“Not Human Subjects Research” Submission and the IRB: Step-by-Step Instructions

January 2024 Issue

Author(s):

• Matt Ogrodnik, MS, CIP
  Director, Office of Human Research Affairs

PRINT

• Introduction
• Decision Algorithm for Submitting to the IRB
• Step-by-Step Instructions for Submitting NHSR or Non-Engagement Projects to the IRB
• When in Doubt…

Introduction

Any project that meets the definition of research with human subjects and/or that is subject to FDA regulations must be submitted to the IRB for approval or for an exemption determination prior to conducting any research activities.  Projects that do not meet the definition of human subjects research, known as “Not Human Subjects Research” (NHSR) or “Non-Engagement in Human Subjects Research” (Non-Engagement), generally do not need to be submitted to the IRB.

However, this article describes exceptions where projects that qualify as NHSR do need to be submitted to the IRB for a formal review and determination*. These situations generally involve use of publicly-available information; or, for circumstances under which submission to the IRB is required solely to meet HIPAA requirements (please consult this link for a more complete discussion of HIPAA). 

This article also provides step-by-step instructions for completing your NHSR or Non-Engagement submission to the IRB. If you are confident that your project does not involve human subjects, and you would like to get started on your IRB submission, please feel free to navigate to this section in the article.

*Note:  This section of the article focuses on determining whether your project qualifies as “NHSR” or whether it involves human subjects research; and is an update to a Feature Article written by Fanny Ennever, PhD, entitled: “Which Projects Must be Submitted to the IRB - Sept 2020”).

For more information on determining whether your research activities involve engagement or non-engagement in human subjects research, please review the slides or video from the December 2022 CRRO Seminar entitled: “Engagement or Non-Engagement? That is the IRB Oversight Question.” The step-by-step IRB application submission instructions near the end of the article apply to both NHSR and non-engagement submissions, as both use the same INSPIR application form.

Decision Algorithm for Submitting to the IRB

1.  Is the project “research” (as defined by the Common Rule)?

RESEARCH means a systematic investigation (including research development, testing, and evaluation) designed to develop or contribute to generalizable knowledge.
Examples of projects that do not constitute research are case series involving three or fewer patients and quality improvement projects.

⇒  If the project does not meet the definition of research, no IRB submission is required (although investigators may submit to request a determination letter from the IRB that the project is not research).

⇒  If the project does meet the definition of research, continue to question 2.  

2.  Does the research involve “human subjects” (as defined by the Common Rule)?

HUMAN SUBJECT is defined as a living individual:

(i) About whom a researcher obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or

(ii) About whom a researcher obtains, uses, studies, analyzes, or generates identifiable private information about the individual or identifiable biospecimens; or

Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).

Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information).

⇒  If the research does meet the definition of involving human subjects, then IRB submission is required (using the review path appropriate to the research: ceded, exempt, chart review, or non-exempt).

⇒  If the research does not meet this definition, continue to question 3.

3.  Does the research use “Health Information” (as defined by HIPAA)?

HEALTH INFORMATION is information that relates to the individual’s past, present, or future physical or mental health or condition; the provision of health care to the individual; or the past, present, or future payment for the provision of health care to the individual. The health information that is potentially protected by HIPAA (if it is individually identifiable, see below) is health information that is held or transmitted by a HIPAA-covered entity. Note: BMC is a HIPAA-covered entity, but only certain designated components of Boston University are covered by HIPAA (see BU’s HIPAA covered components).

In this algorithm for submitting to the IRB, this question would only need to be asked if the research uses information that is not identifiable under the Common Rule. However, HIPAA has a broader definition:

Individually identifiable health information means that the information identifies the individual or there is a reasonable basis to believe it can be used to identify the individual. Health information can be de-identified if all of the following identifiers are removed (of the individual or of relatives, employers, or household members of the individual):

1. Names
2. Geographic subdivisions smaller than a state, except the initial three digits of the ZIP code are not an identifier if encompassing more than 20,000 people
3. All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date (and ages over 89 unless aggregated into a single category of age 90 or older)
4.      Telephone numbers
5.      Fax numbers
6.      Email addresses
7.      Social security numbers
8.      Medical record numbers
9.      Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers, including license plate numbers
13. Device identifiers and serial numbers
14. Web Universal Resource Locators (URLs)
15. Internet Protocol (IP) addresses
16. Biometric identifiers, including finger and voice prints
17. Full-face photographs and any comparable images
18. Any other unique identifying number, characteristic, or code, including any code that includes or is derived from any of the identifiers on this list.

A study could, therefore, involve health information that is “individually identifiable” (under HIPAA) but not “readily ascertainable” (under the Common Rule). For example, if the data identified people only by their record numbers assigned in a clinical trial (and the researchers had no access to the corresponding names), then this would generally not be considered identifiable under the Common Rule, but would be considered identifiable under HIPAA category 18 above.

