To minimize potential risks of harm, a researcher conducting an on-line survey can:

Q. Is my survey project really human subjects research?

Q. I think my project is exempt and should not have to be submitted. Are all research projects involving human subjects required to undergo full IRB Committee review?

Q. My survey doesn't meet the requirements for exemption. Does that mean it has to be reviewed by the full IRB committee?

Q. Do I always have to get informed consent?

Q. What are the elements of consent that must be provided to subjects?

Q. What is considered minimal risk?

Q. What is the difference between 'anonymous' and 'confidential'? How can confidentiality be maintained?

Q. I want to do a survey of high school students, do I need parental consent? What is assent?

Q. I'm not asking anything about the respondent. I want to know only about the place where she works. Does my survey still need to be reviewed by the IRB?

Q. I'm not asking any sensitive questions. Does my survey still need to be reviewed by the IRB?

Q. May I ask a respondent to tell me personal details about other family members?

Q. My IRB does not have any survey experts among its members. What right do they have telling me how to improve my survey?

Q. If I have approval for my survey from one IRB, why would I need approval from other IRBs?

Q. Do I need IRB approval to put a survey online?

Q. When conducting data collection through email or web surveys, what unique features of internet communication and data storage must be addressed?

Q. My IRB wants me to state the possible harms that might come from my survey, which does not include any highly sensitive questions. What should I tell them?

Q. Does the IRB/human subject protection guidance also apply to pilot studies, questionnaire development and testing efforts conducted with members of the population?

Q. Is my survey project really human subjects research?

A. Most surveys

meet the federal definition of research. In defining human subjects research activities, two separate determinations must be made. The first determination is whether or not the activity can be considered research. If the answer is "yes," investigators must follow up with a second determination: Does the research involve human subjects? Both determinations must be made using the definitions of the terms "research" and "human subjects" in 45 CFR 46.102 (a-j):

Research: "a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research, whether or not they are conducted or supported under a program which is considered research for other purposes." Investigators unsure of whether an activity constitutes human research should contact their IRB.

Human subjects: "living individual(s) about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information." Activities in which a researcher collects private, identifiable information about third parties would meet the definition of "human subjects."
Examples of activities that

meet these definitions would be (1) ad hoc evaluations of a workshop or symposium (not a systematic investigation), (2) sample surveys on employee satisfaction within one company if the goal is to identify areas for improvement within that company (not designed to contribute to generalizable knowledge) or (3) an analysis of 1880 census records (not information about living individuals). At some institutions, surveys conducted by students for a class project that will not produce a thesis or scholarly publication may be considered to be non-research; check with your institution to learn local practice with regard to student survey projects.
 

Q. I think my project is exempt and should not have to be submitted. Are all research projects involving human subjects required to undergo full IRB Committee review?

A. Yes, all research projects, including those that you think will be exempt, must be submitted to the IRB for initial review.  Some types of research are exempt from the regulations that govern and empower IRBs, and the regulations allow other types of research to be reviewed in an expedited process. Many survey projects are eligible for exemption.  However, the determination of exempt status (and the type of review that applies) rests with the IRB or with an administration official named by your institution. The determination does not rest with the investigator. Therefore, all projects must be submitted to the IRB for initial review. Some IRBs have special forms or sub-forms for requests for exemptions while others use the same application materials for all projects. Regardless of the form, nearly all IRBs use an expedited process for the initial review of protocols that are headed for exempt status, allowing fairly rapid determination of exempt status for proposed studies that unambiguously meet the criteria for exemption.  Of the criteria listed below, most survey research falls under Category 2.

NOTE: Exemption categories cannot be applied to research involving fetuses, pregnant women, children, human in vitro fertilization, or prisoners. In the case of studies where pregnant women might be part of the subject pool (e.g., RDD or other surveys) but are not a target population, some IRBs may deem the study as eligible for exemption while others may not.

Category 1 - Research conducted in established or commonly accepted educational settings, involving normal educational practices.
Category 2 - Research involving the use of educational tests, survey procedures, interview procedures, or observation of public behavior, unless: (a) information obtained is recorded in such a manner that the human subjects can be identified, directly or through identifiers linked to the subjects; and (b) any disclosure of the human subjects' responses outside the research could reasonably place them at risk of criminal or civil liability or be damaging to their financial standing, employability, or reputation.

Category 3 - Research involving the use of educational, survey procedures, interview procedures, or observation of public behavior that is not exempt under Category 2 above if: (a) the subjects are elected or appointed public officials or candidates for public office; or (b) federal statues(s) require(s) without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter.

Category 4 - Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to them.

Category 5 - Research and demonstration projects which are conducted by or subject to the approval of department or agency heads, and which are designed to study, evaluate, or otherwise examine: (a) public benefit or service programs; (b) procedures for obtaining benefits or services under those programs; (c) possible changes in or alternatives to these programs or procedures; or (d) possible changes in methods or levels of payment for benefits or services under those programs.

