Amending Study

What kind of changes do I need to submit?



What are Waivers of Informed Consent?

Exempt Categories


What is a Federalwide Assurance?

Need for Review

Renewing Study

Do I need to renew my protocol if I am only doing data analysis?

Review Process

Special Topics

Submission Process

Does my project involve human subjects?

Who is a human subject?
Within the context of IRB review, a human subject is defined as a living person about whom a researcher obtains data through:
  • Intervention (for example, venipuncture or cognitive tests) or 
  • Interaction (for example, interviews) with the person, or 
  • Identifiable Private Information (for example, observations or private records). A person may be a "human subject" when a researcher obtains data about the person from a third party as well as from the person directly.
What is "intervention"?
An intervention includes both physical procedures by which data are gathered and manipulations of the subject or the subject's environment that are performed for research purposes.

What is "interaction"?
An interaction includes communication or interpersonal contact between investigator and subject. Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).

What is “identifiable” information?

In this context, identifiable means that the identity of the subject may readily be ascertained by the investigator or associated with the information obtained as part of the research.

What is “private” information?

There are two kinds of private information included in the federal definition –
  • information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and
  • information that has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public, such as a medical or school record
What does "about whom" mean?
In order for a study to be considered human subjects research, the data obtained must be "about" the living individual. In some cases, a researcher may interact or intervene with a living individual, but the purpose is to obtain data about a topic other than the individual. These studies may not be considered human subjects research.

Some examples of research that is NOT considered human subjects research:
  • Asking a nongovernmental organization about its source of funding.
  • Asking an employee to describe the different functions performed by different positions at an organization and communication processes between departments, as long as no private, personally identifiable information is collected about individuals who have filled different positions.
  • Asking a teacher to describe teaching methods or techniques used in the classroom. 
  • Asking a teacher to evaluate the effectiveness of different teaching techniques based on a set rubric, or on the performance of students in aggregate, without providing private, personally identifiable information about individual students.
  • The purpose of the research is to determine whether System A or B is better. The researchers ask 30 engineers who have used both systems to evaluate the systems (e.g., with instructions to rate each system on a scale of 1 to 10). The researchers perform an analysis that determines statistically which system is better.
Some examples of research that IS considered human subjects research:
  • Asking a teacher to describe her or his personal experience using different teaching methods or techniques. Note: This would be considered human subjects research even if the overall purpose of the study were about teaching methods.
  • Asking a political scientist who is the strongest candidate in a political race. Note: This opinion question is about the individual because it seeks a general attitude from—that is, something about—the individual; and not a concrete assessment of something within their realm of expertise.
  • The purpose of the research is to determine within-rater reliability. The researchers ask engineers who have used Systems A and B to evaluate the systems (e.g., with instructions to rate each system on a scale of 1 to 10). The researchers perform an analysis that determines the engineers have low within-rater reliability.
To know if you are conducting "human subjects research",  also see Am I conducting research? Human subjects research projects must be reviewed and approved before you begin. 

How long will it take to review my protocol?

Standard Service Level Expectations
These guidelines are based on the understanding that the ORCA office will receive a completed protocol, with all questions answered in a thorough and responsive manner, and all related requirements met. Requirements for IRB may include: CITI training, HIPAA training, EH&S clearance, and Field Study Plan approval. Some types of review may require extra time or additional reviews. If you have a project involving vulnerable populations (such as prisoners, children, or pregnant women), identifiable medical records, deception, collaboration with other institutions, or illegal activities please allow additional time for review. Additional time should also be allotted for protocols submitted outside of the school term or during vacation periods. The full IRB committee does not meet during the summer quarter. *For protocols requiring committee approval, please keep in mind that the IRB committee is comprised largely of academic volunteers who perform these tasks in addition to their other duties. Additional time should be allotted for any committee review, if possible. Submission Instructions Protocol applications must be submitted electronically as a single .pdf document to the ORCA by noon on the suggested day to ensure the review can be completed in time.
ORCA Administrative Tasks ​Standard Service Level Expectations
IRB Submission Inquiries Within 3 business days
IRB Protocol Screening Within 3 business days
Phone Calls (Responding) Within 3 business days
IRB Consultation (email or phone) Within 3 business days
Exempt Protocols Within 2 - 4 weeks
IRB Committee Processes Deadline
Protocols Qualified for Expedited Review* 4 - 6 weeks before work is scheduled to begin
Annual Renewals* 2 -4 weeks prior to anniversary date
Full Committee Review* 4 -6 weeks before research is scheduled to begin

Does student research require IRB review?

Generally, the IRB definition of "research" does not include student course work or undergraduate honors theses, unless they are to be made available to the public, used by other researchers, or there is a possibility that the research may lead to a formal presentation or publication. See Am I conducting human subjects research?

