There are three levels of review that an IRB conducts.

Overview

The three categories of review are: exempt, expedited, full-board. There are also "limited" reviews and "continuing" reviews, which are special cases. All "limited" reviews are "expedited" (more below). All "continuing" reviews are necessary only for full-board reviews and some expedited reviews.

Levels of review are based on the level of risk to the participant, with each level representing greater levels of risk. The researcher must predict the probable outcomes inherent in their research and whether they convey risk.

Risk is the potential for harm to the participant and/or to the researcher. The nature of "risk" and "harm" is dependent on context and varies study to study. The benefits of a study must justify the risks to all parties. The job of the IRB is to evaluate those risks.

Some participants or study populations are more sensitive to risk and some studies convey greater levels of risk than others. Part of the human experience is encountering risk in daily life. When it comes to research, ethical considerations use "daily life" as a baseline. It is important to minimize risks in research as much as possible. Some consideration of risks include in research (but are not limited to):

Economic: Payment by subjects for procedures not otherwise required, loss of wages or other income and any other financial costs, such as damage to a subject’s employability, as a consequence of participation in the research.
Confidentiality: Taking reasonable and thorough steps to reduce the risk of confidentiality breaches, as well as weighing the consequences for potential breaches of confidentiality. Subjects have the right to be protected against injury or illegal invasions of their privacy and to preservation of their personal dignity. If identifying information, or potentially identifying information is collected, participants must be made aware of what will happen to that information, when, and under what circumstances. This consideration does not preclude the collection (or even the distribution of) such information, but it needs justification and care.
Legal: When the research methods can result in the participant or others being liable for a violation of the law, either by revealing that the subject or others have or will engage in conduct for which the subject or others may be criminally or civilly liable, or by requiring activities for which the subject or others may be criminally or civilly liable. Obtaining this information is not forbidden, but procedures must be explicitly in place and participants must be aware of these procedures.
Physical: Physical risks include physical discomfort, pain, injury, illness or disease brought about by the methods and procedures of the research. A physical risk may result from movement or engagement. It may also result from exposure to stimuli such as noise, electric shock, heat, cold, electric magnetic or gravitational fields, etc. Engaging in behavior that is not part of a participant's daily life.
Psychological: The potential for negative affective states such as anxiety, depression, guilt, shock and loss of self-esteem and altered behavior. Discomfort from answering personal or probing questions. Sensory deprivation, sleep deprivation, use of hypnosis, deception or mental stresses are examples of psychological risks.
Social: The potential for alterations in relationships with others that are to the disadvantage of the subject, including embarrassment, loss of respect of others, labeling a subject in a way that will have negative consequences, or in some way diminishing those opportunities and powers a person has by virtue of relationships with others.

In evaluating risk, the IRB also considers the steps taken to minimize (if not eliminate) that risk. A key consideration is: are the research procedures and/or data collection necessary for the research question.

Some considerations to reduce risk:

Recording data without identifiers/using codes to identify participant data
Collecting just the necessary data for this study, or justifying the collection of supplemental or other information
Collecting the fewest specimens with the least volume necessary
Collecting the least data points necessary
Limiting access to data/destroying records in a timely (and legally/ethically-consistent time frame)
Use existing records or specimens
Maximizing the timing of biospecimens (collecting blood, X-rays, or other procedures at the same time; limiting exposure to MRI, PET, CT or other somewhat invasive scans)

In evaluating the risk, IRB procedures are categorized into four categories:

No greater than minimal: poses no more risk than experienced in daily life. Examples include observational studies without researcher contact with participants and non-sensitive surveys and anonymized studies. Studies at this risk level likely quality for exempt reviews.
Minor increase over minimal risk: medium to high probability of the occurrence of a low-severity event that is completely reversible or the odds of extreme harm are low. Examples include applying electrodes, discomfort from certain surveys, potential for breach of confidentiality. The populations included here are not vulnerable populations. Studies at this level likely can be evaluated at expedited.
Moderate risk: Risks are recognized as being greater than minimal, but are not considered high. There is a medium to high probability of a moderate-severity event occurring as a result of study participation but there is adequate surveillance and protections to identify adverse events promptly and to minimize their effects. Examples include any study in which >5% of the population may experience an adverse risk, studies with deception, and minimal risk studies with vulnerable populations (including children, prisoners, pregnant persons, low resource, low cognitive functioning, and others). Studies with this level of risk must be evaluated by the full board.
High risk: The study risk is greater than a moderate risk study due to the increased probability for generating serious adverse events. There is a high probability of an event that is serious and prolonged or permanent occurring as a result of study participation. In situations where there is the prospect of direct benefit to the subject, study risks are high or there is significant uncertainty about the nature or likelihood of adverse events. Examples include clinical trials, implantation of devices, potential exposure to toxicity. Studies with this level of risk must be evaluated by the full board and may require interview from the primary investigator.

