Subject Research Worksheet to the IRB.

How do I find out general information about the OU and OUHSC IRBs and human research?

The IRB website provides general information on IRB review types, IRB meeting dates, IRB membership rosters, etc.

Where should I start to determine what type of IRB review will be required?

Researchers are encouraged to contact the IRB for consultation and a preliminary interpretation of the most appropriate application type. Ultimately, the IRB will choose the type of review based on the full application relative to the regulatory and ethical framework. 

How do I request IRB approval for changes while conducting the research?

Submit a modification to the IRB via the Modification/Notification form in iRIS. Changes may not be initiated without IRB review and approval, except where necessary to eliminate immediate hazard. Such incidents must be reported to the IRB within 30 calendar days. Changes may also be requested as part of the continuing review submission.

What is the minimum IRB requirement for maintenance of research records?

At a minimum, research records should be maintained for six (6) years after completion of the study.  Longer retention may be required by sponsors or for studies that fall under the authority of other agencies.

Ex. Responsibility log, ICFs (no PHI), records submitted to IRB with evidence of approval, data collection forms, records of disposition of drug/device, participant enrollment log, signed/dated CVs, monitoring reports

45 CFR 46.115(b) – three years after research completion

HIPAA forms, DUAs, BAAs, and any communication, action, activity, designation required by Privacy Regs to be documented.

45 CFR 164.530(j) – six years from the date of creation or the date when it was last in effect (whichever is later)

Researchers should also consult with the study sponsor or funding agency, when applicable. 

What additional information privacy regulations apply to select protocols?

  • Health Insurance Portability and Accountability Act (HIPAA) is a federal regulation designed to protect the use and disclosure of Protected Health Information or PHI. PHI is defined as any of the 18 HIPAA identifiers in combination with health information transmitted or maintained in any form (electronic, paper, or oral) that relates to the past, present or future physical or mental health or conditions of an individual.
  • Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of personally identifiable information contained within a student’s educational record.
  • General Data Protection Regulation (GDPR) is a regulation affecting the way data is processed in the European Economic Area (EEA). This regulation increases the rights afforded to research participants and reshapes the way organizations handle and process personal data from individuals located in the EEA.

What is the difference between protecting the privacy interests of participants and maintaining the confidentiality of data?

Privacy concerns people.

The following are considerations and strategies for respecting the privacy of potential participants:

  • Consider the methods used or setting where potential participants are identified. What is the targeted study population's expectation of privacy, both in person and online?
  • Only approach individuals known to you or make contact on behalf of someone the individual knows.
  • Comply with privacy guidelines of applicable professional associations and scholarly disciplines (e.g., oral history, anthropology, psychology).
  • Access the minimum amount of information necessary.

Confidentiality concerns data.

Confidentiality refers to the researcher’s agreement with the participant about how the participant’s identifiable private information will be handled, managed, and disseminated. In the IRB application, investigators describe their plan to preserve the confidentiality of identifiable data, including:

  • controls on storage, handling, and sharing of data;
  • physical security measures (e.g., locked facility, limited access);
  • data security (e.g., password-protection, data encryption) see IRB Data Security Guidance ;
  • safeguards to protect identifiable research information (e.g., coding, certificate of confidentiality);
  • procedures employed when sharing material or data, (e.g., honest broker (if applicable), written agreement with recipient not to re-identify); and
  • measures that you will take to secure and safeguard confidentiality if protocol involves storing or sharing information or tissue/specimens/data for use in current or future research.

How do IRB regulations define minimal risk?

The Department of Health and Human Services defines minimal risk to mean “the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests” [45 CFR 46.102(2)(i)].

Research risks may be categorized as physical, psychological, sociological, economic, occupational, and legal. 

How does the IRB assess the risk-benefit ratio of the research?

In order to approve human research, the IRB must determine that potential risks to subjects are reasonable in relation to anticipated benefits to subjects, science, and society.

How might investigators minimize risks in research?

  • Using procedures already being conducted for non-research reasons
  • Incorporating criteria to exclude “at risk” subjects
  • Implementing safeguards to protect the rights and welfare of protected groups vulnerable to coercion or undue influence
  • Choosing the least intrusive design that yields valid data (outcomes vs. randomized intervention; comparative drug vs. placebo)
  • Conducting safety monitoring including safety labs and other assessments
  • Planning for responding to clinically significant abnormalities including withdraw of study product and re-challenge with product, if appropriate
  • Including provisions for medical services or professional intervention (e.g., counseling) in the event of adverse events
  • Adopting strategies for research with a focus on, treatment for, or potential for suicidal ideation or behaviors. 
  • Ensuring protections to secure confidential or private identifiable information
  • Establishing data and safety monitoring
  • Implementing routine quality improvement assessments to ensure the conduct of the study is consistent with the IRB-approved protocol
  • Obtaining a Certificate of Confidentiality to protect against compulsory legal demands such as subpoena

What is OU’s policy on Conflict of Interest (COI)?

Institutional conflicts of interest can occur whenever the external financial interests or business relationships of the University or one of its officials are such that their actions could affect, or could reasonably appear to affect, the conduct review or oversight of the University’s research. It is the policy of the University that all institutional conflicts of interest, whether real or perceived, must be fully disclosed.

The reported conflict must be properly identified and either managed or eliminated prior to initiating any contract, sponsored project, dedicated gift, or transaction that might appear to be influenced by the conflict. The institutional policy is implemented using a three-step approach: 1) disclose always, 2) assess the potential for institutional conflicts of interest, and 3) manage the conflict in most cases, and prohibit the activity when necessary to preserve the University’s mission or protect the public’s interest.

How is researcher COI managed?

A COI management plan must be approved by the VPR for HSC or the university official for Norman campus. It must then be submitted to the IRB to be reviewed with the study submission.