However, even when student work involving human subjects does not constitute research, the faculty members who assign or supervise the work are responsible for educating their students to safeguard the well being of the subjects. If an instructor determines that there is a possibility that a student's proposed research project may result in a formal presentation or publication, he/she should recommend that the student submit the project for IRB review.

Internet-Based Research: Public vs. Private

If individuals intentionally post or otherwise provide information on the Internet, such information could be considered public unless the privacy policies and/or terms of service of the entity receiving or hosting the information indicate that the information should be considered private.
What is considered public on the Internet? Public sites fall into one or more of the following categories:
  • Sites containing information that, by law, is considered public (many federal, state, and local government sites are included in this category: property tax records, birth and death records, real estate transactions, certain court records, voter registration and voting history records, etc.). 
  • News, entertainment, classified, and other information-based sites where information is posted for the purpose of sharing with the public.
  • Open access data repositories, where information has been legally obtained and is made available with minimal or no restriction.
  • Discussion formats that are freely accessible to any individual with Internet access, and do not involve terms of access or terms of service that would restrict research use of the information
However, an individual’s expectation of privacy is not always “reasonable” (see What is considered private information?) and someone may assume that the information provided or available on the Internet about them is private, when it is not. The principle of beneficence may support a more conservative approach. A subject who incorrectly assumed his/her identifiable information was private, or restricted to a small group, might not have posted the information if s/he thought the information would be widely available, believing that the information could be embarrassing or damaging.
Are avatars considered human subjects? If I study avatars, is the research considered anonymous?  Investigators should try to determine if an avatar or other Internet personae might be a virtual representation or a proxy for an individual. Avatars should be considered human subjects if during observation of their actions, or while interacting with them, personally identifiable information (PII) could be obtained.

What if my research involves educational records?

Principal Investigators are required to adhere to additional rules when student records are involved. These regulations exist separately from IRB decisions. That is, PIs must adhere to FERPA and PPRA as well as IRB decisions. IF FERPA and PPRA have more stringent rules, the PI must adhere to those. 

What is FERPA?

FERPA is a federal law that gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. 

What part of FERPA relates to UCSC IRB protocols?

Generally, schools must obtain written permission from the parent or eligible student in order to release any information from a student's education record. FERPA defines educational records as records containing information (in any medium - paper, electronic, microfilm, etc.) that are directly related to a student and are maintained by an educational institution or by a party acting for the institution.

FERPA Consent Form Requirements

The written consent authorizing the release of records release must:

  • Specify the records that may be disclosed
  • State the purpose of the disclosure; and
  • Identify the party or class of parties to whom the disclosure may be made.

If a parent or eligible student so requests, the educational agency or institution shall provide him or her with a copy of the records disclosed. Signed and dated written consent may include a record and signature in electronic form that identifies and authenticates a particular person as the source and also indicates such person's approval of the information contained in the electronic consent.

When Consent is NOT Required under FERPA

FERPA allows schools to disclose educational records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

  • School officials with legitimate educational interests
  • Other schools to which a student is transferring
  • Specified officials for audit or evaluation purposes
  • Appropriate officials in cases of health and safety emergencies
  • Appropriate parties in connection with financial aid to a student
  • Accrediting organizations
  • Organizations conducting certain studies for or on behalf of the school
  • State and local authorities within a juvenile justice system, pursuant to specific state law
  • Directory Information. FERPA permits the following as: the student's name, address, telephone listing, electronic mail address, photograph, date and place of birth, major fields of study, dates of attendance, grade level, enrollment status, participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors and awards received, and the most recent educational institution attended.

However, students should be given the opportunity to file a request to prevent disclosure of directory information.

What is PPRA? 

PPRA specifies the right of parents and guardians to inspect any instrument used to collect information concerning:

  • political affiliations or beliefs of the student or the student's parent
  • mental and psychological problems of the student or the student's family
  • sex behavior or attitudes
  • illegal, anti-social, self-incriminating, or demeaning behavior
  • critical appraisals of other individuals with whom respondents have close family relationships
  • legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers
  • income

Parental/guardian consent is required before such instruments can be used to gather information from a minor.

Tips for Researchers:

  • Check school district (or post secondary school) regulations and consent form requirements.

  • Make sure your consent forms comply with both UC Policy and FERPA and PPRA guidelines.

For more information, see US Department of Education FERPA website.

Do I need to renew my protocol if I am only doing data analysis?

You may still need to renew your protocol even if you are no longer directly interacting with human subjects. 

If you still have access to identifiable data, you must continue to renew your protocol until all analyses are complete or all identifiers have been destroyed. Identifiable data include audio/video recordings as well as coded data where the identifier key is retained. 

If all identifiable data fields have been destroyed and data analysis will be conducted using only de-identified data, no renewal application is necessary and the protocol may be closed.

