566. Exempt Review and Approval

Updated February 26, 2024

All human research in which University or affiliate faculty or staff are engaged must be approved or acknowledged by the University Research Integrity or IRB. The University allows certain categories of research to be exempted from Department of Health and Human Services (DHHS) requirements for IRB review and approval (i.e., the Common Rule).

Research activities in which the only involvement of human participants is in one of the DHHS categories exempted at 45 CFR 46.104 or that meet the criteria for Exempt Review under the University’s IRB-Flexibility policy may be submitted for Exempt Review. (For information about the conditions for Exempt Review under DHHS or Flex-Exempt categories, in accordance with the IRB policy regarding review types. Information about FDA exemptions is provided elsewhere.)

The University grants exclusive authority to Research Integrity for review and approval of exempt research. This authority allows qualified Research Integrity staff and IRB members to review applications for exempt research.

Requirements for Exempt Review

In no case will a research project be reviewed by an individual with a real or perceived conflict of interest relevant to that project.

The University’s Research Integrity office requires exempt research to be consistent with the ethical principles described in the Belmont Report (in accordance with the IRB policy for a summary of the Report) as exemplified by the following:

• Risk to participants is no greater than minimal.
• Participant selection is equitable.
• Recruitment and consent procedures are designed to be free from coercion and undue influence.
• For research involving interaction with participants, participants are told the activity involves research and that participation is voluntary, are provided with a description of the research procedures, and are given the researcher’s name and contact information.
• The research is designed to minimize harms to participants and maximize research benefits.
• Individual privacy is protected.
• Provisions are adequate to maintain the confidentiality of the data. There are adequate provisions to maintain the privacy interests of participants

Reviewers also assess for compliance with applicable federal, state, and local laws (including HIPAA, FERPA, and PPRA as described below), and state-mandated requirements for reporting abuse and communicable diseases.

Reviewers use the Exempt Review Worksheet to assess projects submitted for Exempt Review.

Reviewers are IRB Members. The person deciding should be familiar with laws, regulations, codes, and guidance governing the research, organizational policies, and the nature of the research to make sound judgments. An exemption determination may not be made solely by the researcher, or someone with a conflict of interest in the research.

Reviewers may seek clarification from the investigator or request additional information, changes, or researcher forms before making an exempt determination. Reviewers will apply the DHHS/FDA regulations regarding exempt categories and/or University’s Flexibility Policy to determine exempt status. The assigned reviewer completes the review in IRBNet by making a Recommendation, adding the review worksheet and notes (if any), and marking the review complete. Research Integrity will communicate the exempt review results to the Principal Investigator (PI) and research team members promptly, within two to ten business days of receiving a complete submission.

Exempt Review Results

Exempt reviews result in one of five outcomes:

1. Project does not constitute human subject research.
2. Project meets requirements for exempt determination.
3. Information is needed before exempt determination may be granted.
4. Project requires Expedited Review.
5. Project requires Full Committee Review.

Exempt determinations are for the life of the project. Exempt research is not required to undergo renewal.

Documentation of Exempt Review and Approval

For projects that meet the requirements for exempt determination, the reviewer will complete the project in IRBNet by:

• Selecting Exempt Review for Review Type
• Selecting Exempt for Project Status
• Selecting Exempt for Action
• Noting the date, the exempt determination was finalized as the Effective Date
• Leaving the Expiration Date field blank
• Ensuring Minimal Risk is selected for Project Risk Level
• Noting the applicable exempt category (i.e., one of six DHHS categories, or Flex-Exempt) as a Project Note.

Notifications of Exempt Research Determinations

Research Integrity staff will generate and publish an exempt determination letter in IRB. The PI and contact person (if applicable) will be notified that the letter is available for review. Exempt notification letters specify the exempt category.

For projects that do not meet the requirements for exempt determination, Research Integrity staff will notify the investigators either the project was acknowledged and may proceed as “not human subjects research” or the project requires Expedited or Full Committee Review.

Information about exempt determinations is available to IRB members and institutional authorities upon request.

Limited Institutional Review Board Review

Limited IRB review requires that certain exempt research be reviewed by an IRB chair or IRB member designee for privacy and confidentiality under requirements in 45 CFR §46.111(a)(7) or §46.111(a)(8). IRB members conducting limited IRB review may not disapprove research.

The regulations at §46.111(a)(7) state, “When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data,” and §46.111(a)(8) states “… (iii) If there is a change made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. “The purpose of limited IRB review is to ensure privacy/confidentiality protections are in place with exempt research that involves the collection or use of sensitive, identifiable data (exemptions 2, 3 and 8) and, for exemption 7, that “broad consent” was obtained and (if appropriate) documented according to an approved protocol. This process is only applicable to certain new provisions in the exempt categories 2, 3, 7, and 8.

The Exempt application must contain sufficient information to determine whether the proposed research fulfills the relevant criteria for approval required under limited IRB view. Documentation should provide adequate protections for privacy interests of participants and the confidentiality of identifiable data. Continuing review is not required for studies that qualify for a limited review. IRB retains the authority to suspend or terminate approval of research approved with a limited review.

Informed Consent Considerations for Review of Exempt Research

If the researcher will be interacting with participants, there is an agreement to participate that discloses adequate information for participants to make a voluntary decision regarding whether to participate in the research. This may include:

• Statement or explanation that the activity involves research.
• Description of the procedures.
• Statement of risks and benefits.
• Statement that participation is voluntary.
• Statement that there are adequate provisions to maintain the privacy interests of participants.
• Name and contact information of the researcher.

Situations for Reviewer Discretion to Request Additional Researcher Forms

For exempt research involving children or that will take place outside of the US, the designated reviewer may require the PI to submit the Population: Children or Research: International researcher forms, respectively.

Is Online Research Eligible for Exempt Review?

Research Integrity will assess minimal risk online research on a case-by-case basis to determine the appropriate level of review, either Exempt or Expedited Review.

• With adequate protections for ensuring individual privacy and data confidentiality, online research may be exempt under DHHS category 2 or 3.

Is Research Involving Audio or Video Recordings, or Photography Eligible for Exempt Review?

Research Integrity will assess minimal risk research involving audio or video recordings, or photographs on a case-by-case basis to determine the appropriate level of review, either Exempt or Expedited Review.

• With adequate protections for ensuring individual privacy and data confidentiality, research involving recordings or photography may be exempt under DHHS category 2 or 3.

How Do HIPAA, FERPA or PPRA Regulations Apply to Exempt Research?

• Exempt research involving medical records must comply with HIPAA requirements.
• Exempt research involving educational records must comply with FERPA requirements.
• If minimal risk, non-federally funded research involving surveys or interviews with children meets the criteria for exempt review, the research must comply with PPRA requirements.

NOTE: Researchers are advised to contact Research Integrity before submitting an exempt application for research involving children.

Notifying Research Integrity of Closure of an Exempt Research Project

Investigators may notify Research Integrity of a closed exempt project by submitting a closure request via IRBNet.

Research Integrity Closure of Exempt Research Projects

Exempt studies do not have a set expiration date. However, Research Integrity will conduct an annual campaign of verifying the active status of research projects determined to be exempt more than 12 months prior to the campaign. Research Integrity will contact Principal Investigators to ask if their protocol is still active. Protocols will be closed if 1) the PI confirms the protocol can be closed; or 2) Research Integrity receives no response from the PI after two attempts; or 3) Research Integrity determines that the PI is no longer eligible to serve in that capacity (e.g., as a result of having left the institution or retired).