Three levels of review

Exempt:

Exempt research is evaluated by either the Chair or one IRB member for ethical compliance (additional members may be asked to verify). This level of review does not guarantee the "fastest" or "lightest" approval method. All it means is that the study's methods are most likely to cause minimal risk, if any. As a result, once approved, the protocol is "exempt" from any further IRB oversight pending no significant changes are made. Upon review, it is possible that the Chair or other member of the IRB determines the protocol requires a higher level of oversight and will inform the primary investigator if that ends up being the case. Other considerations are listed below.

Must involve only procedures or be a type of research study listed in one or more of the exempt categories (see exempt categories sections below);
Cannot involve any of the exceptions for the exempt categories for research that involves children ;
For studies subject to pre-2018 Common Rule requirements:
1. The study cannot involve prisoners as research subjects if they are the targeted population.
2. Cannot be greater than minimal risk. “Minimal risk means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.” 45 CFR 46.102(i)(Pre-2018 Requirements).
For studies subject to the Revised Common Rule (2018 Requirements):
1. The study cannot involve prisoners unless the research is aimed at involving a broader subject population that only incidentally includes prisoners.
2. For exempt categories that require limited IRB review, the IRB must conduct a limited IRB review to make the determination required by the exemption.
Exempt reviews do not generally require renewal or progress reports. The "exempt" in "exempt review" refers to ongoing IRB oversight. However, the IRB may request ongoing review or status updates if they deem it appropriate or necessary.
Any substantial modifications will require an amendment for exempt reviews.
1. Examples of changes that do not need an amended review: subtraction/omission of individual test items or surveys; addition of non-invasive, non-identifying, or non-personal procedures, the addition of procedures that do not add significant burden to participant's time, burden, or risk of harm, minor changes in recruitment process (e.g., recruiting from an additional well-known social media platform).
2. Examples of changes that do need a new review: changes in consent process, addition of deception, significant changes of recruitment procedures (e.g., a social media platform designed for a vulnerable population; in-person recruitment), collection of identifying information, modification of target population, significant modification of data storage or de-identification procedures.
3. The above are examples; any questions should be directed to a member of the IRB or the IRB chair.

The following categories may be considered exempt under the revised 2018 common rule (CFR §46.104(d)(1-8).

Exemption #1: Educational Exemption

Research, conducted in established or commonly accepted educational settings, that specifically involves normal educational practices that are not likely to adversely impact students' opportunity to learn required educational content or the assessment of educators who provide instruction.

This includes most research on regular and special education instructional strategies, and research on the effectiveness of or the comparison among instructional techniques, curricula, or classroom management methods.

Exemption #2: Research involving interviews, tests, surveys, observation of public behavior

Research that only includes interactions involving educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior (including visual or auditory recording) if at least one of the following criteria is met:

(i) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;

(ii) Any disclosure of the human subjects' responses outside the research would not reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, educational advancement, or reputation; or

(iii) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a limited IRB review to make the determination required by §46.111(a)(7).

**No part of this study may include an intervention, collection of biospecimens, research with children (with limited exceptions of educational testing and public observations) or other vulnerable populations.**

Again, this exemption only applies to surveys • interviews (including cognitive interviews) • focus groups • Educational tests (e.g., cognitive, diagnostic, aptitude, achievement) • observation of public behavior (i.e., behavior that occurs in a public place where there is no expectation of privacy and where no special permission is required to observe others such as a public venue)

Exemption #3: benign behavioral interventions

A "benign intervention" is defined as one that is brief in duration, harmless, not physically invasive, painless, not embarrassing or offensive, and not likely to have a lasting adverse impact.

Research involving benign behavioral interventions in conjunction with the collection of information from an adult subject through verbal or written responses (including data entry) or audiovisual recording if the subject prospectively agrees to the intervention and information collection and at least one of the following criteria is met:

(iii) The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, and an IRB conducts a Limited IRB review to make the determination required by §46.111(a)(7).