What kind of changes do I need to submit?

Principal Investigators (PIs) are  responsible for submitting: 

  • modifications to the study, which must receive UCSC IRB approval before they are implemented (see Modifications to Previously Approved Research);

  • reports of adverse events, protocol violations/incidents, and other safety information meeting UCSC IRB reporting criteria (see Unanticipated Problems and Adverse Events); and

  • Important:  If Federal funding is secured during the approval period, the PI is responsible for promptly submitting a modification to notify ORCA.

Do I need approval from the UCSC IRB or a different IRB?

If you are doing human subjects research at UCSC you will need to submit either an exemption request or a full protocol to be reviewed and approved by the UCSC IRB before the research begins. Please note, there are no provisions for retroactive approval of research protocols. See Collaborative Research with Non-UC Institutions for information on which IRB would review for multisite non exempt research.

What is "coded" data?

In the context of Human Subjects research, "coded" means that identifying information (such as name, address, phone number or social security number) of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e. the code); and a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

What happens after I submit my protocol?

Once ORCA has received your application, you will receive an acknowledgment email.  After that, you should hear back from ORCA within 2-4 weeks with either an approval notification or questions regarding your application.

What if my research involves oral history?

Oral history projects and other activities that consist solely of open-ended qualitative-type interviews are subject to IRB oversight when they involve research, which federal regulations define as "a systematic investigation...designed to develop or contribute to generalizable knowledge."

General principles for evaluating oral history projects

  • Oral history, journalism, biography, literary criticism, legal research, and historical scholarship, including the collection and use of information, that focus directly on the specific individuals about whom the information is collected is NOT considered human subjects research.
    • Example: An oral history video recording of interviews with holocaust survivors is created for viewing in the Holocaust Museum. The creation of the videotape does NOT intend to draw conclusions, inform policy, or generalize findings. The sole purpose is to create a historical record of specific personal events and experiences related to the Holocaust and provide a venue for Holocaust survivors to tell their stories.
  • Systematic investigations involving open-ended interviews that are designed to develop or contribute to generalizable knowledge (e.g., designed to draw conclusions, inform policy, or generalize findings) WOULD constitute "research" as defined by HHS regulations at 45 CFR 46.
    • Example: An open-ended interview of surviving Gulf War veterans to document their experiences and to draw conclusions about their experiences, inform policy, or generalize findings.
  • Oral historians and qualitative investigators may want to create archives for the purpose of providing a resource for others to do research. Since the intent of the archive is to create a repository of information for other investigators to conduct research as defined by 45 CFR 46, the creation of such an archive WOULD constitute research under 45 CFR 46.
    • Example: Open ended interviews are conducted with surviving Negro League Baseball players in order to create an archive for future research. The creation of such an archive would constitute research under 45 CFR 46 since the intent is to collect data for future research.

What do I need to know about raffles, lotteries, or offering a chance to win prizes to participants?

In the State of California, it is illegal to give out a prize by chance in exchange for payment or “valuable consideration,” and participation in research has been interpreted as a type of valuable consideration. Therefore, to avoid violating California’s lottery law, the University of California recommends you

  1. allow the drawing to be entered by anybody who asks, and
  2. allow participants to stay entered in the drawing even if they withdraw.

The protocol should make this clear and subjects should be informed that entry in the raffle or lottery is not contingent on participation in the study.

What are Waivers of Informed Consent?

A waiver of informed consent is a waiver of the requirements to obtain informed consent, or a waiver or alteration of some of the required elements of informed consent.

The UCSC IRB may waive the requirement to obtain informed consent, or it may approve a consent procedure that alters some of the elements of informed consent described above. Before the UCSC IRB does so, the researcher must include sufficient information in the research protocol for the IRB to determine that the waiver requirements have been met. The researcher must show that:

  • The research presents no risks of harm, considering probability and magnitude, greater than those ordinarily encountered in daily life or during the performance of routine examinations or tests; and
  • The waiver or alteration will not adversely affect the rights and welfare of the subjects; and
  • The research could not practicably be carried out without the waiver or alteration; and
  • When appropriate, the subjects will be provided with additional pertinent information after participation; or
  • The research or demonstration project is to be conducted by or subject to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine:
    • Programs under the Social Security Act, or other public benefit or service programs;
    • Procedures for obtaining benefits or services under those programs;
    • Possible changes in or alternatives to those programs or procedures; or
    • Possible changes in methods or levels of payment for benefits or services under those programs.

Waiver of Parental Consent

Alternatively, under 45 CFR §46.408 (c), parental consent may be waived if the IRB determines that parental or guardian permission is not a reasonable requirement to protect the subjects, such as in cases of neglected or abused children. In these cases, an appropriate mechanism for protecting the children must be substituted.