Category 6 - Taste and food quality evaluation and consumer acceptance studies.

Q. My survey doesn't meet the requirements for exemption. Does that mean it has to be reviewed by the full IRB committee?

A. Not necessarily. Federal regulations allow expedited review if the protocol meets one or more of the specific criteria listed below. The process varies from institution to institution but typically, a subcommittee of the IRB, the IRB chair or his/her designee reviews protocols and may either approve them or refer the protocol to the full Board for review at the next meeting. The categories for expedited review are as follows (45 CFR 46.110(a)):

Category 1 - Clinical studies of drugs and medical devices only when (a) the research is on drugs for which an investigational new drug application (21 CFR 312) is not required or (b) the research is on medical devices for which (i) an investigational device exemption application (21 CFR 812) is not required or (ii) the medical device is cleared/approved for marketing and the medical device is being used in accordance with its cleared/approved labeling.

Category 2 - Collection of blood samples by finger stick, heel stick, ear stick, or venipuncture from (a) healthy, non-pregnant adults who weigh at least 110 pounds for whom (i) the amounts drawn do not exceed 550 ml in an 8 week period and (ii) collection does not occur more frequently than 2 times per week or (b) other adults and children, for whom, considering the age, weight, and health of the subjects, and the collection procedures, (i) the amount of blood to be collected does not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and (ii) collection does not occur more frequently than 2 times per week. (Note: Children are defined as "persons who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted.")

Category 3 - Prospective collection of biological specimens for research purposes by noninvasive means.

Category 4 - Collection of data through non-invasive procedures (not involving general anesthesia or sedation) routinely employed in clinical practice, excluding procedures involving x-rays or microwaves. (Note: Where medical devices are employed, they must be cleared/approved for marketing.)

Category 5 - Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected, solely for non-research purposes (such as medical treatment or diagnosis).

Category 6 - Collection of data from voice, video, digital, or image recordings made for research purposes.

Category 7 - Research on individual or group characteristics or behavior or research employing survey, interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies.

According to the Federal regulations and Category 7, most survey research that is not otherwise exempt is eligible for expedited review. However, the expedited review procedure may not be used "where identification of the subjects and/or their responses would reasonably place them at risk of criminal or civil liability or be damaging to the subjects financial standing, employability, insurability, reputation, or be stigmatizing, unless reasonable and appropriate protections will be implemented so that risks related to invasion of privacy and breach of confidentiality are no greater than minimal." (63 FR 60364, November 9, 1998)

Q. Do I always have to get informed consent?

A. Yes, though in some circumstances IRBs can waive the requirement for this to be a written document. The informed consent process is a basic ethical obligation for researchers. It consists of providing adequate information to the subject about the study, giving the subject the opportunity to consider options, responding to questions the subject may have and ensuring that the subject or the legal representative (parent or guardian) understands the information (see 45 CFR 46.116).

Consent must be obtained from the research subjects or their legally authorized representatives (parents or guardians) before participation in research begins. The regulations refer to a signed consent statement (45 CFR 26.117(a)). However, the regulations also provide for some flexibility. If requested by the investigator, the IRB may waive the signature requirement for certain types of minimal risk research, such as surveys. This is referred to as a waiver of documentation of consent. Even when documentation is waived, the informed consent process must still occur. For example, IRBs have approved waivers of documentation when an introductory letter or introductory paragraph includes the elements of consent required.

According to 45 CFR 46 Section 46.117 (c), an IRB may waive the requirement for the investigator to obtain a signed consent form for some or all subjects if it finds either:
the research presents no more than minimal risk and
the research involves no procedures for which written consent is normally required outside of the research context
or
the principal risks are those associated with a breach of confidentiality concerning the subject's participation in the research and
the consent document is the only record linking the subject with the research.

Most survey research meets the requirements for waivers of signed consent, because surveys conducted outside of a research context rarely require written consent. However, it is important to note that it is the investigator's responsibility to request waivers of documentation of consent, and the investigator's rationale for a waiver may or may not be compelling to the IRB.

Q. What are the elements of consent that must be provided to subjects?

A. The following elements of consent are required by the Federal regulations (45 CFR 46.116(a)). The first set lists the requirements for all research. The second set is required only if deemed appropriate or applicable by the IRB.

(1) a statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's participation, a description of the procedures to be followed, and identification of any procedures which are experimental;

(2) a description of any reasonably foreseeable risks or discomforts to the subject;

(3) a description of any benefits to the subject or to others which may reasonably be expected from the research;

(4) a disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;

(5) a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;

(6) for research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained;

(7) an explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights, and whom to contact in the event of a research-related injury to the subject; and

(8) a statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.