What's NOT allowed:

Research with children
Deception, unless prior agreement from participants is obtained
Physiological data collection methods that touches participants (e.g., EEG; wearable devices; blood pressure monitors)

Examples: Benign behavioral interventions could include having participants play an online game, having them solve puzzles under various environmental conditions, or having them decide how to allocate a nominal amount of cash between themselves and others.

Deception: If the research involves deceiving participants regarding the nature or purposes of the research, this Exemption is not applicable unless the participant consents to the deception. This should occur through a participant being informed through the consent process that there are portions of the study that they will be unaware of or not fully described. Debriefing participants about the nature of the deception is required, unless a waiver is specifically requested and justified in your application to the IRB.

“Limited IRB Review” is required for Exempt #3(iii) - when sensitive identifiable data are collected to ensure that adequate protections are in place to protect subject privacy and the confidentiality of data. This means that the IRB must review and approve procedures for data management and security where sensitive information is collected with direct identifiers (e.g., name, address, email, phone number, social security number, student ID, patient ID) OR indirect identifiers, such as a code that can link back to a subject, or data elements that could be combined to readily re-identify a subject (e.g., dates, employment history, etc.).

Exemption #4: Secondary research with identifiable private information or biospecimens

Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:

(i) The identifiable private information or identifiable biospecimens are publicly available;

(ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;

(iii) The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under HIPAA for the purposes of ‘‘health care operations’’ or ‘‘research’’ as those terms are defined at 45 CFR 164.501, or for ‘‘public health activities and purposes’’ as described under 45 CFR 164.512(b).

**(iv) The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for non-research activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.

What's NOT allowed:

Collection and analysis of protected health information (PHI) and personally identifiable information (PII). If you intend to collect both PHI and PII, the research could not be reviewed under an Exempt category. This study would likely fall under an Expedited Category #5.

Since HIPAA does not apply to biospecimens, Exempt #4(iii) applies only to the secondary use of PHI (which can include information obtained from biospecimens), not the biospecimens themselves.

Exemption #5: public benefit/Service program research

Research and demonstration projects that are conducted or supported by a Federal department or agency, or otherwise subject to the approval of department or agency heads (or the approval of the heads of bureaus or other subordinate agencies that have been delegated authority to conduct the research and demonstration projects), and that are designed to study, evaluate, improve, or otherwise examine public benefit or service programs, including procedures for obtaining benefits or services under those programs, possible changes in or alternatives to those programs or procedures, or possible changes in methods or levels of payment for benefits or services under those programs.

Such projects include, but are not limited to, internal studies by Federal employees, and studies under contracts or consulting arrangements, cooperative agreements, or grants. Exempt projects also include waivers of otherwise mandatory requirements using authorities such as sections 1115 and 1115A of the Social Security Act, as amended.

Each Federal department or agency conducting or supporting the research and demonstration projects must establish, on a publicly accessible Federal Web site or in such other manner as the department or agency head may determine, a list of the research and demonstration projects that the Federal department or agency conducts or supports under this provision. The research or demonstration project must be published on this list prior to commencing the research involving human subjects.

Exemption #6: TASTE/FOOD QUALITY EVALUATION & CONSUMER ACCEPTANCE

(i) If wholesome foods without additives are consumed, or

(ii) If a food is consumed that contains a food ingredient at or below the level and for a use found to be safe, or agricultural chemical or environmental contaminant at or below the level found to be safe, by the Food and Drug Administration or approved by the Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture.

**This category is rarely used, please consult before submitting under this category.

exemption #7: STORAGE/MAINTENANCE OF IDENTIFIABLE BIOSPECIMENS WITH BROAD CONSENT

This category covers the storage or maintenance of identifiable private information or identifiable biospecimens for secondary research. Secondary research refers to research with materials originally obtained for non-research purposes or for research other than the current research proposal. The Exemption can only be used when there is broad consent from the participants for the storage, maintenance, and secondary research use of their identifiable materials.