Waiver of Documented Consent

In some cases, the consent process is still required but a written consent form may not be appropriate. Examples of such cases include:

  • Research participants are not literate.
  • Participants live in a community where signing documents is looked at with suspicion.
  • In situations where the consent form is the only link to participation in study (further outlined below).

The UCSC IRB may waive the requirement for the researcher to obtain signed written consent for some or all subjects. Before the UCSC IRB does so, the researcher must satisfy the UCSC IRB requirement that either:

  • The only record in the researcher's possession linking the subject and the research would be the consent document, and the principal risk would be potential harm resulting from a breach of confidentiality. The UCSC IRB requires that each subject be asked whether they want documentation linking them with the research, and the subject's wishes will govern; OR
  • The research presents no risks of harm, considering probability and magnitude, greater than those ordinarily encountered in daily life or during the performance of routine examinations or tests, and the research involves no procedures for which written consent is normally required outside of a research context.

When the documentation requirement is waived, the UCSC IRB requires that the researcher provide subjects with a written or oral statement (or 'script') containing the elements of informed consent, when appropriate.

How do I protect participant data?

The safeguarding of human subjects is of paramount importance to the UCSC IRB. Human subjects data stored on computers in text, photo, video or other formats can be compromised through theft or hacking, and subjects may be put at risk of harm. In addition to the risk to subjects, the cost of reproducing, restoring, or replacing stolen or lost data highlights the need for a comprehensive data protection plan. Investigators should specifically address in their protocols how they will safeguard human subjects data stored in electronic and non-electronic formats.

How can electronic data be protected?
Theft and hacking are particular concerns with electronic data. Many research projects involve the collection and maintenance of human subjects data that could become the target of hackers. The following precautionary measures are recommended when dealing with electronic data.

1. Use password protection on your computer. A good password has the following characteristics:
  • It cannot be found in a dictionary
  • It contains special characters and numbers
  • It contains a mix of upper and lower case letters
  • It has a minimum length of 10 characters
  • It cannot be easily guessed based on user information (birthdate, postal code, phone number, etc.)
2. Learn how to lock your computer. If you need to step away from your computer for a break and want to keep it powered on, lock your computer so it can't be accessed without a password.
  • For Windows 7 users, go to the Start menu, select the right pointing area from the Shutdown category and select "Lock."
  • For Macintosh users, use the keystrokes, "Shift," "Command," and the letter "q," pressing all buttons at the same time. You may also select "Log Out" from the Apple pull-down menu.
  • For Windows XP users, use the  keystrokes, "Ctrl," "Alt," and "Delete," pressing all buttons at the same time, and select "Lock Workstation."
3. Install a hardware or software firewall.
  • A hardware firewall will protect all the computers connected to the network and can often be set up through the network router.
  • A software firewall requires you to install software that will protect only that specific computer.
4. Use the latest versions of antivirus software to protect against viruses.

5. Securely delete sensitive data and personally identifiable information when it is no longer needed. Shred any hard-copy forms as soon as possible. For computer files, note that putting a file in the trash and emptying the trash will not remove it from the system. For information on how to securely delete files, see How can I delete files securely from my computer?.

6. De-identify private data that you must retain whenever possible. If research designs require IDs to be retained, unlink them from main data sources as early as possible. Use arbitrary IDs to link the confidential and anonymized information.

7. Protect all data that you must retain, whether it is on a work computer or a home computer. The computer and files should be password protected and encrypted. Encryption reduces the risks associated with stored private information. Unencrypted data should never be e-mailed or otherwise shared. Contact IT for assistance. When connecting to the UCSC network from off campus, use the Campus VPN (virtual private network) to encrypt your Internet traffic and provide a secure (encrypted) connection. The Campus VPN is available to all campus members with a CruzId and Gold password.

8. Ensure proper physical security of electronic and physical files.
  • Lock down workstations and laptops.
  • Secure your area, files and portable equipment before leaving them unattended.
  • Laptops should be physically locked down to something permanent at all times.
  • Filing cabinets and areas where personally identifiable information is stored should be locked.
9. Restrict access to data. Be sure you know who has access to folders before you put restricted data there. Don’t put sensitive information in locations that are publicly accessible from the Internet.

10. Transmit data securely. Don’t email unencrypted private information. Check for sensitive data in attachments, screen shots, test data, etc.; these need to be sent securely, as well. Don’t open files sent via IM or P2P software on a machine that contains restricted data – these files often bypass anti-virus screening. Don't send paper mail that displays private information.

