Skip to main content
Research Administration Office
Institutional Review Board (IRB)
iRIS Login

Guidance

The guidance put forth by BYU Human Research Protection Program borrows extensively from the best practices of a variety of academic institutions. The information provided here builds on ideas freely shared between institutions and exists because of the generosity and collegiality demonstrated by the community of professionals who work in the field of human research protections.

Guidance for Researchers

  • The guidance provided here combines the requirements from the federal regulations with the guidelines and best practices set forth by the American Red Cross.

    The collection of blood samples for research purposes requires careful consideration to the amount of blood drawn, the frequency of the draw, and the health of the prospective subjects. In some instances, the collection of blood samples may be considered to present no more than minimal risk to research subjects and may be reviewed by an expedited procedure (45 CFR 46.110). In other instances, the collection of blood samples may be considered to be greater than minimal risk and must be reviewed by the full board review.

    In order for a blood draw to be considered minimal risk, and therefore considered for expedited review, the protocol must follow the process and eligibility criteria outlined below.

    Collection Process

    1. Collection of samples should be done by finger stick, heel stick, ear stick, or venipuncture
    2. The cumulative volume of blood drawn from a healthy adult for any purpose (clinical or research) over an eight-week period of time should not exceed 550ml and collection may not occur more frequently than two times per week
    3. The cumulative volume of blood drawn from other adults or from children for any purpose (clinical or research), may not exceed the lesser of 50 ml or 3 ml per kg in an eight-week period and collection may not occur more frequently than two times per week
    4. No more than three (3) skin punctures should be made in any single attempt to draw blood solely for research purposes

    Adult Subject Eligibility Criteria

    1. At least 18 years old
    2. At least 110 lbs.
    3. Non-pregnant
    4. Generally healthy by self-report
      1. Free of cold and flu symptoms the day of collection
      2. No infections within two weeks prior to collection
      3. No symptoms of a heart condition within the six months prior to collection
      4. No known sickle cell disease
      5. Based on the specifics of a population and the amount of blood planned for collection in one sitting, researchers may need to consider excluding subjects with anemia
    5. Including the study draw, blood donation for clinical or research purposes during the preceding eight weeks will not exceed 550 ml
    6. No more than one blood draw has occurred during the preceding week

    The full board will review all protocols that involve blood sample collection that does not align with the above process and eligibility criteria. When the collection of blood samples is to be done in research that involves greater than minimal risk to subjects (such as monitoring studies that require frequent sampling over a short period of time) the collection must be reviewed by the full board.

    The IRB may request additional safeguards based on the specifics of the population and proposed volume of the draw.

    Consent Language

    Activity: We will draw about {insert teaspoons/tablespoons} of blood by putting a needle into a vein in your arm. This is the standard method used to obtain blood for tests. If more than one draw will occur insert the following sentence: We will take a total of {insert teaspoons/tablespoons} of blood over the course of this study.

    Risk: The risks of having blood drawn from your arm include some pain when the needle goes in and a small risk of bruising and/or infection at that site. Some people get lightheaded, nauseous, or faint. You are less likely to have these problems if you drink at least 2 glasses of water and have a snack before the blood draw {Modify for fasting draws}. The American Red Cross recommends that you do not donate more than 1 pint (32 tablespoons) of blood within a 2 month period. Tell the researchers if you have recently had your blood drawn for any reason.

  • The purpose of this guideline is to clarify when classroom projects are and when they are not under the jurisdiction of the IRB. Furthermore, this proposal seeks to clarify the responsibilities of course instructors and IRB oversight.