**This is a controversial exemption. Please consult with the IRB before pursuing this exception.

**The definition of "broad consent" is below

Exemption #8: USE OF IDENTIFIABLE DATA / BIOSPECIMENS OBTAINED WITH BROAD CONSENT Details

This category covers the secondary research use of identifiable private information or identifiable biospecimens originally obtained for non-research purposes or for research other than the current proposal. There are four requirements that must be satisfied to use Exemption #8:

1) Broad consent must be obtained from the subjects for the secondary research use of their identifiable materials; and

2) Documentation or waiver of documentation of informed consent must be obtained; and

3) An IRB must conduct a limited review to make certain determinations relating to privacy and confidentiality protections and broad consent; and

4) Investigators cannot include the return of individual research results to subjects in the study plan. Note that this requirement does not limit an investigator’s ability to abide by any other legal requirement to return individual research results.

**This is also a controversial exemption. Please consult with the IRB before pursuing this exemption.

**The definition of "broad consent" is below

What is Broad consent and can suny-ow implement it?

In the revised Common Rule, "broad consent" is an alternative consent process only for the storage, maintenance, and secondary use of identifiable private information or identifiable biospecimens for future, yet-to-be-specified research. The use of broad consent requires that the investigator maintain a sophisticated tracking system. SUNY OW does not generally have the infrastructure to implement the broad consent option at this time. Therefore, it is unlikely that the IRB at SUNY OW can accomodate Exemptions #7 and #8.

For full details about broad consent including the requirements (in addition to tracking), limitations, and considerations for use, see SACHRP's Recommendations for Broad Consent Guidance.

Expedited

Expedited reviews can be conducted if the level of risk exceeds that of the exempt categories and protocols above, but does not meet the needs of a full-board review. Depending on the protocol, continuing review and oversight by the IRB is likely to be requested, but is not necessary. A termination or renewal date of the IRB can be applied. Under the expedited process, the IRB chair and/or one additional member of the IRB will verify the conditions for expedited reviews are met and that a full board review is not needed. Reviewers may request minor modifications (e.g., in wording), but protocol modifications will be determined by a full-board review. Consent and recr

The following categories may be considered expedited under the revised 2018 common rule (CFR §46.104(d)(1-8).

Expedited category #1: Clinical studies of drugs and medical devices only when certain conditions are met

a) Research on drugs for which an investigational new drug application (21 CFR Part 312) is not required.

b) Research on medical devices for which (i) an investigational device exemption application (21 CFR Part 812) is not required; or (ii) the medical device is cleared/approved for marketing and the medical device is being used in accordance with its cleared/approved labeling.

Expedited Category #2: Collection of blood samples by finger stick, heel stick, ear stick, or venipuncture in certain populations and within certain amountsDetails

Qualified under the following conditions:

a) From healthy, nonpregnant adults who weigh at least 110 pounds. For these subjects, the amounts drawn may not exceed 550 ml in an 8 week period and collection may not occur more frequently than 2 times per week;

b) from other adults and children considering the age, weight, and health of the subjects, the collection procedure, the amount of blood to be collected, and the frequency with which it will be collected. For these subjects, the amount drawn may not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and collection may not occur more frequently than 2 times per week.

Expedited category #3: Prospective collection of biological specimens for research purposes by noninvasive means

Examples: (a) hair and nail clippings in a nondisfiguring manner; (b) deciduous teeth at time of exfoliation or if routine patient care indicates a need for extraction; (c) permanent teeth if routine patient care indicates a need for extraction; (d) excreta and external secretions (including sweat); (e) uncannulated saliva collected either in an unstimulated fashion or stimulated by chewing gumbase or wax or by applying a dilute citric solution to the tongue; (f) placenta removed at delivery; (g) amniotic fluid obtained at the time of rupture of the membrane prior to or during labor; (h) supra- and subgingival dental plaque and calculus, provided the collection procedure is not more invasive than routine prophylactic scaling of the teeth and the process is accomplished in accordance with accepted prophylactic techniques; (i) mucosal and skin cells collected by buccal scraping or swab, skin swab, or mouth washings; (j) sputum collected after saline mist nebulization.

Expedited Category #4: Collection of data through noninvasive procedures (not involving general anesthesia or sedation) routinely employed in clinical practice, excluding procedures involving x-rays or microwaves.

Where medical devices are employed, they must be cleared/approved for marketing. (Studies intended to evaluate the safety and effectiveness of the medical device are not generally eligible for expedited review, including studies of cleared medical devices for new indications.)
Examples: (a) physical sensors that are applied either to the surface of the body or at a distance and do not involve input of significant amounts of energy into the subject or an invasion of the subject=s privacy; (b) weighing or testing sensory acuity; (c) magnetic resonance imaging; (d) electrocardiography, electroencephalography, thermography, detection of naturally occurring radioactivity, electroretinography, ultrasound, diagnostic infrared imaging, doppler blood flow, and echocardiography; (e) moderate exercise, muscular strength testing, body composition assessment, and flexibility testing where appropriate given the age, weight, and health of the individual.