(1) a statement that the particular treatment or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) which are currently unforeseeable;

(2) anticipated circumstances under which the subject's participation may be terminated by the investigator without regard to the subject's consent;

(3) any additional costs to the subject that may result from participation in the research;

(4) the consequences of a subject's decision to withdraw from the research and procedures for orderly termination of participation by the subject;

(5) a statement that significant new findings developed during the course of the research which may relate to the subject's willingness to continue participation will be provided to the subject; and

(6) the approximate number of subjects involved in the study.

Q. Can any of the required elements be waived by the IRB?

A. Yes. If there is a compelling reason to waive one or more elements, then the IRB may do so (45 CFR 46.116(d)). In the context of minimal risk survey research on mundane topics, where potential subjects might refuse to participate rather than listen to a lengthy informed consent process, an investigator might wish to minimize respondent time burden by requesting a waiver of one or more elements in the oral consent process and offering instead to provide the information in response to a subject's question. For example, some IRBs have agreed to waive the required "explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights" if it is available to any subject requesting it. Importantly, it is the investigator's responsibility to request waivers of consent or any specific elements of consent, and the investigator's rationale for a waiver may or may not be compelling to the IRB.

The Federal regulations (45 CFR 46.116(d)) state that IRBs may approve a waiver of consent or any specific elements of consent if the IRB determines:

That no more than minimal risk to research subjects would be involved.

That the rights or welfare of subjects would not be adversely affected.

That the research could not be practicably conducted without a waiver.

Additionally, regulations require that, if appropriate, there be a plan to provide the waived consent information to subjects after the conclusion of the study. This would be the case for studies that involve deception.

A. In many cases, documentation of consent (the signature on a physical consent form) may be waived for questionnaires or interviews. Unless there is more than minimal risk, many IRBs will waive the documentation and allow the investigator to provide the relevant consent information in the form of a cover letter, introductory statement (in an interview), or introductory screen display (in a Web survey). Examples of "IRB-approved" consent documents for different forms of data collection are available on the AAPOR website. In cases where there is greater than minimal risk, a waiver of documentation may still be appropriate if the survey is anonymous because the signed consent form would be the only part of the study that identifies a subject. In other cases (e.g., surveys of minors), many IRBs will require documented permission granted by the parent or guardian.

Q. What is considered minimal risk?
A. Minimal risk means that the probability and magnitude of harm or discomfort anticipated are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests (45 CFR 46.102(i)). Most, but not all, surveys meet this definition.

Q. What is the difference between 'anonymous' and 'confidential'? How can confidentiality be maintained?

A. According to the Federal regulations (45 CFR 46.101(b)), survey research may be exempt from the regulations unless "the information obtained is recorded in such a manner that the human subjects can be identified, directly or through identifiers linked to the subjects" or if "federal statute(s) require(s) without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter." The former refers to anonymous research. Anonymous means entirely without name or identifier, so the individual cannot be discerned in any way by anyone. No one can link an individual person to the responses of that person, including the investigator. For this reason, face-to-face interviews are never anonymous. If phone numbers or other identifiers are not stored, then RDD telephone interviews could be considered anonymous. Mailback questionnaires are considered anonymous only if no tracking codes are utilized.

Web-based surveys that are accessed through a common URL for the survey (instead of via individualized passwords or tracking codes) may be considered anonymous if they do not ask the respondent for any identifying information. However, some Web survey tools collect the IP address of the respondent’s computer, and this factor must be considered when determining the anonymity of the data collection process. Depending on the survey’s content, IRBs have sometimes allowed IP addresses to be collected and have still considered the protocol to be anonymous if the IP addresses are promptly removed from the file, or if investigators pledge not to use the IP address information to determine respondent identities. The IP address on the Web server is thus sometimes treated in a manner similar to the phone number stored in the CATI system in an RDD telephone interview. If using a commercial vendor to conduct a Web-based survey, be sure to read the terms of service to find what they record, collect, use, sell, etc. and decide what should be told up front to respondents.

“Confidential” means that the investigator can (or could) identify individuals who participated in a study, perhaps through a code, however the investigator will not share the confidential information to other than authorized individuals. Although the identities may be recorded, data can be kept confidential if they are carefully coded, if face sheets (paper questionnaire cover sheets with respondent identifiers) and consent documents are separated from survey instruments, if computer printouts that show respondent identifiers and other papers are properly disposed, if access to identifiable data is limited, if research staff are educated about the importance of protecting confidentiality, and if records are stored in secured locations. More elaborate procedures may be appropriate for research involving sensitive data that may involve a greater risk should confidentiality be breached, and investigators may want to seek Certificates of Confidentiality to protect such data from subpoena.

However, unless federal statutes mandate this confidentiality (e.g., statutes surrounding the decennial census), confidential surveys that are not anonymous are not eligible for exemption using these criteria. Confidential surveys may, however, still be eligible for exemption if any disclosure of the human subjects' responses outside the research could not possibly place them at risk of criminal or civil liability or be damaging to their financial standing, employability, or reputation.

Q. I want to do a survey of high school students or children, do I need parental consent? What is assent?

A. Yes, you need parental consent. Because children have not yet attained legal age, the parent or legal guardian is asked to give permission for participation whenever a child is asked to take part in research (45 CFR 46.408(b)). Federal regulations require, however, that children be asked to provide assent, or agreement to participate in the research, whenever they are capable of doing so. Age, maturity and psychological state need to be taken into account when determining whether to ask for assent (45 CFR 46.408(a)). Out of respect for developing persons, it is important to involve children in the decision-making process whenever possible. Though they may not be able to give legal consent, they have the ability to assent or to dissent. It is important to keep in mind that a child's failure to object to participation should not automatically be construed as assent. Assent implies the affirmative, explicit agreement of the child.

Usually children who are age seven and older are asked to provide verbal assent or, in some cases, sign an assent form, which is stated or written in language appropriate to the ages and conditions of study subjects. The assent should include a description of the study and describe any inconveniences and discomforts subjects may experience. IRB requirements may vary regarding the age at which a signed form is required.

NOTE: While parental consent is usually required, all states have an ‘emancipated minor’ status for youth under 18 that meet certain conditions. In those cases, the child has the legal authority to provide informed consent, and parental consent is not required.

Q. I'm not asking anything about the respondent. I want to know only about the place where she works. Does my survey still need to be reviewed by the IRB?

A. Yes. The project may not meet the definition of human subject if the questions are not about any individual (attributes, attitudes, or private knowledge). However, this determination is sometimes difficult to make and the decision rests with the IRB, not with the investigator.

Q. I'm not asking any sensitive questions. Does my survey still need to be reviewed by the IRB?

A. Yes. All research must be reviewed by the IRB. If the project is minimal risk, then it may qualify for exemption or be handled in an expedited review by the IRB. The specific decision rests with the IRB or with an administration official named by your institution, not with the investigator.

Q. May I ask a respondent to tell me personal details about other family members?

A. It depends. This question deals with an issue known as third party consent. Although the Federal regulations do not deal with this issue explicitly, the question has received increasing discussion over the last several years. Many IRBs would conclude that, when an investigator conducting research obtains identifiable private information about a living individual, that individual becomes a research subject, regardless of whether that person is the individual with whom the investigator is having an interaction. For example, if the research involves asking the primary subject to provide identifiable private information about a third party (also known as a secondary subject), that third party then becomes a subject in the research. As such, all of the regulatory requirements for protecting that individual obtain.

IRBs may differ in their interpretations of "identifiable private information." To better understand the issues of interpretation, consider two examples: (1) an unemployed person provides household income information for a two-person household in which only one household member is employed; (2) a mother provides health information about the father of her child. In the first example, the information is identifiable, but may not be considered private. In the second example, the information is private, but may not be considered identifiable if no identifying information was gathered about the father. However, if an IRB determines that these examples represent "identifiable private information" (as it may reasonably do), then the Federal regulations require informed consent from the employed person or the father before such questions are asked of the unemployed person or the mother.

The IRB can determine whether informed consent needs to be sought from third party subjects. The IRB can also determine whether this consent may be waived. The Federal regulations (45 CFR 46.116(d)) state that IRBs may approve a waiver of consent if the IRB determines that the research poses no more than minimal risk to the secondary subject, that the rights or welfare of the secondary survey would not be adversely affected, that the research could not be practicably conducted if consent from the secondary subject were required, and that, if appropriate, there be a plan to provide the waived consent information to the secondary subject after the conclusion of the study.

Investigators whose research may involve secondary subjects are encouraged to contact the IRB to discuss how to best protect the rights and welfare of these subjects in a given project. Other information on the issue of third party information is available at:

https://osp.od.nih.gov/clinical-research/privacy-and-confidentiality-in-research/

Q. My IRB does not have any survey experts among its members. What right do they have telling me how to improve my survey and why are they questioning the science rather than the subject protections?

A. During their review of research, IRBs are expected to make a determination about whether any risks to subjects are reasonable relative to the expected benefits. When determining whether the risks to subjects are outweighed by the benefits of the research, the IRB may take into account the merits of the scientific design (45 CFR 46.111(a)(2)). If the scientific merit is deemed marginal, then the IRB may determine that there will be no benefit and that any risk is therefore unwarranted.

Rather than reject marginal research outright, some IRBs will tell investigators how to improve the scientific merit of the research. The regulations specify that the IRB must include persons knowledgeable in the specific research areas being reviewed (see 45 CFR 46.107a), with sufficient "experience and expertise to promote respect for its advice and counsel." Although many issues are common across social science methods, some are not. In cases where expertise is lacking on an IRB, the IRB should seek consultation from experts outside the IRB for assistance in a review. Investigators should consider asking about expertise and suggesting colleagues that might be knowledgeable about the specific research areas being reviewed. Investigators can also direct the IRB to the AAPOR website for additional information and assistance regarding issues related to human subject protections when utilizing survey methods.

Q. If I have approval for my survey from one IRB, why would I need approval from other IRBs?

A. Under the current system, IRBs have local control and review protocols in the context of the local and community attitudes. Hence, approval from an IRB in another place or institution is not considered sufficient if there is also a local IRB in place. Therefore, protocols require review at the investigator's institution even if they have been reviewed and received approval from a co-investigator's IRB. IRBs do, however, have the option of relying on another qualified IRB in order to avoid duplication of effort (45 CFR 46.114). Don't expect your IRB to defer jurisdiction if you have direct contact with the subjects. But if you are only acting in an advisory role, only adding a few questions to an omnibus survey, or only engaged in analysis issues, then your limited role in the research may convince your IRB to rely on the qualified IRB at another place or institution. The regulations permit, but do not encourage, such actions for cooperative research projects.

Q. Do I need IRB approval to put a survey online?

A. Yes, if the survey is for a research purpose. Computer- and Internet-based research protocols must address fundamentally the same risks (e.g., violation of privacy, legal risks, psychosocial stress) and provide the same level of protection as any other types of research involving human subjects. All studies, including those using computer and Internet technologies, must (a) ensure that the procedures fulfill the principles of voluntary participation and informed consent, (b) maintain the confidentiality of information obtained from or about human subjects, and (c) adequately address possible risks to subjects including psychosocial stress.

Q. When conducting data collection through email or web surveys, what unique features of internet communication and data storage must be addressed?

A. Electronic recruiting and data collection pose some additional challenges to human protections primarily in the area of confidentiality. The key challenges can be broken down into 4 areas:

RECRUITMENT: Computer- and Internet-based procedures for advertising and recruiting potential study subjects (e.g., Internet advertising, e-mail solicitation, banner ads) should follow the IRB guidelines for recruitment that apply to any traditional media, such as letters, telephone scripts, newspapers and bulletin boards. Authentication - that is, proper qualification and/or identification of respondents - is a major challenge in computer- and Internet-based research and one that threatens the integrity of research samples and the validity of research results. Researchers should take steps to authenticate respondents. For example, investigators can provide each study subject (in person or by letter) with a Personal Identification Number (PIN) to be used for authentication in subsequent computer- and Internet- based data collection.

DATA COLLECTION: It is often recommended that any data collected from human subjects over computer networks be transmitted in encrypted format. This helps insure that any data intercepted during transmission cannot be decoded and that individual responses cannot be traced back to an individual respondent. In addition, if the content of the responses would pose risk to the respondents if the information were shared, it is recommended that the highest level of data encryption be used, within the limits of availability and feasibility. It should also be noted that encryption standards vary from country to country and that there are legal restrictions regarding the export of certain encryption software outside the US.

SERVER ADMINISTRATION: It is recommended that for online data collection a professionally administered survey server be used or that: a) the server is administered by a professionally trained person with expertise in computer and Internet security, b) access to the server is limited to key project personnel and is configured with firewalls to minimize the possibility of external access to the server data, c) there are frequent, regularly scheduled security audits of the server, and d) the server is subject to the periodic security scans.

DATA STORAGE/DISPOSAL: If a server is used for data storage, personal identifying information and IP addresses should be kept separate from the data, and data should be stored in encrypted format. Data backups should be stored in a safe location, such as a secure data room that is environmentally controlled and has limited access. Competent data destruction services should be used to ensure that no data can be recovered from obsolete or discarded electronic media. For projects that are minimal risk, if these data security safeguards cannot be put in place, then language in the consent information should be added indicating that complete confidentiality cannot be guaranteed and/or that encryption of responses is not provided.

A. In some cases, the IRB may want only an explicit statement in the consent information indicating that risks are minimal and are no greater than those encountered in day-to-day life. In other cases, even demographic items might be viewed as "potentially harmful" by some IRBs if, for example, knowledge of income, religious affiliation, or educational attainment might pose a social risk in some contexts if the data were made public. In these cases, the introductory consent information might include disclosure that general items about income and education will be included in the interview. For other surveys of more sensitive topics, possible harms include embarrassment, psychological distress, or discomfort as a result of question content (e.g., surveys of private behaviors, abuse, or crime victimization). Some IRBs may require investigators to include the explicit statement that respondents may skip any item that they do not wish to answer. Additionally, mere contact may put a potential subject at risk depending on the survey and its target population. For example, the act of contacting individuals who have completed rehabilitation programs could be damaging if their families did not have knowledge about their treatment. All of these potential risks will be important to the IRB and will need to be anticipated and addressed by the investigator in order to provide adequate subject protections.

Q. I want to access administrative records to develop a sample frame for a health survey. What are the key issues related to consent for this and other studies?

A. Investigators sometimes want access to existing records in order to identify potential subjects or in order to conduct research. If the investigator will record subjects' names (either for further record review or for personal contact), this activity requires IRB review. The IRB will determine whether the consent of subjects should be sought before the researcher gains access to the records; in some cases, a waiver can be granted. When determining whether it is appropriate to waive the requirement to obtain consent from these subjects, the IRB considers the sensitivity of the information being recorded, the vulnerability of the subject population, and other risks to the subject. The IRB also considers whether the rights or welfare of the subjects would be adversely affected by the waiver, the purpose for which the investigator wants access to the information, and the practicability of conducting the research without the waiver. In some cases, consent cannot be waived. For example, the Buckley Amendment [the General Education Provisions Act (20 USC 1232), also known as FERPA] requires written parental permission for release of records or identifiable information about children in public schools. It is also important to note that recent HIPAA (Health Insurance Portability and Accountability Act) regulations are applicable to most medical records and may impact access and/or the ability of IRBs to grant consent waivers.

A. The Privacy Rule is a Federal regulation under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 that governs the protection of individually identifiable health information. The Rule was enacted to increase the privacy protection of health information identifying individuals who are living or deceased, and to regulate known and unanticipated risks to privacy that may accompany the use and disclosure of personal health information. The Privacy Rule is a regulation in addition to the Common Rule (45 CFR 46).  Whenever the Common Rule and the Privacy Rule do not agree, researchers should follow the regulation that provides the higher privacy protection.

HIPAA directly regulates three types of organizations that are defined as covered entities:

• Health care providers (both individuals and organizations who directly provide health care to patients)
• Health plans (insurers and payers)
• Health care clearinghouses (billing services)

There are several ways that researchers can obtain PHI from a covered entity while following the Privacy Rule.

• If a researcher only needs existing data and does not need to further contact any individuals, the covered entity can provide the data de-identified. De-identified data no longer include variables that may be necessary for research. Therefore, the Privacy Rule also allows a covered entity to provide a Limited Dataset that can retain:

• If the researcher plans to build their respondent database through a review of records containing PHI, and does not need to see the names of all potential respondents, then the study invitation can be made through the covered entity and contact information for only those individuals who want to proceed with the study would be provided to the researcher.
• If a covered entity receives written authorization from an individual to provide their data for a specified purpose, then that PHI can be provided to a researcher.
• A covered entity’s IRB can grant a waiver of authorization when the following conditions are met:

• There is no more than minimal risk to privacy based on a plan to protect any identifiers, a plan to destroy identifiers ASAP, and a written assurance that the PHI will not be re-used or disclosed except as required by law or for authorized oversight of the research.

If a researcher’s company is hired by a covered entity to perform a service that involves PHI on behalf of the covered entity, the Privacy Rule considers that organization to be a Business Associate and the two organizations need to complete a Business Associate Agreement (BAA) before any PHI can be provided. The BAA will describe how the researcher will receive, protect and return the PHI following the guidelines of the covered entity.

Q. Does the IRB/human subject protection guidance also apply to pilot studies, questionnaire development, and testing efforts conducted with members of the population?

A. Yes. The definition of research in the Federal regulations includes research development, testing, and evaluation (45 CFR 46.102(d)). Some IRBs might not consider such studies research if they are not systematic but overall, pilot studies and feasibility studies, including those involving only one human subject, require the same scrutiny as full-scale research projects. Pilot studies should be identified as such in applications to the IRB. Ordinarily the data collected from subjects in a pilot or feasibility study are not used for study findings.

A. Yes. The definition of research in the Federal regulations includes all research. However, the review process varies across institutions. If a "survey" is done for a class project, does not include vulnerable populations, is minimal risk, and will not be presented or published (e.g., as a thesis or scholarly paper), then some IRBs do not define the work as research and do not require formal review. Other IRBs review all student projects, including classroom demonstration projects. 
Therefore, it is important to review your institutional policies and to provide adequate time for preparation of applications and review when planning student projects.

A. Many professionals are subject to legal requirements to report the intent to harm oneself or others. Most IRB committees expect that professionals conducting research will comply with their professional reporting requirements and although the legal requirements to do so when acting as a researcher may not always be clear, there is an argument that the ethical obligation remains even if no clear legal requirement exists. Requirements differ by state and sometimes even county so if an investigator is conducting data collection that is likely to require mandatory reporting disclosure, the laws/requirements for all jurisdictions must be reviewed for all locations in order to include the applicable legal risks in the consent documents across locations. Regardless of mandatory reporting requirements, most survey centers train their interviewers to refer respondents to local crisis hotlines or other appropriate local agencies (e.g., domestic violence intervention number) if acute distress or danger is apparent during an interview.

A. Yes. The recruitment protocol would need to either screen out Facebook users under age 18 or obtain permission from the parent or legal guardian. The Children's Online Privacy Protection Act (COPPA) mandates that websites that collect information about users (like Facebook) are not allowed to sign on anyone under the age of 13, but many Facebook users are in the 13 to 17 age range and need to be duly protected in survey recruitment.

A. It is necessary to consider how much information is presented on a map that could potentially reveal the identity and Personally Identifying Information (PII) of a survey participant, including if it would be possible to determine the housing unit in question.  Convey to the IRB the geographic detail in the presented information and how that relates to risk e.g., “we present thematic maps at the Census tract level, which are coarse enough in our case to carry no risk of disclosure by themselves.”

A. For many health studies, in addition to collecting survey data the researcher may want to collect some biological specimens from the respondents, such as urine, blood, buccal cells, or hair. While these biospecimen provide a valuable source of information when studying health conditions, they also present many issues of concern to the study participants. Unless the biospecimen are absolutely required from every respondent, it is good practice to have the specimen collection require its own opt-in on the consent form, by either having the respondent check a box or sign a separate consent statement on the form. This way, respondents who want to participate without contributing a biological specimen can do so, with a sense of assurance that their specimens will not be required.

Consent forms need to also address the additional concerns that participants have about contributing a biological specimen, including:

• Why the specimen is needed
• What specific tests will be done on the specimen
• Who will be collecting the specimen – what their training or qualifications are
• Where the specimen collection will take place
• What precautions will be taken to ensure the collection will be safe and pain free
• What risks are involved with the specimen collection
• If anyone will be looking at the respondent’s DNA or conducting any genetic tests on the specimen
• If the sample will be stored after it is tested for this study
  • If stored, how long it will be maintained
  • If stored, whether it will be identifiable
  • If stored, who can use the specimen in the future and for what purposes
• If not stored, when and how the specimen will be disposed
• Whether respondents can later change their mind about storing the specimen

A. Yes. The mobile nature of cell phone technology allows for a respondent to be engaged in numerous activities and to be physically present in various locations that would not normally be expected with other modes of administration (e.g., fixed landline or paper questionnaire). In particular, the operation of a motor vehicle or any type of potentially harmful machinery by a respondent during a research interview presents a potential hazard to the respondent and to anyone else in the general vicinity of the respondent (e.g., fellow passengers in the car). However, even if someone is merely walking about while speaking on their cell phone, this could increase their chances for physical harm occurring. Any researcher who conducts a survey that reaches people on a cell phone should take appropriate measures to help protect the safety of the respondent and whoever else may be nearby. Merely asking respondents whether they are operating a motor vehicle is insufficient because the potential risks from distraction are not limited to driving. Questions about specific activities also suggest inappropriately that the researcher is in the best position to make judgments about the respondent’s safety. It is suggested that researchers leave the responsibility for determining safety to the respondents themselves and encourage respondents to consider their own safety by asking about it directly (e.g., ―Are you in a place where you can safely talk on the phone and answer my questions?). If respondents indicate that they cannot safely talk, contact should be quickly ended, and interviewers should not extend the contact at that time by attempting to schedule an appointment for a callback.

The fact that cell phone survey respondents are often reached outside their homes also raises privacy concerns. Whenever it is appropriate and based on the nature of the topics being surveyed, researchers should design their cell phone questionnaires so that answers to sensitive questions may be provided in a nondisclosive categorical format (e.g., answering with a “A, B, C” or “1, 2, 3”) rather than voicing more disclosive responses. It is recommended that checks on safety and privacy be made independently and at different stages of the interview. For example, a question about safety could appear immediately after a brief introduction, and/or midway through the questionnaire. Questions about privacy could follow a description of the survey, which would permit respondents to make informed decisions about the risks of disclosure. For additional information regarding legal and ethical issues surrounding cell phone surveys, the 2010 AAPOR Cell Phone Task Force Report is recommended.

A. One might think that exempt status would give the investigator complete freedom over the conduct of the research, but the IRB retains an interest in the exempt study and at least some authority over its conduct.  At present, there seems to be considerable local variation in the amount of control exercised by the IRB over an exempt study and, conversely, the amount of flexibility that is afforded to the investigator.  At many institutions, exempt studies are not subject to annual re-review but may be exempted for several years if the protocol does not change.  Of course, if any unanticipated adverse events occur during the course of an exempt study, the IRB must be promptly notified.

Of particular importance for survey researchers is the ability to modify a protocol, including changes to the questionnaire or interview script, survey invitations and reminder notices.  The quality of surveys is clearly improved when investigators can make small changes—without undue delay—during the process of questionnaire expert review, survey pretesting or production.  Practice currently varies substantially across institutions as to whether such changes require advance written IRB approval (as would likely be the case for an approved, non-exempt study), or whether some changes can be made in exempt studies without advance written approval.  At institutions where advance approval is required, the process for approval of such modifications is generally an expedited process.  Where changes are allowed without advance approval, the IRB may require that notice be given after the change (for example, by submitting the final version of the questionnaire for the IRB’s records on the project).  The scope of allowable changes for an exempt study also varies across institutions.

When it comes to flexibility in modifying protocols for survey research studies, informal and unwritten understandings seem to be the norm, especially for investigators with broad experience in conducting exempt studies and good records of cooperation and compliance.  Inquire locally to learn the approach being used at your institution with respect to minor modifications of questionnaires, survey invitations and reminders in exempt and non-exempt studies.

A. Yes. Interviewers are required to have HSP training. In essence, anyone who has contact with human subjects during the course of a research project is considered “key personnel” for the purpose of this rule. While all key personnel must be trained, the NIH does not endorse any specific educational programs. Institutions have the freedom to determine what programs are appropriate for fulfilling the education requirement.

Several options are available, including developing your own in-house training and testing program. Others include, but are not limited to:

• Require staff to read the textbook: Protecting Study Volunteers In Research: A Manual for Investigative Sites (3rd ed.), Dunn, C.M., & Chadwick, G.L. (2004), Boston: CenterWatch, Inc.
• Require staff to complete the Collaborative Institutional Training Initiative’s (CITI) Social and Behavioral Research training module. This can be tailored to your institution’s needs.  Indeed several institutions require only a short version of the CITI Social and Behavioral Research training which includes only a few of the most relevant modules for interviewers. These often include: History & Ethical Principles, The Regulations and the Social/Behavioral Sciences, Assessing Risks, Informed Consent, and Privacy and Confidentiality.
• Require staff to complete NIH’s free tutorial - Protecting Human Research Participants (http://phrp.nihtraining.com/users/login.php).

Q. Is it OK to pay respondents for their participation?

A. The regulations do not directly address payment of subjects. Whether or not individuals are paid for participating in research can depend on a number of factors, including availability of funds and the extent of effort on the part of study subjects. When subjects are reimbursed for direct expenses incurred due to research participation (e.g., parking and transportation), there is no ethical debate. However, IRBs will pay particular attention to incentive payments (e.g., payments for participation) to determine whether they could have an undue coercive effect on a prospective subject's ability to make an informed, voluntary choice about taking part in research. This is especially important when participation may include more than minimal risk or low income subjects are involved.

If compensation or the use of incentives is to be part of your study, it is important to include specific information in the IRB application and to provide detailed information about payment (including terms) in the informed consent information.

A.  Payments and compensation for research participants are viewed by most institutions as subject to Internal Revenue tax laws (the guidance about research participants was clarified by the IRS in 2008). Hence, most institutions now have policies or guidelines that apply to the use of payments for research participants. Some institutions have a ceiling on the amount an individual may earn in any one study or during a given length of time (e.g., per year, per semester).  Some have maximums for any given study (some as low as $25) that trigger a requirement to obtain the participant’s Social Security Number (SSN) and contact information and possibly a signed IRS W-9 form.  Current tax laws require that institutions issue a 1099-misc form to each person who is paid $600 or more in a given year. Although few research participants would reach this level of payment for any given year, many institutions issue guidelines about maximum payments to assure that such payments can be tracked by the institution. These requirements are often at odds with the protection of participant identity and minimizing risk of breach of confidentiality.  Because the public has been appropriately educated not to disclose their SSN except to select financial or government officials, the requirement that participants in the research supply the researcher with this information can represent a significant obstacle to participation and may increase the risk of a breach of confidentiality. Researchers should, therefore, structure their use of incentives so as to avoid making such requests of prospective respondents.

To satisfy internal audit requirements, most institutions require careful record-keeping for handling incentive payments.  Whether utilizing gift cards, checks, cash or non-cash gifts, a process should be developed for reconciling the amount of incentive payments provided with the number of participants receiving such payments. That is, the investigator should be able to produce a record indicating the participant names (or ID numbers) and the amounts they received – or the gift card code assigned to them.  Accounting for all cash or gift cards in undeliverable mail packets would also be needed.

Additionally, using incentives can involve handling large amounts of cash or large numbers of gift cards (e.g., enclosing a two-dollar bill in each of 1,000 mailing pieces will require handling of $2,000). It is important to confirm that all institutional policies for secure handling of cash or gift cards are being followed. Key concerns are likely to be: having a safe or other secure location for storage of cash or gift cards, need for security personnel when receiving or transporting cash or gift cards, and security of questionnaire packets (in mail-back modes) that include cash or gift cards.

It is important to note that participants who “win” prizes from sweepstakes or drawings used as an incentive are also subject to these tax laws. Hence, a participant who receives a tablet or other electronic device may exceed the minimum payment amount for research participants and be subject to the reporting requirements for the institution.

Finally, some institutions also categorize any student research participation incentives as part of the total amount of money awarded in any financial aid package. Therefore, incentive payments may impact the amount of tuition or other offsets awarded to the students who are paid to participate in a research study. This may serve as a negative unintended consequence of using financial incentives for some student populations.