    Definitions

    Classroom Projects:

    • Assignments to fulfill course/major requirements which involve interactions with individuals.
    • Typically initiated and completed within a single term.
    • Designed to teach research methods through student interaction with individuals or data about individuals, or designed to help students understand concepts taught in the course.
    • Generally, not intended to create new knowledge or to lead to scholarly publication. (University of Michigan)

    Research:

    • A systematic collection of data from human subjects with the purpose to develop or contribute to generalizable knowledge, which is clarified on the IRB website as:
      • The information contributes to a theoretical framework of an established body of knowledge.
      • The primary beneficiaries of research are other researchers, scholars, and practitioners in the field of study.
      • Publication, presentation or other distribution of the results is intended to inform the field of study.
      • Results are intended to be replicated in other settings (University of Michigan)

    The following student driven projects are considered research:

    • Undergraduate Theses presented at a professional venue.
    • Honor’s Theses
    • Master’s Theses
    • Doctoral Dissertations
    • Pilot studies
    • A student-led classroom project that the instructor may use in his/her own research

    Instructors’ Responsibilities

    Instructors should meet with students as soon as possible and go over these guidelines to determine if the proposed class project could be considered research. If there is a possibility that a class project may fall under the definition of research, instructors are advised to submit an IRB application, and a qualified researcher (SOP GA 106), as the principal investigator. The student researcher would serve as a co-investigator.

    If the class project meets the definition of research:

    • The instructor should assist the student to prepare the appropriate human subjects review application.
    • The instructor should ensure the student has obtained necessary reviews and signatures prior to submitting the application to the college representative to the IRB.

    If the class project does not meet the definition of research:

    • It is the responsibility of the instructor to ensure that the student project does not meet the definition of research.
    • It is the responsibility of the instructor to ensure that the class project is conducted according to the ethical standards of the relevant discipline.
    • Remember that from the participant’s viewpoint, giving out personal information does not differ for a class assignment or a research project. Personal information is personal information. Instructors should advise students to identify the project to participants as a class assignment and be sensitive to the personal nature of the obtained information. Labeling the class project as “research” is inaccurate and misleading to participants.
    • Individuals providing information to students need to be informed that the projects are being conducted to meet a course requirement and that any data collected will not be made public.
    • Students should inform participants that data will be destroyed soon after their assignment or class project is completed.
    • Instructors are advised to tell students that data from human subjects should not contain any personal, identifying information whenever possible.
    • The IRB is available to give feedback on any proposed class project not meeting the definition of research, even though the IRB would not officially act on the project.
    • Any complaints about the project should be reported to and managed by, the instructor, department chair, and depending on the situation, officials of the college.

    Special Considerations

    Instructors should carefully scrutinize class assignments that involve protected populations or sensitive information.

    Protected Populations include, but not limited to:

    • Children/Minors (under the age of 18)
    • Prisoners (now includes non-publicly available secondary data)
    • Pregnant women
    • Fetuses and products of labor and delivery
    • People with diminished capacity to give consent

    Sensitive Information include, but not limited to:

    • Information relating to an individual’s psychological well-being or mental health Information relating to sexual attitudes, preferences, or practices
    • Information relating to the use of alcohol or drugs
    • Information relating to illegal behavior
    • Information that if released could reasonably place the individual at risk of criminal or civil liability or be damaging to the individual’s financial standing, employability, or reputation
    • Information that would normally be recorded in a patient’s medical record and the disclosure could reasonably lead to discrimination, stigmatization, etc.

  • Federal regulations and institutional policy require BYU IRB to determine the adequacy of provisions to protect the privacy of subjects and to maintain the confidentiality of their data. To meet this requirement, federal regulations require researchers to provide a plan to protect the confidentiality of research data. Today, the majority of data is at some point collected, transmitted, or stored electronically.

    The purpose of this guidance is to help the research community develop best practices for managing electronic data and hardcopy files. These best practices will need to adapt as technology evolves, so it is important that research teams keep current with the guidance and resources offered by the University. In addition, research is now a global enterprise, and investigators should understand the international laws or regulations that may apply when conducting research outside the United States.

    The Principal Investigator (PI) is responsible for ensuring that research data is secure when it is collected, stored, transmitted, or shared. All members of the research team should receive appropriate training about securing and safeguarding research data. For example, the research team should understand they need to document their standard practices for protecting research data so that they can provide these details to the IRB if a mobile device is lost or stolen. Data security must be discussed regularly at research team meetings, and data security details must be included in the study data and safety monitoring plan. The University offers a wide range of training for all faculty, staff, and students, and we encourage investigators to consult with their IT staff and/or departmental data security experts to develop standard best practices. (With Permission of the University of Pittsburg HRPO)

    The following recommendations are to assist you in designing a data security and storage plan for your study. The recommendations are extensive, but not exhaustive. Please consider all facets of your study requiring data storage and security.