⇒  If the research does use health information from a covered entity, then IRB submission is required (using the Not Human Subjects Research review path if the identities are not “readily ascertainable”). The IRB will determine whether this study requires an authorization, a designation as involving a Limited Data Set, or a waiver of authorization.

⇒  If the research does not use health information from a covered entity, continue to question 4.

4.  Does the research use publicly-available information?

PUBLICLY-AVAILABLE INFORMATION means information that is readily accessible to everyone and does NOT meet the definition of private information:

Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).

Examples of such research include observation of public behavior and analysis of public social media postings.

Because of ever-evolving accessibility provisions and privacy expectations, the BMC and BU Medical Campus Human Research Protection Program made the decision to require the review of projects using publicly-available information by someone other than the investigator. The IRB’s review, with potential assistance from the relevant communications department and/or department chair or section chief, will assess whether the information being used qualifies as publicly available and whether any additional safeguards are needed.

⇒  If the research involves the use of publicly-available information, then IRB submission is required (using the Not Human Subjects Research review path if the only project activities are analysis of publicly-available information).

Step-by-Step Instructions for Submitting NHSR or Non-Engagement Projects to the IRB

In order to submit these types of projects to the IRB in our electronic IRB system INSPIR II, please follow these steps:

PRE-STEP: If you do not yet have an INSPIR II account, please follow the instructions in this link to gain access to the system: How to get access to INSPIR II

STEP ONE: Create a new study in INSPIR.

STEP TWO: Complete Sections 1-3, which are the same for *all* studies created in INSPIR (Section 1: Study Title; Section 2: Department(s); Section 3: Internal (BMC/BUMC) Study Personnel).

Please note that for this type of NHSR or non-engagement submission, you only need to list the Principal Investigator (PI) (and Supervising PI, if the PI is a student, resident, or fellow) and Department Chair/Section Chief in Section 3. This is because only study staff who are involved in human subjects research need to be included here. The IRB uses this section to check required training, which does not apply to NHSR/non-engagement as these types of research do not require human subjects training. By the nature of this type of submission, no study staff are involved in human subjects activities.

STEP THREE: In Review Path Section 4.1, check off:

“This project meets the definition of Not Human Subject Research (NHSR). Examples are non-research Quality Improvement/Quality Assurance projects; studies that involve obtaining anonymous data/tissues or coded data; or BMC/BU Medical Campus is not 'engaged' in human subjects research.”

INSPIR II uses a “smart” application system, whereby the system only generates sections and questions that apply to the type of study being submitted. Choosing this Review Path will generate the correct version of the application.

Please then check NO to Sections 4.2, 4.3, and 4.4, as none of these apply.

STEP FOUR: Section 5.1 is the NHSR/Non-Engagement Pathway. It is based on the

Decision Algorithm described earlier in this article and helps determine whether a project truly qualifies as NHSR/Non-Engagement. The answers to the following questions depend on the specifics of your study:

1. Answer “Yes” to indicate that this project qualifies as research.

Answering “No” means that no research is involved (for example, the project is a case series involving three or fewer patients or a quality improvement project). That answer may be correct for those types of projects (which use this same Review Path in 4.1), but those are not the focus of this article.

2. Answer “No” to indicate that no intervention or interaction with living individuals is involved.

If your answer to this question is “Yes”, then this means your study is human subjects research, and you need to go back and change the Review Path accordingly in Section 4.1.

3. Answer “No” if the research only involves using data and/or specimens from deceased individuals (all subjects must be deceased for this to be correct), or, answer “No” if the data used is not about humans at all.

If you answer “No”, the pathway will end here; and you should move to STEP FIVE.

Answer “Yes” if the data are about living individuals (even if the data you will use are completely anonymous!)

4. Answer “Yes” if all information used in this study is publicly-available. Please re-review Number 4 in the Decision Algorithm section above if you have questions about whether the information is publicly-available.

Answer “No” if any information used in the research is not publicly available.

5. Answer “No” to indicate that no one on the BMC/BUMC research team will be able to identify the subjects whose data and/or biospecimens are being used.

If your answer to this question is “Yes”, then this means your study is human subjects research, and you need to go back and change the Review Path accordingly in Section 4.1.

6. Answer “No” if no one anywhere can identify the subjects whose data and/or biospecimens are being used. “No” is only correct if the data/biospecimen stewards who are releasing the information do not have a master code or any other way to link the information to the identities of the subjects.

If you answer “No”, the pathway will end here; and you should move to STEP FIVE.
Answer “Yes” if someone somewhere can link the subjects’ identities to the data and/or biospecimens.