11. Don’t forget smart phones. Many of these protections also relate to smart phones. If you are recording interviews using your phone, you should also consider the following:
  • Be aware of the possibility of theft. Phones are small and easily misplaced or lost. If an individual steals your smart phone, it may be only a matter of time before even a well-secured device is compromised.
  • Password protect your phone. Use a strong password (minimum of 8 characters, with a mixture of numbers, symbols, and upper and lower case letters).
  • Turn off Bluetooth (when not in use). Disabling the Bluetooth service decreases a hacker’s opportunity to wirelessly hack into your phone.
  • Obtain and install anti-virus software, if it is available for your model, and keep it updated.
  • Do not accept files and text messages from individuals you do not know.
  • Obtain and install encryption software for your cell phone, if available. Encrypting data can help users prevent identity theft and the loss of sensitive information (note some encryption processes may not be reversible without resetting your phone).
  • Lock the device whenever it is not in use.
  • Consider the privacy implications before enabling location-based services and limit usage to trusted applications.
  • Remove data from the phone or recording device as soon as possible.
  • Remember that wireless data transfer is only as secure as the wireless network you are connected to at that time. Phones may automatically change networks depending on your location.
12. Consider study goals and risk level. The planning stages of your research project should include careful consideration about what type of data is needed to achieve your study aims. As the level of risk increases (depending on the type of questions that are asked, etc.), so will the responsibility of protecting a participant’s identity. If protecting participant confidentiality is important to your study and factors may limit your ability to securely protect data (i.e. international travel, budget), you may want to consider written documentation or field notes that do not include identifiers. If you choose to use audio or video-recording you will need to describe in your protocol how you will maintain the audio recordings (i.e. where they will be kept), when/if they will be destroyed, and how the recordings will be coded to protect the participant’s identity.

Additional Resources:

Is an institution engaged or not engaged in research on my project?

In general, an institution is considered engaged in a particular non-exempt human subjects research project when its employees or agents for the purposes of the research project obtain: (1) data about the subjects of the research through intervention or interaction with them; (2) identifiable private information about the subjects of the research; or (3) the informed consent of human subjects for the research. 

More specifically, an institution is engaged in research when any of the following apply:

  • The institution is the awardee institution for a non-exempt human subjects research project, even if all activities will be carried out by employees or agents of another institution. 
  • An employee or agent of the institution intervenes with human subjects for research purposes through 
  • Invasive or noninvasive procedures (see examples below)
  • Manipulating the environment  (see examples below)
  • Interacting with any human subject of the research (see examples below)
  • Obtaining informed consent 
  • Obtaining identifiable private information or identifiable specimens, even if there is no direct interaction with human subjects (see examples below)

Examples of invasive or noninvasive procedures include:

  • drawing blood; 
  • collecting buccal mucosa cells using a cotton swab;
  • administering individual or group counseling or psychotherapy;
  • administering drugs or other treatments; 
  • surgically implanting medical devices; 
  • utilizing physical sensors; 
  • utilizing other measurement procedures. 

Examples of manipulating the environment include:

  • controlling environmental light, sound, or temperature;
  • presenting sensory stimuli; 
  • orchestrating environmental events or social interactions.

Examples of interacting include:

  • engaging in protocol dictated communication or interpersonal contact; 
  • asking someone to provide a specimen by voiding or spitting into a specimen container; 
  • conducting research interviews or administering questionnaires. 

Obtaining identifiable private information or identifiable specimens includes, but is not limited to:

  • observing or recording private behavior; 
  • using, studying, or analyzing for research purposes identifiable private information or identifiable specimens provided by another institution; and 
  • using, studying, or analyzing for research purposes identifiable private information or identifiable specimens already in the possession of the investigators 

See also Do I need approval from the UCSC IRB or a different IRB? and Collaborative Research with Non-UC Institutions.

For more information about identifiable information, see What is considered identifiable information?

For more information about what it means to be engaged or not engaged in research, see the Department of Health and Human Services Guidance on Engagement of Institutions in Human Subjects Research.

What is a Federalwide Assurance?

Under a Federalwide Assurance (FWA, or "Assurance"), an institution commits to the Department of Health and Human Services (DHHS) that it will comply with the requirements for human subjects research set forth in 45 CFR 46 and the Terms of Assurance. In general, if an institution receives federal funding for human subjects research, they will hold an assurance. A searchable database of assurances is available at the Office for Human Research Protections.

If UCSC is serving as the Lead Site on cooperative research with a non-UC institution, the UCSC Lead Investigator is responsible for verifying the other institution's IRB approval.

If the non-UC institution holds an Assurance
The non-UC institution can have the project reviewed by its own IRB.

If the non-UC institution does not hold an Assurance
The UCSC IRB does not review protocols for institutions that do not hold Assurances. The non-UC institution must find an IRB to review its research and provide UCSC a copy of its approval or letter of support. There are several commercial IRBs that will review projects for hire.

UCSC's Federalwide Assurance number is FWA00002797.

If you are engaged in research with another campus within the UC system, see Collaborative and Multi-Campus Research in the UC System. 

What should I consider when completing a non-exempt protocol application? 

Please review the IRB’s Submission Guide for tips on what to include in your application.

What if a question on the IRB application form does not apply to my study?

If a question does not apply, please write ‘NONE’ or N/A or explain why it does not apply.

I want my project to start as soon as I get approval. What do I put for the start date?

If you want to start your research as soon as your protocol is approved, put "upon approval" for the project start date.

Who should be listed as an investigator (questions 1 and 2)?

Provide a list of all personnel that will be intervening or interacting with human subjects or with their personally identifiable data. For more information and examples see Who needs to be listed as an investigator?

What if I don't know who all the investigators will be yet (e.g. I am in the process of recruiting or I will be assigned research assistants later on)?

Any research personnel not identified on the original protocol will need to be added through an amendment. This modification must be approved before any new research personnel are permitted to work on the project. See Modifications to Previously Approved Research.

What should be included in the recruitment section (question 8)?

Describe what materials and methods will be used for recruiting subjects. Describe how human subjects will be contacted in the first instance, by whom, and what they will be told. Attach the recruitment script to the application, if applicable. For the purposes of recruitment, researchers should not have access to any personally identifiable private information about a prospective participant without their consent.

What qualifies as a "risk" for the purposes of this form (question 16)?

A subject is considered at risk in research if she or he may be exposed to a possibility of harm that is greater than that ordinarily encountered in daily life or during routine examinations or tests. Please use your best judgement and consider both the magnitude of potential risk and how likely it is that participants will experience the risk. When conducting research with potentially vulnerable groups, including children and pregnant women, federal guidelines mandate the potential risks receive heightened scrutiny. Additionally, if any research protocols include a risk that participants will experience emotional distress, UCSC guidelines outline that the PI must provide all subjects with information about available mental health resources.

What is meant by the terms "confidential," "de-identified," "coded," and "anonymous" (questions 20-22)?

The terms confidential, de-identified, coded, and anonymous describe distinct practices and methods related to subjects' participation in research and the collection and storage of participant data.

Participation in research

  • An individual’s participation in a research project can be described asanonymous when no one, including the research team, can identify her or him as a participant. 
  • An individual's participation is considered confidential when the research team knows the individual's identity but is obligated not to disclose that information to others outside of the team (except as clearly described in the research protocol and consent document).

Data collection and storage

  • Data are anonymous when no one, including the research team, can connect the data to the individual participant (i.e. no personally identifying information is collected). Keep in mind that even when researchers do not collect direct personal identifiers such as name or student ID number, collection of indirect identifiers, taken in combination, might make it possible for someone to identify an individual participant from among a pool of subjects - for example, academic department and ethnicity.
  • Data are confidential when there continues to be a link between the data and the individual who provided it, but the research team is obligated to protect the data from disclosure outside of the research team (except as clearly described in the research protocol and consent document). In order to protect against accidental disclosure, the subject’s name or other identifiers should be stored separately from their research data. In the research data, the identifiers can be replaced with unique codes. Even when data are coded, they are not anonymous because it is still possible to link the codes to identifiable data.
  • Data are considered de-identified when any direct or indirect identifiers linking the data to the individual subject’s identity are destroyed.

(source: adapted from

What should be included in the financial aspects section (question 27)?

Any costs to subjects that may result from participation in the research should be described (e.g. parking fees, transportation, child care). If remuneration or payment is offered, details should be provided regarding the amount and the proposed method of payment, as well as the researcher's reasons for believing that this payment is unlikely to unduly influence the subject's decision to participate, and that distribution is equitable. Payment should not be contingent upon completion of the study (although it may be prorated) and participants should be permitted to skip any questions or steps that they are uncomfortable with, without forfeiting remuneration. 

Why does the IRB need so much detail about the study?

Providing information with a high level of detail is necessary so that IRB reviewers can make an informed decision about potential risks to participants and promote compliance with federal guidelines for human subjects research. Completing this process can also help researchers carefully evaluate procedures prior to beginning research.

Who needs to be listed as an investigator?

All human subjects investigators are required to be listed on the approved IRB application. For new investigators added after the initial approval of a project, an amendment to the IRB protocol must be submitted and approved before any new investigators may commence work on a non-exempt human subjects protocol.

Definition of investigator

A person listed as an investigator in the IRB application is "an individual who is interacting and/or intervening with human subjects or handles personally identifiable data of a human subject". The HHS regulations at 45 CFR 46 use the term “investigator” to refer to an individual performing various tasks related to the conduct of human subjects research activities, such as obtaining informed consent from subjects, interacting with subjects, and communicating with the IRB. Investigators can include professors, scientists, administrative staff, teachers, and students, among others.

Examples of human subjects research activities include:

  • obtaining information about living individuals by intervening or interacting with them for research purposes
  • obtaining identifiable private information about living individuals for research purposes
  • obtaining the voluntary informed consent of individuals to be subjects in research
  • studying, interpreting, or analyzing identifiable private information or data for research purposes
Examples of involvement that would not need to be listed include:
  • laboratory personnel receiving de-identified samples for analysis
  • collaborators at other institutions who are receiving survey responses that do not include identifiers
  • administrative personnel assisting with logistics who do not have access to study data

What is "identifiable" information?

Personal identifiers
For most human subjects research purposes at UCSC, personal identifiers include the following:
  • names
  • photographs 
  • audio or video recordings
  • social security numbers
  • student ID numbers
  • email addresses
  • codes that link unidentifiable data to identifiers
Information is also considered identifiable if there is enough information being collected to allow a subject's identity to be deduced. 
Indirect identifiers
There are instances where an investigator may not be collecting any direct identifiers, such as names, but will be collecting enough indirect information about a group of people that a person familiar with the group could potentially identify subjects, or that information could be combined in such a way as to ascertain subjects' identities.
For example:
  • A researcher collects both academic department and ethnicity at a university with a small number of ethnic minorities.
  • A researcher collects demographic information about a group of employees at a small company. 
  • A researcher records the age, rank, and years of service of a group of Marines who served in a small base in Afghanistan in 2012.
No identifiers
If no identifiable information (including audio and video recordings) is being collected, then the research is considered anonymous and respondents' identities are protected.

Exempt Category 1: Educational Practices

Research conducted in established or commonly accepted educational settings that involves normal educational practices, such as (a) research on regular and special education instructional strategies or (b) research on the effectiveness of or the comparison among institutional techniques, curricula, or classroom management methods. 

As noted above, research must be conducted in "established or commonly accepted educational settings" and involve "normal educational practices" to be exempt under this category.

Commonly accepted educational settings include but are not limited to K-12 schools and college classrooms. They may also include after-school programs, preschools, vocational schools, alternative education programs, and other sites where educational activities regularly occur.

Normal educational practices include established teaching methods, curriculum content and commonly accepted classroom managment techniques that are planned and implemented by the classroom teacher. Normal educational practices are activities that would occur regardless of whether the research is conducted. Thus, a study that evaluates a radically new instructional strategy or curriculum, or that randomly assigns students to different instructional strategies/curricula for comparison, would probably not be exempt, since these are not "normal educational practices." Studies that involve surveys and interviews with minors that are outside of "normal educational practices" also do not qualify for exemption.

Examples of Research Exempt under Category 1

A study evaluating the effectiveness of a commonly accepted science curriculum. For the study, researchers will observe classroom instruction and collect quizzes and class evaluations that are part of the curriculum and classroom practices

A study comparing two curricula that are currently being implemented in a school. Researchers will observe classrooms as well as interview instructors about their experiences implementing the instructional materials (but not about specific students).

A study comparing driver's education curricula offered by area driving schools. The researcher will observe classes and compare driving test scores at the end of the courses.

For more information, consult our FAQ handout.

Special thanks to UC Berkeley's Committee for the Protection of Human Subjects for generously allowing us to borrow information from their website for this page.

Exempt Category 1: Examples

Examples of Research Exempt under Category 1
  • A study evaluating the effectiveness of a commonly accepted science curriculum. For the study, researchers will observe classroom instruction and collect quizzes and class evaluations that are part of the curriculum and classroom practices
  • A study comparing two curricula that are currently being implemented in a school. Researchers will observe classrooms as well as interview instructors about their experiences implementing the instructional materials (but not about specific students).
  • A study comparing driver's education curricula offered by area driving schools. The researcher will observe classes and compare driving test scores at the end of the courses.
Examples of Research NOT Exempt under Category 1
  • A researcher wants to determine whether providing tangible reinforcement or verbal reinforcement will lead to greater increases in appropriate behavior and decreases in problem behavior for students identified with a serious behavior disorder. Individual students will be chosen for participation from classrooms of the same grade in consultation with the teachers. The students will be as closely matched for age and nature of the disorder, and then randomly assigned to an intervention condition. For example, one student will receive tangible reinforcement, one will receive verbal reinforcement, and the third will be the control.
  • Researchers are interested in developing a new assessment for math skills that involve both scoring of written prompts as well as responses involving use of manipulatives. It is expected that a new standardized, norm-referenced product will result. According to the school, the planned assessment is aligned with current curriculum and will not require students to respond to questions that would be unfamiliar. However, the development process entails having students respond to more assessment items than would be expected. In addition, in order to validate the new assessment, additional tests not currently used in the school will be administered for comparison, thus extending total testing time and number of items beyond what would be considered normal educational practice.

Exempt Category 1: What is a commonly accepted educational setting?

In the context of Category 1 exemptions, commonly accepted educational settings include but are not limited to K-12 schools, college classrooms, after-school programs, preschools, vocational schools, alternative education programs, and other sites where educational activities regularly occur.

Exempt Category 1: What is a normal educational practice?

In the context of Category 1 Exemptions, normal educational practices are established teaching methods, curriculum content and commonly accepted classroom management techniques that are planned and implemented by the classroom teacher.
Normal educational practices are activities that would be occurring regardless of whether or not the research is conducted. Therefore, a study that evaluates a new instructional strategy or curriculum, or that randomly assigns students to different instructional strategies/curricula for the purpose of comparison, would probably not be exempt because these are not considered normal educational practices.

Exempt Category 1: What if my educational research involves videotaping?

The exemption criteria for Category 1 says nothing specific about videotaping. Videotaping may be permissible in a Category 1 exemption, so long as the research will be taking place in a commonly accepted educational setting and will be examining normal educational practices. However, researchers should review and adhere to the school's or other educational institution's policies on videotaping students and classroom instruction. 

Exempt Category 1: What if my research involves parent focus groups?

A parent focus group may or may not meet the criteria for a Category 1 exemption.  If the focus group is being planned and implemented by the classroom teacher and would take place whether or not the research occurs, then the research could include the parent focus groups and still meet the criteria for the Category 1 exemption. 

If the parent focus group is being led by the researcher and would not be taking place if the research was not occurring, then the research may not meet the criteria for a Category 1 exemption.  It may be the case, however, that the parent focus group portion of the research could qualify for a Category 2 exemption. Category 2 exemptions do not apply to minors, but might apply to a parent focus group, where the information being collected would likely be very low-risk.

Exempt Category 2: Educational Tests

Research involving these procedures is exempt if:

(a) Information obtained is recorded in such a manner that human subjects cannot be identified, directly or through identifiers linked to the subject;


(b) any disclosure (including accidental disclosure) of the human subjects’ responses outside the research could not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, or reputation.

This exempt category applies only to the activities listed above. Public behavior refers to behavior taking place in a publicly accessible location in which the subject does not have an expectation of privacy (e.g., a public plaza or park, a street, a building lobby, a government building). If subjects have a reasonable expectation of privacy at the location where the researcher is conducting the observation, the project may not be considered exempt.

EXCEPTION: This exemption does not apply to research with children, except for research involving observations of public behavior when the investigator(s) do not participate in the activities being observed.

The research must meet either of the following two conditions to qualify under Category 2:

(a) The data is collected anonymously (which means that no identifiers can be connected to the data, either directly or through a coding system). In addition to videotapes and photographs, audio recordings are considered to be identifiable; therefore any data collection that involves audio recordings, video recordings, or photographs of subjects would not be considered anonymous. It is also possible that multiple pieces of information, none of which are identifiable on their own, may uniquely identify a person when brought together; in this case, the data would be identifiable and would not be considered anonymous.

(b) The information collected is not anonymous (because, for example, the researcher has a key linking respondents' names to coded identifiers), but the information is so innocuous that, in the event of disclosure outside of the research, there would be no significant detrimental consequences to the subject. The significance of "detrimental consequences" depends in part on context. For example, including a question about sexual identity in an interview study that investigates adults' plans to change careers could be non-controversial --and exempt-- in some locales, but highly sensitive --and non-exempt-- in other places.

Examples of Research Exempt under Category 2:

  • A study involving an anonymous survey regarding workplace satisfaction at area firms.
  • An observational study of pedestrians crossing a street; the researcher takes notes of what occurs, recording sex, race, and type of clothing of pedestrians, but does not interact with subjects.
  • A study involving interviews with college seniors (age 18 and older) about their plans after graduation. The answers to questions asked would present no risks to subjects if divulged outside the research.
  • A study involving focus groups with expectant mothers regarding their perceptions of parenting education.

For more information, consult our FAQ handout.

Special thanks to UC Berkeley's Committee for the Protection of Human Subjects for generously allowing us to borrow information from their website for this page.

Exempt Category 4: Existing Data 

Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:

(i) The identifiable private information or identifiable biospecimens are publicly available;

(ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects.

To qualify for this exemption, although researchers have access to private identifiable data, the data must be recorded in such a way that the information can no longer be connected to the identity of the subjects. This means that the abstracted data set does not include direct identifiers (names, social security numbers, addresses, phone numbers, etc.) or indirect identifiers (codes or psuedonyms that are linked to the subject's identity).

Category 4 is used when researchers have access to private identifiable information (e.g., medical records, etc.) but are able to record the data with no codes or identifiable information to have an anonymized dataset.