    IRB BOX Recommendations

    The IRB strongly recommends storing your study materials (consent materials, data, etc.) in your BOX account. The recommendations in the following sections apply to file storage in BOX, as well, but provide more specific guidance to consider when developing the data security and storage part of your study.

    University Information Security Program

    The institutional administrative procedures provide information about implementing safeguards to protect nonpublic information including:

    • Risk Based Implementation
    • Limiting Access to Information
    • Management and Training
    • Physical Security
    • Information Systems Security
    • Selection of Appropriate Service Providers

    Use Coded Identifiers and a Master Key

    One of the easiest ways to help protect the confidentiality of data that you collect is through the use of coded identifiers.

    • Assign each study participant a random unique identifier.
    • Develop a master key to enable the organization of identifying information and data (preferably in an electronic format and vigorously protected with encryption and passwords). Investigators and programs engaged in work where very sensitive and/or federally protected data are gathered should be charged with identifying and implementing file encryption to convince the IRB that robust safeguards are in use.
    • Enter the contact or other identifiable information you collect into the master key.
    • Record the coded study identifiers in the master key.
    • Once the data are organized and analyzed, the master key (and participant contact information forms, if used) should be destroyed. If it is important to your study to keep the master key, please provide a detailed rationale to the IRB. In your proposal, detail how and when these keys will be destroyed.
    • Data documents should have only the data and the study ID code; all other identifiers must be eliminated.
    • Ideally, the informed consent, data, and the master key should be transported and stored independently, but reasonable alternatives can be proposed and approved.

    Plan for Data Transport, Storage, and Security

    Ideally, transport of data (whether through physical or electronic means) should be limited to reduce the risk of loss or theft. When it is not in transit, data should be stored in a secure location accessible only to authorized study personnel. The IRB highly recommends using BOX for data storage, Brigham Young University's online file storage platform, for all data storage and transportation. For instance, scanning the documents on site to BOX eliminates the need to secure identifiable physical data for transport.

    • Data that are transported physically from a study site to an investigator's office or lab should be locked in a secure container (e.g., a briefcase or lockbox). If possible, a personal vehicle (rather than public transit) should be used.
    • Data must be transported separately (whether in separate electronic files or physical containers) from consent documentation or master keys. This ensures that if data is lost or stolen, there will be no associated identifiable information at risk of disclosure.
    • Identifiable data and documents should not be stored (except temporarily and out of necessity) at the investigator's place of residence. All identifiable study materials and data should be stored securely on Brigham Young University campus. (Note: De-identified data sets may be used for analysis, etc. off-campus).
    • Electronic data should be stored only on password-protected (and, if possible, encrypted) storage media or computers.
    • Copies of electronic data files should be kept to an absolute minimum. If multiple study personnel need access to the data, storage in a central secure location such as BOX is preferable over multiple copies being provided.
    • Electronic data should not be sent over email; but if necessary, it should only be sent if it is de-identified.
    • Data (whether electronic or physical) must be stored separately from the master code key.

    It is recommended that you include in your IRB research proposal the following information: how data will be transported (if applicable); where data will be stored; what security measures will be used; who will have access to the data; and how any identifiable information (consent forms, code keys, etc.) will be kept separately and securely from data files.

    Establish a Data Retention Plan

    In accordance with federal guidelines and institutional policy, the IRB requires that study data and consent forms must be maintained securely for, at minimum, three (3) years after the completion of a study (this applies only to non-exempt research). Regulations, best practices, and ethical guidelines in your specific discipline (e.g., those related to data covered by HIPAA, APA, AAA) may dictate a longer retention schedule. The IRB requires the following data retention practices.

    • During the retention period, data, signed consent forms and other documentation related to human subjects must be stored in the manner described in the IRB-approved protocol. Access must be limited to those identified in the approved protocol as having access to study data.