7. Answer “Yes” to confirm that the holder of identifiable information (for example, the data/biospecimen stewards who have access to a master code) will never disclose the identifiable information/master code to the BMC/BMC research team.

If your answer to this question is “No”, then this means your study is human subjects research; and you need to go back and change the Review Path accordingly in Section 4.1.

STEP FIVE: Answer Section 5.2 to indicate whether your project is single-site (BMC/BUMC-only); or, whether the BMC/BUMC research activities are part of a larger study that is also occurring at other sites. Usually the latter means that the correct determination is “BMC/BUMC is not engaged in human subjects research”, but the IRB will make the NHSR vs. “non-engaged” determination.

STEP SIX: Answer Section 5.3 by providing a description of the research activities occurring at BMC/BUMC. It is very important to detail the source of the data/biospecimens and the types of variables that you will receive. Please ensure you follow the listed instructions.

STEP SEVEN: Answer “Yes” or “No” to Section 5.4 depending on whether the Boston HealthNet Community Health Centers (CHCs) are involved in this research in any way.

STEP EIGHT: Attach any relevant documentation in Section 5.5; for example, a Data Dictionary from a releasing database, or documentation regarding the non-identifiability of the data/biospecimens.

STEP NINE: Complete Funding Source Section 6.1 by checking off all types of funding sources that apply.

If you check off any option other than “Student/Resident/Fellow Research with no External Funding” Funding Details, then Section 6.3 will generate. Please add a separate entry for each funding source.

STEP TEN: Answer “Yes” in Study Type Section 6.2 if the overall study meets the definition of a clinical trial. If the answer is “Yes”, then please ensure that the answer in Section 5.2 (in STEP FIVE) indicates that this is a multi-site study.

STEP ELEVEN: Complete Grants Office Section 6.4 by indicating which grants office is handling your award. If there is no grant or other type of agreement associated with this project, then just leave this section blank.

STEP TWELVE: Answer “Yes” if the research does use health information from a covered entity. Please re-review Number 3 in the Decision Algorithm section above if you have questions about whether you are using health information protected by HIPAA.

For example, if the PI is part of the covered entity (for example, a BMC investigator per the Home Institution database), and the dataset includes dates beyond year, zip codes, or specific ages > 18, then you must check “Yes”.

Answer “No” if no health information from a covered entity is used; for example, if the dataset does not include *any* of the 18 HIPAA identifiers.

If you answer “Yes”, then the rest of the section will generate. Please carefully answer each question by following the provided instructions. Here are some helpful hints:

Section 7.2: Only answer “Yes” if the data being obtained are only used for recruitment purposes. This will only be correct for multi-site research in which BMC/BUMC is not engaged.

Section 7.5: You may attach a document (for example, a spreadsheet or Data Dictionary) that includes all variables to be used, in lieu of listing them in the textbox.

Section 7.7:  Answer “Yes” if *any* of the 18 HIPAA identifiers listed in Number 3 in the Decision Algorithm section are included in the dataset or attached to the biospecimens.

This is an important section, so please always reach out to the IRB at medirb@bu.edu if you have any questions when filling this out.

STEP THIRTEEN: If there are any other applicable documents that have not yet been attached, then attach them here in Section 8.1.

STEP FOURTEEN: Your study application is now complete. The next step is to navigate to the Additional Special Routing section of the Initial Review Submission Form.

First, complete and attach the Reduction of Explicit and Implicit Bias in Research Form.

Next, answer each Special Routing question. If you have any questions about the process for each, please re-read the May 2023 Feature Article entitled: What’s so Special about Special Routing? - May 2023.

STEP FIFTEEN: Once you have answered each question in the Initial Review Submission form, navigate to the top right corner and click “Save Form”. This will bring you to a page entitled: Form has been Completed!

If you are now ready for the PI to sign-off, then click the “Notify PI to Signoff” button. Or, you may go back to change your responses. The Initial Review Submission form page will now also have a “Notify PI to Signoff” button.

When you “Notify PI to Signoff”, ensure that the PI and Department Chair/Section Chief name are correct, and save the routing list to send it to them.

STEP SIXTEEN: You have reached the last step! You now just need to sign off on the study as PI (or, if you are not the PI,  you should next provide these instructions to the PI). Please follow the instructions here: How to sign off on protocol as PI

When in Doubt…

Investigators should contact the IRB at medirb@bu.edu if they are unsure about whether their project conforms to any of the definitions in this article (research, quality improvement, intervention or interaction, covered entity, health information, identifiable, etc.).  It's always better to err on the side of caution whenever there's a chance that submission is required.

Once you are certain that your project does qualify as NHSR or Non-Engagement, then please follow the step-by-step instructions above to ensure an efficient submission and a successful IRB review process.