What is limited IRB review?

Limited IRB is increased oversight by the IRB for low-risk research (e.g. certain exempt categories) to ensure that either:

• The identifiable private information or biospecimens collected have the appropriate data security and privacy protections in place to reduce the chance of inappropriate disclosure; or
• Broad consent was obtained for the use of stored identifiable data or biospecimens.

How is limited IRB review conducted?

The IRB will conduct limited IRB review during the initial review of the submitted project. In addition, Investigators are required to submit changes to the IRB when the context or conditions of the original limited IRB review change. (e.g. if the location for the storage and protection of the data change). Continuing review of research is not required for research that had limited IRB review.

What are the data security standards?

The IRB will assess whether the data collected as part of the proposed study require increased protections based on the following criteria:

• The extent to which identifiable private information is or has been de-identified and the risk that such de-identified information can be re-identified;
• The use of the information;
• The extent to which the information will be shared or transferred to a third party or otherwise disclosed or released;
• The likely retention period or life of the information;
• The security controls that are in place to protect the confidentiality and integrity of the information; and
• The potential risk of harm to individuals should the information be lost, stolen, compromised, or otherwise used in a way contrary to the contours of the research under the exemption.

What exempt categories require limited IRB review for data security and privacy protections:

• Exempt 2(iii)
• Research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) if the information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects and an IRB conducts a limited IRB review.
• Exempt 3(i)(C)

Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and

• the information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review.

Secondary research for which broad consent is required: Research involving the use of identifiable private information or identifiable biospecimens for secondary research use, if the following criteria are met:

(i) Broad consent for the storage, maintenance, and secondary research use of the identifiable private information or identifiable biospecimens was obtained in accordance with the required elements of informed consent;

(ii) Documentation of informed consent or waiver of documentation of consent was obtained in accordance with the requirements for documentation of consent;

(iii) An IRB conducts a limited IRB review

What exempt categories require limited IRB for verification that broad consent was obtained?

• Exempt 7

Storage or maintenance for secondary research for which broad consent is required: Storage or maintenance of identifiable private information or

identifiable biospecimens for potential secondary research use if an IRB conducts a limited IRB.

The IRB will determine that the research to be conducted is within the scope of the broad consent; and the investigator does not include returning individual research results to subjects as part of the study plan. This provision does not prevent an investigator from abiding by any legal requirements to return individual research results.