  • Documentation of research site approvals is necessary to ensure that the study is feasible and is appropriate for the culture and the target population. The documentation provides the IRB with confirmation that the site is aware of the activities and has agreed to research activities administered on site. Researchers can request this documentation concurrently or after IRB submission. Sites like public schools require IRB approval before documentation of approval.

    Format

    Documentation must be written on letterhead where possible and contain the following information:

    • Name, title or role, and contact information of the person providing permission
    • Name of the PI and brief description of the activities to be conducted at the site
    • Confirmation that the approach to recruitment, the method and timing for obtaining consent, and data collection activities are appropriate for the setting and the study participants
    • Confirmation that the research plan does not expose study participants to unnecessary risk

    Depending on the site and the study population, additional information may be required.

  • Glossary of Terms

  • Special Considerations

    Special attention should be given to local customs and to local cultural and religious norms in developing research, drafting recruitment material as well as written consent documents and data collection instruments. The following information is guide for researchers who plan to collect data internationally. Please note that additional time will be required to prepare studies and research personnel to engage in research outside the U.S.

    Local Oversight

    Where appropriate, research projects must have been approved by the local equivalent of an IRB, sometimes called a Research Ethics Committee (REC) or local ministries, local governance (before they are presented to the University IRB). Where there is no equivalent board or group, researchers are expected to consult with local experts or community leaders about the project and to secure their support for the conduct of the research. The IRB does require that there be good faith effort applied to secure local cooperation for the research and to document those efforts as part of the application.

    Researcher Qualifications

    At the time of initial review, the researcher must demonstrate that he/she and key research personnel possess the appropriate qualifications for conducting research in a specific country or region. The International Research Supplement document is used to provide information to evaluate the qualifications of the research

    personnel. It is the responsibility of the principal investigator and key research personnel to be familiar with local context, to consult with University faculty, international campus organizations or community individuals experienced in the local law, culture and social values of the community where the research will take place.

    Consent Process

    Consideration should be given to the most appropriate method of obtaining informed consent, including literacy levels, confidentiality concerns, and cultural norms. Different cultures have different authority structures for approval and consent. Researchers should be aware of and honor different cultural attitudes regarding consent. These attitudes may include differences with regard to autonomy and coercion (e.g., what we might consider to be coercive in the US may not be so in a different culture and vice versa).When it is appropriate the IRB will consider alternative consent formats if culturally appropriate. In some instances, it may be appropriate for the IRB to waive some or all requirements for written consent in favor of a verbal consent for cultural, religious or literacy reasons. Research proposals for which this may be reasonable should include explanations of cultural norms or conditions requiring such as waiver in section 14 of the application. (E.g. societies where no written language is used, or societies where signatures represent the surrender of spirit or soul to the researcher).

    Consent is best obtained using the language that is most familiar to the prospective subject and ideally the researcher or research team is fluent in the local language. If not, the researcher might seek collaborators or hire assistants who are fluent in the local language. A third option is to hire interpreters.

    When hiring interpreters, the following elements should be considered:

    • In a small population, the relationship between the interpreter and the subjects must be considered.
    • The interpreter might exert influence or undue pressure that could lead to selection bias.
    • The interpreter may not relay information in a clear and unbiased manner (e.g., he/she may leave out information they believe is unpleasant or culturally inappropriate).
    • In addition to the initial consent process, fluent researchers or interpreters should be available to answer questions, address complaints, or relay instructions throughout the conduct of the study.
    • Some languages are not written and sometimes people speak a language but may not be able to read or write it.
    • There may not be any translations of important words.
    • It may be culturally inappropriate to ask for a signature and may indicate a lack of trust.
    • It may be appropriate to use alternative consent procedures, such as the use of a short form and witness, photos or videos, or other alternate forms of documentation

    Research with Children
    Children may have different statuses in foreign countries than in the US. Questions that may need to be considered are:

    • What is the age of majority?
    • What is the relationship between parents and their children in that country?
    • What is an acceptable and effective parental permission process?
    • What is an acceptable and effective child assent process and are there laws pertaining to orphans in that country?

    Levels of Review
    Through consultation with experts, the IRB must ensure that the risk assessment holds true at the foreign site. Thus, knowledge of local context is important even in research that may be exempt.

    Note: even in exempt research, informed consent, parental permission, or child assent may still be ethically appropriate and/or required under local law. The researcher should include information in the research submission to address the local community ethical standards where the study will be conducted. This information should include details regarding local review (as applicable) and the researcher’s experience with the locality. This information will be considered when approving exempt research conducted at a performance site outside of the U.S.

    To assist researchers who are conducting expedited or full board research in a foreign country, the IRB requires that the International Research Supplement Form is submitted and uploaded to iRIS as a study document. This allows the researcher to consider and detail relevant political, social, cultural, and economic norms or issues and gives the IRB a sense of how knowledgeable the researcher is about the region where the research will take place.

    International Data Security Laws

    General Data Protection Regulation (GDPR)

    The European Union (EU) General Data Protection Regulation, known as the GDPR, is a comprehensive privacy regulation enacted by the EU Parliament. Although the GDPR primarily protects the personal data of persons physically located in the European Economic Area (EEA), it may protect the personal data of persons located in other countries, as well.

    The GDPR applies to controllers (someone who determines the purposes and means of processing personal data—principal investigators are often controllers) and processors (someone who processes data on behalf of a controller) in three circumstances:

    • When they are established in the EEA; or,
    • When they are not established in the EEA but they:

      • Offer goods or services to persons in the EEA; or,
      • Monitor the behavior of persons in the EEA.

    The GDPR defines personal data broadly as any information associated with an identified or identifiable natural person.

    The GDPR may affect to your research if:

    • Your research involves the personal data of persons physically present in the EEA;
    • You want to re-use personal data you previously collected from persons in the EEA (e.g., for a previous research project) or you want to obtain existing personal data about persons in the EEA from other persons or units at BYU (e.g., admissions data) to use in your research;
    • A person or entity physically present in the EEA is providing you with the personal data of research subjects located anywhere in the world;
    • You intend to conduct data scraping involving the accounts or websites of persons or entities physically present in the EEA; or,
    • You are collaborating with researchers or entities physically present in the EEA.

    The notice and consent requirements can be complex if the research involves certain special categories of personal data identified in Article 9 of the GDPR.

    • These special categories include data revealing racial or ethnic origin, political opinions, religious beliefs or philosophical beliefs, or trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; health data; and data concerning a person’s sex life or sexual orientation.

    Data Protection Regulations in Other Countries

    Researchers should be aware that in recent years international data security laws, similar to GDPR have been emerging to protect personal data. Countries such as Russia, China and various African nations have adopted stricter regulations within the last two years.

    Information about how researchers will abide by national personal data protection should be articulated in detail in section 15.3 of the application.

    Some regulations require additional measures for researchers to implement during the consent process and documentation. Researchers must be well informed about the regulations, plan more time to review research methods to accommodate extra considerations before application submission.

    Federal Guidelines for International Research

    In addition, the OHRP International Program works to ensure that human subjects outside of the United States who participate in research projects conducted or funded by HHS receive an equal level of protection as research participants inside the United States. To that end, the Institution’s human research activities, regardless of whether the research is subject to the U.S. Federal Policy for the Protection of Human Subjects (also known as the Common Rule), will be guided by an assurance of specific principles governing the institution in carrying out its responsibilities for protecting the rights and welfare of humans in research conducted at or sponsored by the institution. This requirement of an assurance applies to non-U.S. Institutions such that whenever non-U.S. institutions are engaged in non-exempt HHS-supported or -conducted human research, the HHS human subject protection regulations, 45 CFR part 46, apply.

    This means that when appropriate the non-U.S. institution must obtain an FWA which is the only type of assurance of compliance accepted and approved by OHRP. There is a single version of the FWA and the Terms of Assurance for U.S. and non-U.S. institutions. For additional information see: ( http://www.hhs.gov/ohrp/register-irbs-and-obtain-fwas/fwas/fwa-protection-of-human-subjecct/index.html )

    It should be noted that there when considering local cultural norms, equivalent protections are required (see OHRP guidance for equivalent protections: http://www.hhs.gov/ohrp/international/equivalent-protections/index.html). For example, with all due respect and sensitivity for local customs, minors who are treated as adults in their own country will be treated a minors for the purpose of protection in research.  However, the definition of who may provide ‘parental permission’ to participate may appropriately be adjusted based on cultural norms. It is possible, that grandparents or even tribal leaders may be the cultural head of household and may ethically serve as the designated guardian for a minor participating in research. That said, the cultural norms in question must be identified in the research protocol and the exception to policy anticipated.

    OHRP also publishes  The International Compilation of Human Research Standards , a listing of over 1,000 laws, regulations, and guidelines on human subject protections in over 100 countries and from several international organizations. This document should be consulted to determine country level guidelines on human subject research. Many of the listings embed hyperlinks to the source document.

  • BYU IRB must approve MRI research involving human subjects. The BYU MRI Research Facility houses a research-dedicated MRI scanner and does not provide clinical diagnostic scanning.

    The BYU MRI Research Facility has detailed information on their website regarding requirements and procedures for the protection of human subjects and researchers (see MRI Safety).

    Researchers who plan to conduct human subjects research at the BYU MRI Research Facility must follow these steps:

    1. Complete an IRB application in the iRIS system, but do not submit it to the IRB at this point.
    2. Next the researcher must save a PDF copy of the application and email the file to the MRI Research Facility Director at mri_director@byu.edu.
    3. The MRI Research Facility Director will review the proposal and provide you with an approval letter that should be uploaded to the researcher’s iRIS profile as part of the researcher’s certifications.
      1. MRI studies only need to seek approval from the MRI Facility Director with the initial submission of the study.
      2. Faculty PIs are responsible for ensuring their research teams have completed the required safety trainings with the MRI Research Facility.
      3. Faculty PIs are also responsible for maintaining MRI data integrity and confidentiality once the data leave the MRI Facility.
    4. When the approval is uploaded to iRIS and the researcher has completed all sections of the application and submission packet; the application is submitted to the IRB for review.

  • Research in the Utah public school districts require planning, careful preparation, and ample time for review and to obtain permission to conduct studies. Researchers should familiarize themselves with each school district’s demographics, policies, and procedures before they submit an application. There are certain times of the year that the districts do not allow research in the classrooms.

    When conducting research in public schools, researchers should also consider whether the Protection of Pupil Rights Amendment (PPRA) or the Family Education Rights and Privacy Act (FERPA) also apply. If either of these regulations applies, there will be additional requirements. Please see the following links for more information:

    Please note the following procedures:

    1. Discuss with relevant stakeholders (e.g., teacher, principal, special education director, curriculum director) about the timeline and feasibility of the proposed study.
    2. Submit the IRB application to your college’s Scientific Review Committee, including evidence of conversations (for MSE researchers only) with the Partnership schools/districts to mse_src@byu.edu.
    3. Submit the college-approved IRB application to irb@byu.edu.
    4. Submit the approved-IRB to the school district via the “Consent to Conduct Research Form” found here: https://education.byu.edu/request_to_conduct_research.
    5. After review, the district administrator will email you whether your study has been approved or not.
    6. Please note that student researchers are required to pay a $100 fee to each district. The fee will be refunded once a summary of the research findings are submitted to the district.
    • Each school district will review and make a determination about the research based on the study topic, benefit to their schools, scheduling, etc.
    • BYU IRB approval does not guarantee that the school districts will approve the research.
    • Researchers must submit written documentation on letterhead from each school district to BYU IRB before initiating any research procedures.
    • Research conducted in charter schools will require the approval of the school principal.
    • Research conducted outside the Partnership School Districts will follow policies and procedures set forth by each institution.

Resources

HRPP/IRB Forms and Templates
Guidance
Glossary of Terms
Standard Operating Procedures
FAQs