Expedited Category #5: Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for nonresearch purposes (such as medical treatment or diagnosis).

This listing refers only to research that is not exempt. See exemption #4.

Expedited category #6: Collection of data from voice, video, digital, or image recordings made for research purposes.

These are, by definition, identifying. Protection of these data must meet all HHS requirements described elsewhere, including efforts to maintain confidentiality, de-identification, storage, and, ultimately, destruction of the data. Note that data collected from vulnerable populations in this manner will require full board review.

Expedited category #7: Research on individual or group characteristics or behavior

These include, but are not limited to, research on perception, cognition, motivation, identity, language, communication, cultural beliefs or practices, and social behavior), or research employing survey, interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies. Ensure that your study does not meet the exempt categories above. Research in this category can include the collection of identifying information (e.g., collected on printed consent forms or intake forms) or sensitive information that may be disturbing or potentially unsettling (e.g., the use of graphic stimuli; asking about histories of abuse, drug use, suicidal behaviors, etc.). Anything with significant qualitative data likely fits this category (e.g., interviews where identifying information may be expressed either deliberately or incidentally).

Expedited category #8: Continuing review of research previously approved by the convened IRB (see details)

where (i) the research is permanently closed to the enrollment of new subjects; (ii) all subjects have completed all research-related interventions; and (iii) the research remains active only for long-term follow-up of subjects; or
where no subjects have been enrolled and no additional risks have been identified; or
where the remaining research activities are limited to data analysis.

Expedited category #9: Continuing review of research, not conducted under an investigational new drug application or investigational device exemption (see details)

Categories two (2) through eight (8) do not apply but the IRB has determined and documented at a convened meeting that the research involves no greater than minimal risk and no additional risks have been identified.Details

Full Board

If a study's methods and/or populations do not fall into the above categories, odds are, it will need a full-board review. A protocol should be submitted for full-board review if any (or a combination) of the present is predicted:

risk is moderate or high (i.e., "greater than minimal)
involves recruitment of vulnerable populations (note: this is intended for purposive/deliberate recruitment of participants, not incidental involvement)
sensitive topics (e.g., illegal/high-risk behaviors)
anything where mandated reporting may emerge (e.g., child/elder abuse; disclosure of harm to self or others)
anything with genetic testing
complex research designs requiring expertise and oversight by the board
use of deception
All research taking place outside of the United States and/or with intentional international recruitment (note: this does not include incidental participation by individuals outside of the United States, only deliberate recruitment).
most medical and clinical studies that do not fall into the categories of exempt or expedited (e.g., drugs, devices, biologics, new medical or surgery procedures)

Does your population meet the definition of "protected" or "vulnerable"?

A vulnerable population is generally defined as having an increased risk of abuse via manipulation, coercion, undue influence, or physical control. These populations are considered to have increased risk of difficulties with communication, cognition, independence and decision making, and generally are in positions where they may believe they have to defer to more powerful agents than themselves. As considered by this IRB, the following groups are considered vulnerable (this is not an exhaustive list):

Individuals with serious mental illness and/or limited cognitive or physical capacity
prisoners/incarcerated individuals
individuals living in an institution (correctional facilities, nursing homes, etc.)
minors, neonates and infants, fetuses, (i.e., anyone under the age of 18)
older adults (typically defined as those ≥65 years of age)
survivors of abuse, torture, genocide, and crimes against humanity
surivvors of persecution (including based on sexual orientation and gender identity)
individuals for whom participation in a study may place them at risk for any of the reasons above (e.g., legal, social, economic)
economically or socially disadvantaged, low-resource, or otherwise with limited capacity

Note: this category is only involved for purposive and deliberate recruitment, not for incidental involvement. In other words, this does not apply if it is possible for a member of the population to be in your study (they do not need to be excluded). For example, if you are doing crowd sourced data and a respondent happens to be a pregnant person, then this does not apply.

Studies involving these populations are welcome, but will automatically be reviewed by the full board.

Note: IRB members evaluating a protocol submitted for exempt or expedited review may call for full review to determine level of risk.

Types of Review