What are examples of events/issues that you report to the IRB?

Major or minor protocol deviations or unanticipated problems. 
A protocol deviation is any change, divergence, or departure from the research study approved by the IRB. 

Findings documented in for-cause or routine QI evaluation reports.

What is an unanticipated problem (UP)?

A UP is any incident, experience, or outcome that meets all three (3) of the following criteria:

  1. is unanticipated or unexpected; 
  2. is related or possibly related to the research; and 
  3. places participants or others at greater risk of harm than previously known or recognized. 
Investigators are required to submit to the IRB within five (5) University business days of discovery any UP, both internal and external, involving risks to participants or others. 

What would be considered a major protocol deviation?

 -    The deviation has harmed or posed a significant or substantive risk of harm to a research participant (this is also an unanticipated problem).


       A research participant received the wrong treatment or incorrect dose.

       A research participant met withdrawal criteria during the research project but was not withdrawn.

       A research participant received an excluded concomitant medication.

-        The deviation compromises the scientific integrity of the data collected for the research project.


       A research participant was enrolled but does not meet the protocol's eligibility criteria.

       There was a failure to treat research participants per protocol procedures that specifically relate to primary efficacy outcomes (if it involves patient safety, it meets the first category above).

       There was a change the protocol without prior IRB approval (except where necessary to eliminate an apparent immediate hazard to the participant).

       Inadvertent loss of samples or data.


-        The deviation is a willful or knowing breach of human participants research protection regulations, policies, or procedures on the part of the investigator(s).


       Failure to obtain informed consent prior to initiation of research project-related procedures.

       Research or medical records were falsified.

       Tests or procedures were performed beyond the individual's professional scope or privilege status (credentialing).


-        The deviation involves a serious or continuing noncompliance with federal, state, local, or University human subjects research protection regulations, policies, or procedures.


       Work conducted under an expired professional license or certification.

       Failure to follow federal and/or local regulations and intramural research or University policies.

       Repeated minor deviations.

-        The deviation is inconsistent with the HRPP’s research, medical, or ethical principles.


       A breach of confidentiality.

       Inadequate or improper informed consent procedure.

What responsibilities and qualifications are required for research investigators?

What is your process for task delegation?

Prior to describing delegation, the Principal Investigator should indicate his/her [your?] direct involvement in the conduct of the study including recruitment, obtaining consent, assessing eligibility criteria, events, and protocol procedures.

For example, an investigator may delegate many tasks to study staff, if the tasks is within their scope of practice. Anyone delegated a task must be qualified by education, training, and experience (and state licensure where relevant). In addition, the investigator must ensure that the delegation is consistent with any specifications in the research protocol or stipulations by the IRB. Medical procedures and assessments (including adverse event causality, un-blinding, treatment decisions) should not be inappropriately delegated to unqualified staff. Using task delegation logs is a best practice for clinical research, to define roles and indicate who serves in the PI’s absence.

Investigators designate which study personnel should be authorized to obtain informed consent on the IRB application for review by the IRB. The investigator must assure that the study personnel are informed regarding their obligations and commitments. 

Describe some key points for ethical and respectful recruitment methods.

  • Respect Privacy – consider time and setting for recruitment activities, including online settings
  • Equitable Selection - Proportionate Distribution; not targeting or excluding based on convenience
  • Avoid Undue Influence – No finders fees or recruitment bonus to study staff; appropriate IRB-approved ads; use of third party if investigator is an authority figure
  • No Cold Contacts – contact by personnel with legitimate access or through individuals with established relationships
  • Compensation – appropriate amount, method, and timing

What additional provisions would you employ for protection of vulnerable populations, groups vulnerable to undue influence, or populations with cultural considerations?

Please contact the IRB for additional provisions that can be applied to your study design.

Describe your consent process.

What is the difference between Informed Consent and the process of obtaining Assent and Parental Permission?

What is Informed Consent Key Information?

Does the Key Information need to be a full page if the entire consent is not much longer than a page?

Under what conditions can informed consent process be altered or waived for minimal risk research?

Under what circumstances can documentation of informed consent be waived?

Who do you contact with a complaint, concern, or suggestions?

OUHSC Contact

865 Research Parkway, Suite 400
Oklahoma City, OK 73104

ph: (405) 271-2045
fax: (405) 271-1677



Norman Contact

Five Partners Place
201 Stephenson Parkway, Suite 4200
Norman, OK 73109

ph: (405) 325-8110



You can also contact the Institutional Officials for concerns or complaints. See the box below for their information.

Who are the Institutional Officials (IO) for the OU and OUHSC IRBs?

·  Randall Hewes, Ph.D., Senior Associate Vice President for Research and Partnerships, serves as the Institutional Official for the Norman Campus.

·  Jason Sanders, M.D., Senior Vice President & Provost, serves as the Institutional Official for the Health Sciences Center Campus.

What provisions do you have in place for receiving and handling a subject complaint or request for information?

The procedures to satisfy this should offer a safe, confidential, and reliable channel for current, prospective, or past research subjects (or their designated representative) allowing them to discuss problems, concerns and questions, or obtain information. 

The IRB recommends the consent document(s) include a reliable, dedicated pager or phone number for the principal investigator and after-hours emergencies.

Who may a subject call outside of the study personnel, about their rights and welfare?

The Director of the HRPP. Each IRB-approved informed consent document must include the IRB phone number.

OUHSC Contact

865 Research Parkway, Suite 400
Oklahoma City, OK 73104

ph: (405) 271-2045
fax: (405) 271-1677

Email Us:

Norman Contact

Five Partners Place
201 Stephenson Parkway, Suite 4300A
Norman, OK 73109

ph: (405) 325-8110

Email Us: