Topics arranged alphabetically from A-Z related to human subjects research with respect to UNL Institutional Review Board (IRB) review, approval, and other activities overseen by the UNL Human Research Protection Program (HRPP) are described below. Each topic below is linked to its page location. Topics may also include links to corresponding policies, guidance and/or templates. If you are unable to find an answer to your question below, please contact the IRB at irb@unl.edu or 402-472-6965, or through your IRB Coordinator.
NuRamp Guidance Document
Questions about the New Project Form for Primary Data Collection? Please review our guidance document, which includes each question of the New Project Form and provides a brief commentary to explain what types of information should be included in the response.
List of Topics
118 Determination (Non-definitive Plans for Human Subjects)
Best Practices for Classroom & Clinical Practica Not Requiring IRB Approval
Blood Collection and Research Personnel Requirements
Certificates of Confidentiality
Child Abuse Reporting Requirements & Human Subjects Research in Nebraska
Clinical Trials Registration, Consent Form Posting & Data Sharing
Compensation/Incentives and Accounting Guidance
Data Identifiability – Definitions
European Union General Data Protection Regulation (EU GDPR)
Exempt Research Guidance and Templates
External Organization IRB Review Request Fee Schedule
Family Educational Rights and Privacy Act (FERPA): Use of FERPA-regulated Data for Research Purposes
Genetic Information Nondiscrimination Act (GINA)
Health Insurance Portability and Accountability Act (HIPAA) and UNL Human Subjects Research
Informed Consent Process Best Practices
Lincoln Public Schools (LPS) Approval Processes
National Institutes of Health (NIH) Proposal Requirements – Human Subjects
Program Evaluation vs. Evaluation as Research
Research Records Best Practices
Re-Consenting/Re-Assenting Participants
Secondary Information and Biospecimens: Use in Research and IRB Applicability
Single Institutional Review Board (sIRB)
Students as Research Participants in the Classroom Environment
Terms and Conditions (Outside Entities)
118 Determination (Non-definitive Plans for Human Subjects)
A “118 Determination” refers to a determination by the IRB for applications or proposals lacking definite plans for involvement of human subjects per the regulatory criteria at 45 CFR 46.118. Specifically, a 118 Determination is made when certain types of applications for grants, cooperative agreements, or contracts are submitted to Federal departments or agencies with the knowledge that subjects may be involved within the period of support, but definite plans would not normally be set forth in the application or proposal.
Other Related Term(s):
- Grant Congruency Review
- When a funding source is identified on an IRB project form (regardless of whether or not the funding source is Federal), UNL HRPP staff will complete a grant congruency review to ensure the proposal/grant/statement of work or other related document matches or is closely related that of the proposed IRB protocol.
Key Information:
- When the UNL IRB is contacted by a PI or UNL Sponsored Programs regarding a project, the HRPP staff will conduct a grant review to determine whether or not definitive plans are set forth in the proposal for human subjects research involvement.
- If no definitive human subjects research plans are detailed, a 118 Determination is issued in writing by the IRB/HRPP staff.
(NO human subjects work can be conducted, including recruitment, until full IRB approval has been obtained.)
- At least one year or sooner as specified by the IRB Coordinator, from the date of the 118 Determination, the PI is required to either:
- Verify that the project continues to lack immediate plans for the involvement of human subjects, their data, or their specimens; or
- Provide documentation to the applicable funding source to demonstrate that IRB approval has been obtained.
- If it is found that definitive plans do exist in the proposal, HRPP staff, in consultation with the PI, will move forward with the typical process of IRB approval.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
UNL Guidance for UNL HRPP staff grant congruency review:
- Standard Operating Procedure, IRB Protocol Grant Congruency Reviews & Certification
Authorization Agreement
For information about Authorization Agreements, also known as a Reliance Agreement, please visit our Single IRB (sIRB) | Reliance Agreement webpage.
Best Practices for Classroom & Clinical Practica Not Requiring IRB Approval
All activities meeting the federal definitions of human subjects research carried out at the University of Nebraska-Lincoln or under its auspices must be reviewed and approved by the IRB prior to the start of research. In some cases, students conduct projects as a course assignment or for educational purposes under which IRB approval may not be required. This guidance is intended to provide information on best practices that students and instructors should follow when IRB approval is not required, yet interaction with participants will occur.
- Best Practices for Classroom & Clinical Practica Not Requiring IRB Approval (PDF of full guidance)
- UNL Student Class Project Information Sheet Template
Biospecimen/Data Repositories
Biospecimen and data repositories can take on different forms and serve different purposes depending on how they are created or the parameters surrounding their use. For example, some biorepositories serve as a central storage and distribution point for biospecimens collected from multiple studies for future research use. Other biorepositories originate from a single research protocol designed solely for the purpose of future use. Further, some data repositories are also standalone sources for a single site or protocol while other examples include data repositories that are also linked to biorepositories.
Biospecimen and data repositories must be approved via a new project form submitted to the IRB and the protocol must provide enough information to allow the IRB to satisfy human subjects regulatory requirements at 45 CFR 46. The following guidance is intended to provide best practices for planning and receiving IRB approval for a biospecimen or data repository.
Other Related Term(s):
- Bio or Data Banking
- A bio or databank is a type of repository that stores biological or data samples for use in research. Samples in biobanks and the data derived from those samples can often be used by multiple researchers for cross purpose research.
Key Information:
The amount of information and level of detail required to be included in a bio or data repository protocol will vary depending on the specific repository and its planned use. The following are details to include or consider when beginning the development of the repository and ultimately submitting the IRB protocol for approval. This list is not necessarily an exhaustive list but will provide an overview of the amount and types of information the New Project Form will request.
You will find that most of the information will be requested throughout the New Project Form:
- Overall goals and purpose of the repository.
- Location of the repository.
- An explanation of what types of research will be conducted using the repository. This information should be specific, unless the types of future research is not clearly defined at the time of the repository’s creation. In which case, a broad description should be used.
- Size of the repository (how many specimens/data points).
- Identifiability of the persons from whom the biospecimens or data were collected.
- How the biospecimens or data will be collected, stored, and maintained.
- A description of the collection procedures for the repository. In other words, will the repository store prospective (newly collected or collected in the future) or retrospective (previously collected) biospecimens or data. It should describe how the participants will be recruited and selected if prospective or how the biospecimens/data will be identified and selected for inclusion if retrospective.
- If the collection is prospective, the protocol should include details regarding the method used to recruit participants, including how and where the consent process will be completed.
- If the collection is retrospective, the protocol should include how and where the biospecimens or data were obtained and if there was informed consent or a waiver of informed consent.
- A description of whether or not the repository will include biospecimens or data from unique populations that could include rare diseases, specific ethnic, racial, or social groups, populations that may have unique views about biospecimens (e.g. certain Native American groups), or particular geographic regions.
- A description of exactly what types of biospecimens or data that will be collected (e.g. information on drug use, past criminal activity, blood, DNA, urine, or tissue/biopsies). It should also explain if biospecimens are collected during the course of routine medical care and that the medical care will not be compromised as a result of the biorepository or biospecimen use/distribution.
- A description of how any data or data repository specific information will or will not be linked to a biorepository or vice versa.
- The biorepository department’s requirements, if any, regarding if individual research results may or may not be returned to participants. For example, if an incidental finding was discovered or could include clinically significant information. *NOTE: Individual research results are not normally returned to participants unless directly related to their medical care, they have been clinically validated, or run in a laboratory that is certified under CLIA/CAP requirements.
- The biorepository department’s requirements, if any, regarding returning aggregate, generalized research findings to participants and how this will be accomplished. *NOTE: There are established guidelines for the depositing of clinical trial data on ClinicalTrials.gov.
- An explanation regarding whether or not participants would be able to withdraw their biospecimens/data from the repository and if they cannot, what the reasoning is (i.e. the biospecimens or data have been de-identified, or biospecimens/data have already been distributed to other researchers).
- A description of how the biospecimens or data are linked back to the participant by way of a code, key or honest broker.
- A description of how biospecimens are labeled (e.g. ID number or barcode). Biospecimens should be labeled without direct participant identifiers whenever possible to avoid breaches of privacy and confidentiality.
- Emergency backup options if there are problems with freezers shutting down/data access/security breaches. (e.g. a lab in another building has a similar freezer with enough space to temporarily store biospecimens until another freezer can be ordered and installed).
- An explanation of who will have access to the repository. For example, will biospecimens be stored in a locked freezer or room with restricted access? Will two-factor authentication be required for accessing data?
- A statement regarding how long the biospecimens or data shall be retained (e.g. 5 years, 10 years, indefinitely).
- A description of the potential use of the biospecimens in the repository and if DNA or RNA will be tested or if permanent cell lines will be created.
- A description on whether or not the biospecimens or data will be sent to outside researchers and how that will be accomplished.
- It should be described if there will be an oversight committee approving requests for access to the repository, if the outside researcher needs IRB approval, and what types of agreements will be used (MTA’s/MOUs).
- Provide the repository’s Standard Operating Procedures (SOP) via a separate document attachment to the protocol submission in NuRamp. This document should be written in a manner that will delineate the parameters of the project and can be shared with collaborators, external access requests, specific departments, study team, etc.
- A description of how the participants’ privacy will be protected, including the following items/elements as applicable to the repository:
- Employee confidentiality agreements
- Encryption techniques
- Certificates of Confidentiality
- Honest brokers
- Agreements prohibiting re-identification by recipients
- A plan regarding release of identifiable information, if applicable, to ensure the repository access and use is used consistently with informed consent documentation and tracking
- An explanation, or plan, regarding what might happen if the repository loses funding or the steward/custodian or repository director leaves UNL
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- 2018 Policy #8.010 Banking Human Biological Material for Future Research
- 2018 Policy #8.011 Use of Human Biological Material in Research
- 2018 Policy #8.012 Participant Registries and Data Repositories
Additional Guidance and/or External Resources:
- Office of Human Research Protections (OHRP): Issues to Consider in the Use of Stored Data or Tissues.
- NIH Guidance: Private Information or Biospecimen Decision Chart
Blood Collection and Research Personnel Requirements
This guidance has been created to assist researchers in identifying the requirements for human subjects research projects involving blood collection and dealing with bloodborne pathogens.
A statute in the State of Nebraska does not exist that stipulates phlebotomists, or those responsible for blood collection, must possess a certain type of or specific certification. However, in order to protect human participants in research involving blood collection, the UNL IRB requires research personnel responsible for collecting blood to be able to provide documentation that they have appropriate experience, licensure, or certification. The type of documentation can be commensurate with the collection method and amount required in order to achieve the research goals.
The responsible personnel, collection method, and amount necessary must be detailed in the IRB application, particularly within the section of the application when it asks about appropriate experience.
The following parameters are specific to research blood collection procedures that are approvable under an expedited category. If the PI proposes different information that does not meet the below parameters, full board review is required for approval. The collection of blood samples by finger stick, heel stick, ear stick, or venipuncture are as follows:
- From healthy, non-pregnant adults who weigh at least 110 pounds. For these subjects, the amounts drawn may not exceed 550 ml in an 8 week period and collection may not occur more frequently than 2 times per week; or
- From other adults and children, considering the age, weight, and health of the subjects, the collection procedure, the amount of blood to be collected, and the frequency with which it will be collected. For these subjects, the amount drawn may not exceed the lesser of 50 ml or 3 ml/kg in an 8 week period and collection may not occur more frequently than 2 times per week.
Other Considerations:
Blood loss due to cumulative diagnostic phlebotomies can result in significant decreases in hemoglobin resulting in anemias. If the subject has a compromised health status, the PI, or the physician connected with the protocol, should review the hemoglobin levels before obtaining blood samples for research purposes. Careful attention must be made to the cardiovascular status, general activity, previous clinical blood draws, and overall status of the subject and as needed, consultation with their primary care provider. The investigator should consider the blood collection tubes used to ensure collection of the minimum volume needed. It is important to take into consideration the following issues when assessing the risk and benefits of blood draws for research purposes.
- Current health status and age of the individual
- Volume of blood to be withdrawn
- Withdraw only the minimal amount of blood needed to perform the tests and/or banking
- Obtain research blood at the same time as any clinical labs if possible
It is important to consider the total blood volume of the individual when evaluating their ability to provide blood for research purposes. A reasonable figure for calculation of total blood volume for adults is 70mL/kg of body weight and for infants 80mL/kg.
Depending on the health status of the research subject, the IRB may require the PI to justify the need for volume of blood removed in relation to the expected benefit to the subject and safeguards to protect from undue risks.
In addition, the PI should also detail within the IRB application what plan is in place if an event or emergency were to occur during the process to collect the blood sample(s). For instance, where will the collection take place and what if the participant experiences light-headedness or an episode of fainting (i.e. how will the PI contact emergency services if necessary; what will they do in the interim of help arriving; are snacks/juice available if the participant’s blood sugar is low and/or they are close to fainting?).
A clear plan must be in place and discussed with the research team and those responsible in order to ensure participants are protected appropriately (e.g. ensure another research personnel team member is readily available to assist if an emergency occurs, do not complete blood collection entirely on your own). This is also in consideration that many times participants are required to fast ahead of time in preparation for the blood collection.
The PI must be cognizant of the safeguards available in order to help ensure the protection of human subjects, however, the PI and research team must also be knowledgeable and meet bloodborne pathogen requirements. All clinical/diagnostic, research, and teaching activities involving human samples that are subject to the Bloodborne Pathogens Standard require submission of a protocol to and approval by the UNL Institutional Biosafety Committee (IBC). Please reference the below links for additional information.
Additional Guidance and/or External Resources:
- UNL IBC: Bloodborne Pathogens Exposure Control Plan
- UNL IBC: Guidance for Collection and Storage of Human Samples
- OHRP Guidance: Expedited Review Categories and Blood Collection
Certificates of Confidentiality (CoCs)
CoCs allow researchers to refuse to disclose names or other identifying characteristics of research subjects in response to legal demands. Certificates are issued by NIH and other Federal agencies to researchers to help protect the privacy of human subjects enrolled in research where an individual is identified; or for which there is at least a very small risk, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual. Persons authorized to protect the privacy of research subjects may not be compelled in any Federal, State, or local civil, criminal, administrative, legislative, or other proceedings to identify them by name or other identifying characteristic.
The NIH has updated their policy on CoCs effective October 1st, 2017. Specifically, the following has been updated:
- All research that was commenced or ongoing on or after December 13, 2016 and is within the scope of this Policy is deemed to be issued a Certificate and is therefore required to protect the privacy of individuals who are subjects of such research in accordance with subsection 301(d) of the Public Health Service Act. This Policy will be included in the NIH Grants Policy statement as a standard term and condition of award effective October 1, 2017 for new and non-competing awards. Institutions and their investigators are responsible for determining whether research they conduct is subject to this Policy and therefore issued a Certificate. Certificates issued in this manner will not be issued as a separate document.
- Previously, NIH provided these protections through the issuance of Certificates only upon receipt and approval of a specific Certificate of Confidentiality application. However, in order to comply with the requirement in subsection 301(d) of the Public Health Service Act to minimize the burden to researchers, streamline the process, and reduce the time it takes to comply with the requirements associated with applying for a Certificate, NIH will now provide Certificates automatically to any NIH-funded recipients conducting research applicable to this Policy.
Key Information:
- The National Institutes of Health issue CoCs for NIH Awardees, Other HHS Agencies (Non-NIH), Non-HHS Federal Funders, and Non-Federal Funders.
- All funded human subjects research projects do not necessarily start out by having a CoC as part of the award terms. Whether or not your project receives a CoC automatically is based on funding:
- NIH: Only those projects funded wholly or in part by the NIH, whether supported through grants, cooperative agreements, contracts, other transaction awards are automatically granted a CoC. The issuance is part of the terms of award and it is up to the institution to comply, as applicable.
- Non-NIH funded: These projects may still have access to a CoC, but these must request a CoC through a separate application process rather than having this automatically issued.
- Specifically, NIH CoCs are used for biomedical, behavioral, clinical or other types of research in which identifiable, sensitive information is collected or used that may include:
- Human subjects research as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46), including exempt and non-exempt research.
- An exception to this requirement is if the project is determined to be exempt from all or some of the requirements of 45 CFR 46 and the information obtained is recorded in such a manner that human subjects cannot be identified or the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects;
- Research involving the collection or use of biospecimens that are identifiable to an individual or for which there is at least a very small risk that some combination of the biospecimen, a request for the biospecimen, and other available data sources could be used to deduce the identity of an individual;
- Research that involves the generation of individual level, human genomic data from biospecimens, or the use of such data, regardless of whether the data is recorded in such a manner that human subjects can be identified or the identity of the human subjects can readily be ascertained as defined in the Federal Policy for the Protection of Human Subjects (45 CFR 46); or
- Any other research that involves information about an individual for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual, as defined in subsection 301(d) of the Public Health Service Act.
- Some projects may not be applicable for a Certificate of Confidentiality. Projects that are not are those that are:
- not research,
- not reviewed and approved by the IRB as required by these guidelines, or
- Certificates do not authorize researchers to refuse to disclose information about subjects if authorized DHHS personnel request such information for an audit or program evaluation. Neither can researchers refuse to disclose such information if it is required to be disclosed by the Federal Food, Drug, and Cosmetic Act.
- In the informed consent form, investigators should tell research subjects that a Certificate is in effect. Subjects should be given a fair and clear explanation of the protection that it affords, including the limitations and exceptions.
- Examples of sensitive research activities include but are not limited to the following:
- Collecting genetic information;
- Collecting information on psychological well-being of subjects;
- Collecting information on subjects’ sexual attitudes, preferences or practices;
- Collecting data on substance abuse or other illegal risk behaviors;
- Studies where subjects may be involved in litigation related to exposures under study (e.g., breast implants, environmental or occupational exposures).
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #3.011 Certificate of Confidentiality
- 2018 Policy #3.011 Certificate of Confidentiality
Guidance for UNL Projects that wish to pursue a CoC, have obtained a CoC or been issued a CoC:
- Further guidance regarding CoCs, can be found on the National Institutes of Health website at https://humansubjects.nih.gov/coc/index
- CoC Consent Form Template Language is available on the Templates Forms webpage.
Child Abuse Reporting Requirements & Human Subjects Research in Nebraska
- Nebraska University General Counsel has prepared guidance materials to describe how mandatory reporting requirements apply to the conduct of human subjects research. In short, state law requires any person who suspects that a child has been physically or sexually abused or neglected to report it promptly to the Nebraska Department of Health and Human Services.
- NE DHHS Adult & Child Abuse & Neglect Hotline: 1-800-652-1999
- UNL Police: 402-472-2222
Clinical Trials Registration, Consent Form Posting & Data Sharing
Some clinical trials involving human subjects require registration, data sharing, and/or posting of an informed consent form on a government website (https://clinicaltrials.gov or https://www.regulations.gov) due to federal requirements or journal requirements.
- ClinicalTrials.gov (CT.gov) is a web-based resource that provides patients/research participants, their family members, health care professionals, researchers, and the public with easy access to information on publicly and privately supported clinical studies on a wide range of diseases and conditions A service of the U.S. National Library of Medicine (NLM) at the National Institutes of Health (NIH), and in collaboration with the Food and Drug Administration (FDA), ClinicalTrials.gov requires registration and results reporting for Applicable Clinical Trials (ACT) and clinical trials that are required or that want to share their findings with the public.
- Regulations.gov is a multi-agency website where citizens can view and comment on federal regulations and other agency actions that affect their daily lives. More than 35 federal departments and agencies participate in Regulations.gov, which is designed to encourage public involvement and citizen input. As part of the implemented 2018 changes to the Common Rule, some research studies may be required to post an informed consent to a Federal website. If your study does not require registration on CT.gov due to, for example, NIH funding or ICMJE requirements, this website may be an option for you to meet the consent form posting requirement.
At UNL, registration, data sharing, or posting of the consent form can be completed via either of the above websites, however, these requirements are dependent on the parameters of the protocol and must have IRB approval. Please review the full guidance for this topic here: Clinical Trials Registration & Data Sharing Guidance.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #8.013: Registering Clinical Trials (Clinical Trials.gov)
- 2018 Policy #8.013: Registering Clinical Trials (Clinical Trials.gov)
Additional Guidance and/or External Resources:
Compensation/Incentives and Accounting Guidance
- Guidance for providing payment to research participants – This guidance has been developed in concert with the UNL Accounting and Bursar’s Office and the Office of Research and Innovation (ORED) to describe processes to be followed when paying research participants at varying amounts above, at, or below $100.
- For additional information about the Virtual Incentives process, please refer to ORED’s Research Participant Compensation Process.
- Research Participant Compensation Form – $100 or less
- Research Participant Compensation Form – Greater than $100
- Virtual Incentives Follow-up Compensation Email Draft
- Template informed consent documents include language related to compensation. These can be found on our Templates and Forms Page.
Cooperative Research
For more information about Cooperative Research, please visit our Single IRB (sIRB) | Reliance Agreement webpage.
Data Identifiability – Definitions
The following guidance looks at definitions related to the identifiability of data. You may see these terms often throughout our policies and in other guidance topics.
Aggregated Data | Data that has been created by combining or compiling individual-level data to identify patterns or make comparisons. |
Anonymous Data | Data that is not personally identifiable. Identifiers were never collected and cannot be retrieved by anyone including a collaborator at another institution. |
Coded Data | Data that includes identifying information (such as, but not limited to, name, initials, or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain that has been replaced with a number, letter, symbol, or combination thereof (i.e., code), and a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens. |
Confidentiality | From the IRB perspective, confidentiality is the protection of participant data from unauthorized disclosure and is determined by the agreement (e.g., consent) between investigator and participant as to how identifiable data will be stored, used, and disseminated by investigators. The IRB requires that adequate provisions are provided to protect the confidentiality of participant data, or that participants agree to the sharing of private information. |
Data at Rest | Data that is in a destination location (such as a hard drive or an archive) and is not being actively used. |
Data in Motion/Transit | Data that is being actively moved from one place to another via digital methods such as e-mail or FTP, or via physical means. |
Data in Use | Data that is being actively accessed. |
De-identified Data | Data that does not include any identifiable information. There is no way to link the data to a person through codes or deductive disclosure (e.g., through a combination of the data variables such as demographics, you cannot figure out the person’s identity), or the linking code has been destroyed. |
FERPA Identifiers | The following items are considered identifiers under the FERPA Guidelines: • Student’s name; • Name of the student’s parent or family members; • Address of the student or their family; • Social security number, student ID number, or biometric record; • Indirect identifiers such as date of birth, place of birth, and mother’s maiden name; • Other information that alone or in combination is linked or linkable to a specific student that would allow a reasonable person in the school community who does not have personal knowledge of the relevant circumstances to identify the student with reasonable certainty; or, • Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. |
HIPAA Identifiers | The following 18 items are considered identifiers under the HIPAA Guidelines: • Names. • Postal address information: street address, city, county, precinct, ZIP code (except specified combinations). • All elements of dates (except year) related to an individual (e.g., birth, admission, discharge). For participants over 89 years of age, all elements of dates (including year) must be removed. • Telephone numbers. • Fax numbers. • Electronic mail addresses. • Social Security numbers. • Medical Record numbers. • Health plan beneficiary numbers. • Account numbers. • Certification/license numbers. • Vehicle identifiers and serial numbers, including license plate numbers. • Device identifiers and serial numbers. • Web Universal Resource Locators. • Internet Protocols address numbers. • Biometric identifiers, including finger and voice prints. • Full face photographic images (and any comparable images). • Any other unique identifying number, characteristic, or code. |
Human Subject | A living individual about whom an investigator conducting research: • Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or • Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens. |
Identifiable data / Identifiable private information | Data where the individual can be identified in the data set. This could be by name, unique identifying number, characteristic, or code. |
Obscured/Obfuscated Data | Data (often images, video, or photographs) that have been distorted either via blurring/masking or via other cryptographic means to reduce or eliminate the potential for identification. |
Personal Data (EU/UK GDPR) | Any information relating to an identified or identifiable natural person. Examples of Personal Data: • a name and surname; • a home address; • an email address such as name.surname@company.com; • an identification card number; • location data (for example the location data function on a mobile phone); • an Internet Protocol (IP) address; • a cookie ID; • the advertising identifier of your phone; • data held by a hospital or doctor, which could be a symbol that uniquely identifies a person. Examples of data not considered personal data: • a company registration number; • an email address such as info@company.com; • anonymous data. |
Personally Identifiable Information / Private Individual Information (PII) (As defined in Nebraska Legislature Revised Statute 87-802) | A Nebraska resident’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident if either the name or the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable: • Social security number; • Motor vehicle operator’s license number or state identification card number; • Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial account; • Unique electronic identification number or routing code, in combination with any required security code, access code, or password; or • Unique biometric data, such as a fingerprint, voice print, or retina or iris image, or other unique physical representation; • A username or email address, in combination with a password or security question and answer, that would permit access to an online account. Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records; and • Redact means to alter or truncate data such that no more than the last four digits of a social security number, motor vehicle operator’s license number, state identification card number, or account number is accessible as part of the personal information. For more information, please visit the UNL ITS topic regarding SSN and personally identifiable information. |
Primary Data | Data collected by the research team directly from first-person accounts (such as interviews, surveys, and questionnaires). |
Primary Source | A contemporary or first-hand account of an object or event. |
Private Information | Information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects. |
Protected Health Information (PHI) | Per HIPAA (Health Insurance Portability and Accountability Act), is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. For more information, please refer to the HIPAA A-Z Guidance topic. |
Pseudonymised Data (EU/UK GDPR) | Anonymous or coded data that could still be traced back to a particular individual. This data is still considered personal data. |
Record | According to the Privacy Act of 1974, refers to any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, [their] education, financial transactions, medical history, and that contains [their] name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph. |
Secondary Data | Data (qualitative or quantitative) that has already been collected for an original purpose that is now being used for a different purpose. |
Secondary Research | Research that will re-use information and/or biospecimens that are collected for some other “primary” or “initial” activity. This can generally be found by investigators in some type of record or database (in the case of information) or some type of tissue repository (such as a hospital’s department for storing clinical pathology specimens). |
Deception in Research
Deception is a research method in which investigators deliberately mislead participants during research procedures by withholding information or providing false information. As a result, participants are not fully informed about the research when they consent to participate. Deception can occur in different forms and is sometimes necessary to receive an unbiased result, but it should not place any research participant in significant financial, physical, legal, psychological, or social risk. The following describes three types of deception typically utilized in research.
Other Related Term(s):
- Authorized Deception
- To inform participants prior to the study that a study will not be described accurately or that some procedures will be deceptive, providing them an opportunity to decide whether to participate on these terms.
- Incomplete Disclosure
- To withhold information about the true purpose or nature of the research.
- Deception
- To deliberately withhold certain information from research subjects as part of the project design.
Key Information:
The UNL IRB approves research projects involving deception or concealment in accordance with 45 CFR 46. Depending on the project complexity and when participants are informed regarding the deception, projects involving deception can be reviewed at the exempt and expedited levels. For projects involving more than minimal risk, a review by the full board would be required.
Investigators must be able to justify the reasons for the deception, why the deception is necessary, the benefits of the research with deception, and provide the process of how participants will be debriefed, as applicable.
Authorized Deception
During the consent process, investigators have the option of informing participants that they will not be made aware of, or misled regarding, the nature or purpose of the research. If participants are made aware of this deception and then consent to participate in the research, this is known as Authorized Deception. Participants can be informed either via language in a consent form or verbally (depending on the nature of the project), and a debriefing process should occur as soon as possible.
Provided that the project meets the other requirements of Exempt Category 3(iii), projects utilizing authorized deception can be reviewed as Exempt with Limited Review.
During the consent process, investigators have the option of informing participants that they will not be made aware of, or misled regarding, the nature or purpose of the research. If participants are made aware of this deception and then consent to participate in the research, this is known as Authorized Deception. Participants can be informed either via language in a consent form or verbally (depending on the nature of the project), and a debriefing process should occur as soon as possible.
Provided that the project meets the other requirements of Exempt Category 3(iii), projects utilizing authorized deception can be reviewed as Exempt with Limited Review.
Incomplete Disclosure
Depending on the research design, it is possible that participants knowing that they are somehow being deceived could affect the scientific validity of the results. In these situations, investigators may need to withhold the true purpose of the study. This is known as Incomplete Disclosure. Participants should be debriefed regarding the true purpose of the study as soon as possible after participating, unless the debriefing procedure meets one of the exceptions listed under the “Debriefing” section, below.
Deception
For some projects, the entire research may depend on deceiving participants to study a particular phenomenon, and informing participants prior to participation may affect the scientific validity of results. This process is known as Deception. Participants should be debriefed regarding the true purpose of the research and the reason for the deception as soon as possible after participating, unless the debriefing procedure meets one of the exceptions listed below.
- Studies involving Incomplete Disclosure or Deception must meet all criteria for a waiver or alteration of informed consent. For a waiver or alteration of consent, the study must pose no more than minimal risk to subjects, and the waiver or alteration must not adversely affect subjects’ rights and welfare. The nature of the study must necessitate use of deception and, therefore, the waiver or alteration.
- While most studies involving Incomplete Disclosure or Deception will be reviewed using the expedited method, some studies may be deemed to involve more than minimal risk and would then require review by the full board.
Debriefing
Except in specific circumstances approved by the IRB, participants should be debriefed following their participation in the study as soon as possible.
- For many projects, debriefing can occur as soon as participants have completed the study procedures.
- If informing participants regarding the deception immediately could affect the scientific validity of results, debriefing could also occur upon the completion of the full study.
- There are some circumstances where revealing the deception could cause more harm to participants. In these situations, as determined by the IRB, the debriefing process can be waived.
- Depending on the nature of the research, it may be required by the IRB to include an option for participants to withdraw their data from the study after learning the true purpose of the study, especially if it is of a sensitive nature.
The debriefing language should be simple, clear, and informative, describing the rationale for the design of the study and the methods used. It should also give participants the opportunity to ask questions and to ensure that participants feel they are an important part of the research process. A debriefing template form is available on our Templates page.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
Document Version Control
Version control is a process used to keep track of and communicate, in a standardized manner, different drafts of a document. This process is important as it provides an audit trail for the revision and update of a finalized version. In particular, this process can be most readily utilized by researchers to track different versions of consent forms that may be used in order to ensure the most current, and approved, form is being used.
Investigators are encouraged to implement the use of version numbers to track the most up-to-date document. While there are many ways to approach version control of documents, this is the standard operating procedure used by Research Compliance Services. Please feel free to reference and use this SOP as needed.
UNL Guidance for Document Version Control:
European Union General Data Protection Regulation (EU GDPR)
This guidance is to be used in the development of or in the review of human subjects research only and is not intended to be used for other areas at UNL that may intersect with the EU GDPR.
In the context of human subjects research, the EU GDPR applies when any investigator is conducting research that involves collecting information or data in-person or online from a participant that is located in an EEA country. This affects people living or traveling in a GDPR regulated county; these regulations are based on location and not citizenship. Additionally, the GDPR applies if “goods or services” are offered, or the behavior of EEA participant behaviors are monitored within the EEA.
Effective May 25, 2018, the European Union General Data Protection Regulation (EU GDPR) requires entities that collect, store or process personal data to comply with stricter privacy standards and give EU citizens more access to and control over their own data. The EU GDPR supersedes the EU Data Protection Directive, which was adopted in 1995. As a regulation of the EU, the GDPR will apply directly to data controllers and data processors in the 28 member states of the EU and in the three additional countries (Iceland, Liechtenstein, and Norway) that, together with the EU, make up the EEA. The 28 EU member states are: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Ireland, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Spain, Slovakia, Slovenia, and Sweden.
Notes: (1) Given that the United Kingdom is no longer a member of the EEA, it is therefore not subject to the EU GDPR. However, the United Kingdom now has its own version of the GDPR known as the UK GDPR, which is virtually identical to the EU GDPR. If data is being transferred from the UK, nothing changes in how UNL researchers conduct research subject to EU GDPR. However, if personal data is transferred to the UK, that data must be covered and regulated by an appropriate safeguard, usually a contract. If your research involves transferring personal data to a collaborator in the United Kingdom, be sure to document this in your protocol and be in touch with your IRB coordinator as soon as possible to ensure all requirements are met per the UK GDPR regulations; (2) In February 2021, the European Data Protection Board (the “EDPB”) released new guidance on the application of the European Union General Data Protection Regulation (“GDPR”) to health research. The guidance was issued in the form of answers to questions posed by the European Commission, the executive branch of the European Union. The EDPB did not answer substantively many of the questions posed, instead noted that additional guidance would be forthcoming later this year regarding processing personal data for scientific research purposes. Investigators should be aware of possible changes forthcoming and our office will be sure to update our guidance and templates as needed. The guidance acknowledged important issues to researchers, and a brief overview of those issues can be found on the Ropes & Gray website.
Definitions:
- Data Controller: person/authority/agency which determines the purposes and means of the processing of person data. For example, a sponsor of a research study would typically be a “controller.”
- Data Processor: person/authority/agency which processes personal data on behalf of a controller. For example, the PI of a sponsored research study would typically be a “processor.” For a self-initiated study, the PI would be both the controller and the processor.
- Personal data: broadly defined as, any information relating to an identified or identifiable natural person.
- An identifiable person: is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
- Pseudonymised: is the same as coded/anonymized data and are still considered personal data per the EU GDPR.
- Goods/Services: broadly interpreted to include things as simple as an EEA person participating in research.
Key Information:
- If your human subjects research project involves any of the above listed 31 countries, or person(s) living or traveling in or to an EEA country while they are enrolled as a participant and the project collects personal data, your project may be subject to the EU GDPR.
- The GDPR will apply extraterritorially in a broader range of circumstances than previous requirements. Unlike the “Directive,” the GDPR applies to the processing of personal data by a controller or processor not established in the EEA, i.e., that lacks a physical presence in the EEA, when the processing is related to
- (a) offering goods or services to data subjects in the EEA or
- (b) the monitoring of behavior of data subjects who are in the EEA.
- This means that the GDPR will apply directly to, and will directly regulate, much of the U.S.-based use and processing of personal data that have been collected in the EEA for clinical and other research purposes.
- The category of “personal data” to which the GDPR applies is much more broadly defined than “protected health information” covered by HIPAA or “identifiable private information” as defined in the Common Rule. Under the GDPR, “personal data” are defined broadly to include:
- Any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
- Notably, coded data, referred to as “pseudonymised data” in the GDPR, are considered to be “personal data” subject to the protections of the GDPR. This is in contrast to the Common Rule, which generally does not protect such information as “identifiable private information” provided that certain steps are taken to prevent the investigator from obtaining the means to link the code to the subject’s identity.
- However, anonymous data are not subject to GDPR. De-identified data, where the research team had no role in the collection of the original data with identifiers and have no access to the identifiers going forward are also not subject to GDPR. A data use/data transfer agreement may be applicable.
These GDPR regulations strengthen and define the individual rights of participants located in EEA countries. Those rights include:
- Right of access (What do you know about me?)
- Right to erasure/Right to be forgotten (Remove me from your database.)
- Right to Rectification (Amend or correct my details)
- Right to Restrict Data Processing (Stop filming/recording me)
- Right to withdraw consent (I don’t want to do this survey anymore)
- Right of data portability (Move my personal data from one location to another)
- Right to prior notification before data collection
- Right to reject automated profiling (Ability to reject automated processing used to evaluate personal aspects of an individual, like refusal for insurance based on algorithm)
GDPR requires that consent be: Freely given, specific, informed, and unambiguous. Further it should be a two-step process that includes:
- A letter of information (Note: This can be accomplished within the body of the informed consent document)
- A 1-2 page consent document that includes affirmation, consent elements, and signature (These elements are found in the Social-Behavioral Adult Participant Informed Consent and Biomedical Adult Participant Informed Consent templates available on the RCS website.)
Based on the regulations, a waiver of consent or a waiver of consent documentation are not acceptable under the GDPR for non-exempt research projects. However, in an exempt project if a consent form contains a check box with “I agree”, where a participant is actively choosing to consent, that would serve as sufficient proactive affirmation of consent.
Additionally, for the processing of genetic, biometric, health and certain other sensitive categories of Personal Data, the individual’s consent must be explicit. The GDPR does not define explicit consent, but provides examples such as a hand-written signature, an electronic signature, an uploaded scanned document carrying a signature or two-stage verification of consent where individual must click on a verification link by email or text message after initially consenting.
Template language to include within informed consent documents for projects needing to meet GDPR requirements can be found on the RCS Templates/Forms web page.
Keep in mind that these requirements depart in several ways from how human subjects research is conducted in the US. Guidance regarding standard or best practices have not yet been created at the Federal level or otherwise. Thus, there may not be a clear way forward in how best to accomplish your human subjects research until more detailed guidelines are worked out.
The IRB new project form in NuRamp requests information regarding whether or not your proposed project will involve an international site. As a starting point to meeting the GDPR requirements, please be sure to include information in your IRB application regarding any involved EEA countries/citizens. If you have a currently approved IRB protocol involving the above, please contact the IRB.
Additional Guidance and/or External Resources:
- OHRP/SACHRP EU GDPR Recommendations
- COGR/Ropes & Gray Presentation on EU GDPR
- OHRP Compilation of Guidances on the EU General Data Protection Regulation
- Additional helpful information on the GDPR provided by the European Commission
Exempt Research
In order for research to be categorized as exempt, research must meet the criteria of one or more exempt categories officially documented by Research Compliance Services staff through submission of a new project form via NuRamp.
In addition, effective January 19, 2018, the IRB has removed the requirement for change requests to be submitted for exempt research projects. Unless the change would involve one of the following, a change request would not need to be submitted:
- A change in the scope of the project.
- Increased risk to participants.
- A change to the category of the original exemption determination.
- A change in performance site.
- A change in the principle or secondary investigator.
- Addition of a funding source.
- A change as directed by Research Compliance Services.
- Or, if the exempt project is approved under a limited review category (effective July 19, 2018).
Key Information:
- Being categorized as exempt, does not mean the project is exempt from review. This categorization means that the research does not have to meet some of the regulatory requirements present at 45 CFR 46.
- If a project is categorized as exempt based on the federal regulations, the project must still meet institutional policy requirements such as, for example, providing basic information about the research, submission of some change requests, reporting to the IRB of any new information found during the course of the project. HRPP Policy #12.001: Change Request delineates the types of changes that must be submitted.
- Beginning January 19, 2018, recruitment materials and informed consent documents for Exempt projects are not stamped and certain changes to the project do not require submission and approval prior to implementation.
- Because the consent and recruitment documents are not stamped, study teams are encouraged to implement the use of version numbers to track the most up-to-date document. Feel free to review Research Compliance Services Standard Operating Procedure for the use of version numbers available.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #4.001 Exempt Research
- 2018 Policy #4.001 Exempt Research
- 2018 Policy #4.003 Exempt Research – Limited Review
- Pre-2018 Policy #12.001 Request for Change
- 2018 Policy #12.001 Request for Change
UNL Guidance for Exempt Research:
- It is recommended to use the consent and recruitment templates that are available on the Templates/Forms webpage.
- See also our guidance on Recruitment/Advertising and HRPP Policy #3.016: Recruitment of Participants Through Advertisements.
External Organization IRB Review Request Fee Schedule
The UNL IRB can consider becoming the IRB of record for external entities or institutions when they do not have an IRB of their own and/or the use of a commercial IRB is not a viable option. Approval in these cases is limited and the decision on whether or not to provide IRB review is determined on a case-by-case basis involving approval from the UNL Institutional Official and/or RCS Director. Please see our Fee Schedule document for further information and how an outside entity could request IRB review at UNL.
Please download the UNL IRB Fee Schedule for further details.
Family Educational Rights and Privacy Act (FERPA): Use of FERPA-regulated Data for Research Purposes
The following guidance utilizes terminology that can be found in our Data Identifiability Definitions A-Z guidance.
The following information is made available to assist UNL research investigators in preparation of research projects involving human subjects that may be subject to FERPA requirements. This information is not meant to be legal advice or any other form of advice outside of a research project being reviewed by the UNL IRB. If any information made available here is inconsistent with UNL HRPP policies and procedures, policies will supersede this information.
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It applies to any educational institution that receives funds from programs administered by the U.S. Department of Education. A student or parent may be the owner of the education record. The law assigns an eligible student, defined as a student who has reached 18 years of age or is attending an institution of postsecondary education, as the owner of their educational record. This means that, at the secondary level, once a student turns 18, all the rights that once belonged to his or her parents transfer to the student. FERPA also provides guidelines on how the educational institution is to use and release protected information. This ensures certain student-centered information is not public information and that the eligible student can control who has access to this information. This law also requires the educator/institution to grant students access to their personal records. Be aware that some private schools do not receive federal funds and therefore may not be subject to FERPA.
For more information about FERPA and UNL’s implementation, broadly speaking, including definitions of key terms please visit UNL’s FERPA webpage using the link below.
Key Information:
As an employee of UNL, all faculty, staff and/or student research investigators must comply with FERPA regulations if the research project being conducted involves education records. As a researcher, access to education records may be achieved through a variety of ways as primary or secondary data and include the following:
- Obtaining records through the Office of the Registrar
- Obtaining records through Institutional Effectiveness and Analytics
- Obtaining records through student information systems maintained by the Institution (e.g., Obtaining records through the course instructor (who could also serve as the researcher). This could include course assignments, grades, etc.)
Researcher Agreement
In some instances, researchers utilizing student education records may be required to enter into an agreement documenting the following assertions:
- To use the information only for purposes of the approved research project. Any new use of the information requires new approval.
- To provide adequate protection for the information to ensure that it is not compromised or subject to unauthorized access.
- To ensure that no one outside the research team has access to the information.
- To destroy the identifiable information within a reasonable time after completion of the research. These timeframes must be in alignment with the IRB approved protocol.
Ethical Access
In many cases, student education records are accessible to and used by instructors, teachers, and administrators for the purposes of conducting the duties of their job. For example, as part of an instructor’s job, there is ethical access to student’s assignments, test scores, and attendance records to evaluate performance and ultimately assign a grade. However, this same instructor cannot use this ethical access for other intents and purposes, such as research. In other words, simply because an investigator has access to these data as the instructor of a course, it does not mean they can use the data for research purposes without permission. Investigators must have a legitimate educational interest to use the data for something other than its original purpose and may also be required to have written permission if it will be used for research if no exceptions apply.
Identifiable or De-identified Records
Education records may be obtained as identifiable or de-identified records. As part of the planning process for all research projects involving education records, researchers must consider whether consent from the parent or eligible student would be a requirement.
Informed Consent
Use of or access to identifiable education records will require, with exceptions, signed informed consent by the eligible student and/or parent, as applicable before obtaining the record for research purposes. The IRB does not have the authority to waive the FERPA consent requirement for use of or access to identifiable records, including coded records.
Exceptions to Informed Consent Requirements for Use of Identifiable Records
The following scenarios or use of education records would be considered exceptions and would not require written consent:
- Use of “directory information” and the student has not opted out of having their information included in the directory. A research consent will not override this notation and the research team may not receive a full dataset as requested.
- Use of de-identified records and the research investigator does not complete the de-identification process nor maintain a master list linking codes to identifiable information.
- Third parties with written agreement in conjunction with the evaluation of federal or state supported educational programs. This may include conducting research studies for or on behalf of the educational agencies or institutions to develop, validate or administer predictive tests; administer student aid programs; or improve instruction. However, a written agreement, which meets all FERPA criteria, between the university and the educational agency or institution is required to be fully executed between the data provider and the data recipient; this includes UNL researchers conducting research/evaluation on behalf of the institution.
- This does not include research at the discretion of the research investigator in the normal course of their faculty research responsibilities.
For additional information about informed consent exceptions, please use the UNL Registrar’s FERPA webpage link below.
FERPA-Compliant Consent Form
The Institutional Review Board requires certain elements to be present in most consent forms, with certain flexibilities allowed by the regulations at 45 CFR 46. If consent is a requirement for the use of and access to education records, certain FERPA elements will be required to be included in the research consent form. In addition, parental consent must be obtained if the student is not an eligible student. Be aware, that while student assent is not a FERPA requirement the school district and/or the IRB may require the assent of the minor or decisionally impaired research subject.
The following elements must be included in a FERPA-compliant consent form:
- Signature and date.
- This may include signature in electronic form provided that it identifies and authenticates a particular person as the source of the electronic consent and indicates their approval of the information contained in the consent. (e.g. Typing out their full name and actively clicking on an “I Agree” or “I do not agree” check box.)
- A description of the records/information that will be used in the research.
- A description of the purpose of the records disclosure.
- A description of the people and/or organizations to whom the disclosure may be made.
- A description of when identifiable data will be destroyed. (As soon as the identifiers are no longer necessary, they should be deleted.)
Requesting FERPA Data
As described above, FERPA data can be requested in a variety of ways and from several different administrative units, departments and/or offices based on the breadth of the University activities and services. Review the information below to find the most appropriate request process for the data being accessed and/or used for research purposes. If you have questions about accessing student records and do not find your answer below, including where the data may reside, please contact the University Registrar.
Accessing Data From the Registrar
- A research request must be sent in writing to the University Registrar, at registar@unl.edu.
- The request should include the student NUID, as applicable, and a list of each data field or variable and the associated IRB application and IRB project ID, as applicable. When sending this list of fields, the preferred method is to have the codebook with explanations of data field set up and to send that Excel document to the Registrar’s office so they can fill in the requested fields.
- FERPA-regulated data that are requested from the Registrar’s office can only be provided to University Faculty and Staff (including post-doctoral positions) as authorized officials. Please be aware, the Registrar might not release identifiable records (other than public directory information) about students to other students (TA’s, graduate research assistants, undergraduate research assistants) and other arrangements may be necessary if the data request is for a student project.
- It is possible for an appropriate personnel member to de-identify the students’ FERPA data first, and then another student on the research team would be able to view and analyze that data.
From a Department/College
- Generally, this data would be in the possession of a faculty member and includes items such as graded assignments and tests, attendance records, discussion/posts in Canvas, etc. The use of this identifiable data would require acknowledgement and permission from the department dean/chair as described above along with any relevant consent requirements being met.
From the Office of Scholarships & Financial Aid
- Reach out to their office and speak with someone about your request and they can provide you with appropriate information.
From Institutional Effectiveness and Analytics
- This office maintains, manages, and reports information on students, faculty and staff, academic programs, national and peer institutions, higher education trends, and agency data.
- Formally request your data on their website here: https://iea.unl.edu/online-forms/data-request-form
- Be sure to include your IRB project number/approval number as they will email our office to confirm that the data you request is included in your approved protocol.
Record-Keeping Requirements
Each administrative unit of the University of Nebraska has an obligation to keep a record of requests and disclosures of student record information, except when the request is from the student, a university school official with a legitimate educational interest, a request for directory information, or a request to which the student has given a FERPA consent. A student has the right to review the record of requests and disclosures made in relation to his or her education records.
Research investigators must ensure consent forms, including FERPA-compliant consent forms are available for inspection in the normal course of IRB monitoring. The length of storage will be determined by the IRB approved protocol.
IRB Review
All research investigators must submit an IRB application through the New Project Form to begin the process of review and approval for use of educational records in research. The IRB application must indicate that FERPA-regulated data will be accessed and used during the research project. The application must include detailed information regarding what specific data variables will be used (e.g., assignments, grades, etc.), if the student record will be created during the research project or if the student record will be used as a secondary data source, as well as a description of the participant privacy and data confidentiality practices.
Surveys and assessments administered only for research purposes (i.e., will not be graded) are not covered by FERPA because the data collected are not part of a student’s educational record.
De-identified records may not require IRB approval prior to their use. Please be sure to follow-up with the IRB if there are any questions regarding IRB requirements. If an official IRB review and determination is required to obtain de-identified records from external organizations or other entities, the Determination Form must be submitted.
Be aware, if an investigator receives IRB approval for a study that involves the use of data obtained from educational records, it may not be the case that the providing entity such as the Registrar’s Office or Institutional Effectiveness and Analytics has the obligation or the resources to provide the data.
Frequent Example: An investigator asks to use identifiable classroom assignments and grades from previous semesters (Fall 2018, Fall 2017, and Fall 2016) of a particular course. These students may have potentially graduated and there is no way to obtain signed consent. These pieces of the educational record are housed within a specific department and not the Registrar’s Office. The researcher would need to obtain permission from the applicable person in the department by way of a written agreement that includes the required elements as noted above. This document should be uploaded to the IRB application, as well as kept in the investigator’s research records.
Other Related Federal Regulations Applicable to Research with Student Populations
Protection of Pupil Rights Amendment (PPRA). These regulations are additional protections that ensure no student is required to submit, without prior consent, to any psychiatric testing or psychological examination/testing/treatment where the purpose is to reveal information on one or more of the following topics: political affiliations, mental and psychological problems potentially embarrassing, sex behavior and attitudes, illegal/anti-social/self-incriminating/demeaning behaviors, critical appraisals of other individuals with whom the student has close familial relationships, legally recognized privileged and analogous relationships, and income.
This regulation also gives parents the right to inspect any instrument used to collect information concerning the above-identified topics. Specific information about this right must be included in parental consent form(s), when applicable. Consent form templates are available at the link below.
In addition to ensuring the consent form accurately describes the ability to inspect instruments, the IRB has the obligation to verify, by acceptance of the school official’s letter of agreement or School IRB approval (when applicable), that compliance with US Department of Education regulations will be maintained. Specifically, schools are required to develop and adopt policies in conjunction with parents regarding the following:
- The right of parents to inspect, upon request, a survey created by a third party before the survey is administered or distributed by a school to students.
- Arrangements to protect student privacy in the event of the administration of a survey to students including the right of parents to inspect, upon request, the survey, if the survey contains one or more of the same eight items of the information noted above.
- The right of parents to inspect, upon request, any instructional material used as part of the educational curriculum for students.
- The administration of physical examinations or screenings that the school may administer to students.
- The collection, disclosure, or use of personal information collected from students for the purpose of marketing or for seeing that information (or otherwise providing that information to others for that purpose), including arrangements to protect student privacy that are provided by the agency in the event of such collection, disclosure, or use.
- The right of a parent of a student to inspect, upon request of the parent, any instrument used in the collection of personal information before the instrument is administered or distributed to a student.
The above information illustrates one of the many reasons why the IRB requires school permissions to be provided as part of the IRB application prior to research commencing at the performance site.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #15.001: Human Research Compliance with Department of Education Regulations
- 2018 Policy #15.001: Human Research Compliance with Department of Education Regulations
UNL Guidance and Resources:
- Office of the University Registrar: FERPA
- Office of the University Registrar: FERPA Key Terms
- Office of the University Registrar: FERPA Consent Exceptions
Additional Guidance and/or External Resources:
- UNL Consent Form Template
- U.S. Department of Education FERPA Website
- 34 CFR Part 98: Student Rights in Research, Experimental Programs, and Testing (PPRA)
- 34 CFR Part 99: Family Educational Rights and Privacy (FERPA)
- 16 CFR Part 312: Children’s Online Privacy Protection Rule (COPPA)
Genetic Information Nondiscrimination Act (GINA)
GINA defines a genetic test as an analysis of human DNA, RNA, chromosomes, proteins, or metabolites that detect genotypes, mutations, or chromosomal changes. To learn more about GINA, please visit the Office of Human Research Protection’s (OHRP’s) webpage.
GINA defines genetic information as information about:
- An individual’s genetic tests (including genetic tests done as part of a research study);
- Genetic tests of an individual’s family members (defined as dependents and up to and including 4th degree relatives);
- Genetic tests of any fetus of an individual or family member who is a pregnant woman, and genetic tests of any embryo legally held by an individual or family member utilizing assisted reproductive technology;
- The manifestation of a disease or disorder in an individual’s family members (family history); or
- Any request for, or receipt of, genetic services or participation in clinical research that includes genetic services (genetic testing, counseling, or education) by an individual or an individual’s family members.
Genetic information does not include information about the sex or age of any individual. Routine tests that do not detect genotypes, mutations, or chromosomal changes, such as complete blood counts, cholesterol tests, and liver enzyme tests, are not considered genetic tests under GINA. Also, under GINA, genetic tests do not include analyses of proteins or metabolites that are directly related to a manifested disease, disorder, or pathological condition that could reasonably be detected by a health care professional with appropriate training and expertise in the field of medicine involved.
Template language to be used for non-exempt genetic research involving human subjects conducted or supported by Health and Human Services (HHS) can be found on our Templates/Forms page.
Grant Congruency Review
When a funding source is identified on an IRB project form (regardless of whether or not the funding source is Federal), UNL HRPP staff will complete a grant congruency review to ensure the proposal/grant/statement of work or other related document matches or is closely related that of the proposed IRB protocol.
Other Related Term(s):
- 118 Determination
- This is a specific regulation that could be used during a grant congruency review that allows for IRB approval when there are no definitive plans for human subjects involvement in a proposed project. See topic 118 Determination for more information.
Key Information:
- The congruency review between the funding proposal document and IRB protocol is completed to confirm that the information provided in the grant proposal matches or is closely related that of the proposed IRB protocol.
- The IRB protocol must include the research questions, design, and procedures that are provided in the grant proposal, but the protocol may also include additional design and procedures that are not related to the grant.
- HRPP staff will request revisions to the IRB application or request clarifications from the PI to better identity or clarify any discrepancies between the funding and the IRB applications, as necessary.
- The UNL Office of Sponsored Programs holds funding awards until all IRB requirements have been satisfied. Specifically, Pre-2018 Federal regulations at 45 CFR 46.103 require that grant applications or proposals for federally funded human subjects research be reviewed and approved by an IRB:
- “Certification is required when the research is supported by a Federal department or agency and not otherwise waived or exempted. For such research, institutions shall certify that each proposed research study covered by the assurance and this section has been reviewed and approved by the IRB. Such certification must be submitted as prescribed by the Federal department or agency component supporting the research. Under no condition shall research covered by this section be initiated prior to receipt of the certification that the research has been reviewed and approved by the IRB.”
Once the grant congruency review has been completed and any inconsistencies addressed, the HRPP staff will document:
- Grant congruency review date
- IRB Coordinator who completed the congruency review
- Sponsored Programs Project and Form ID numbers
For those projects where funding is not being routed through Sponsored Programs for processing, it is still important to contact the IRB (and other compliance offices: institutional animal care program, export control, conflict of interest, biosafety and radiation safety) in order to ensure appropriate approvals are in place if the project involves any of these components.
The RCS Office provides the following template language for use by any Departments on campus when funding or an award is perhaps internal or not being routed through Sponsored Programs. The language may not fit every scenario but please keep in mind the main intent of the notification is to ensure release of funds does not occur until all applicable compliance areas have been checked.
“In order to ensure use of these funds meets research compliance requirements, please follow up with the respective UNL campus research offices for approval involving human or animal subjects, export controls, conflicts of interest, and biosafety or radiation safety as applicable. The office responsible for administering the award will not authorize release of funds until all compliance checks have been addressed.”
UNL Human Research Protection Program (HRPP) Policies and Procedures:
UNL Guidance for UNL HRPP staff grant congruency review:
- Standard Operating Procedure, IRB Protocol Grant Congruency Reviews & Certification
Health Insurance Portability and Accountability Act (HIPAA) and UNL Human Subjects Research
The following guidance utilizes terminology that can be found in our Data Identifiability Definitions A-Z guidance.
The following information is made available to assist UNL research investigators in preparation of research projects involving human subjects that may be subject to HIPAA requirements. This information is not meant to be legal advice or any other form of advice outside of a research project being reviewed by the UNL IRB. If any information made available here is inconsistent with UNL HRPP policies and procedures, policies will supersede this information.
The Health Insurance Portability and Accountability Act’s Privacy Rule, 45 CFR 160 & 164, regulates the use and release of a patient’s personal health information, also known as protected health information (PHI), by a covered entity.
The HIPAA Privacy Rule contains requirements designed to ensure that the PHI of research participants is appropriately used and/or disclosed during the conduct of research. When using or disclosing PHI for research purposes, a signed authorization from the research participant or a waiver of authorization issued by the UNL IRB or a Privacy Board must be obtained as part of the IRB approved project if identifiable information will be obtained.
Other Related Term(s):
- Covered Entity
- Defined as (1) health plans, (2) health care clearinghouses, and/or (3) health care providers who electronically transmit any health information in connection with transactions for which Health and Human Services (HHS) has adopted standards.
- Generally, these transactions concern billing and payment for services or insurance coverage.
- For example: hospitals, academic medical centers, physicians, and other health care providers who electronically transmit claims transaction information directly or through an intermediary to a health plan are covered entities. Covered entities can be institutions, organizations, or persons.
- Hybrid Entity
- A covered entity that engages in both HIPAA covered and non-covered functions.
- The University of Nebraska-Lincoln is a hybrid entity.
- Business Associate
- Defined as a person or entity who, on behalf of a covered entity, performs or assists in performance of a function or activity involving the use or disclosure of individually identifiable health information, such as data analysis, claims processing or administration, utilization review, and quality assurance reviews, or any other function or activity regulated by the HIPAA Administrative Simplification Rules, including the Privacy Rule. Business associates are also persons or entities performing legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for a covered entity where performing those services involves disclosure of individually identifiable health information by the covered entity or another business associate of the covered entity to that person or entity. A member of a covered entity’s workforce is not one of its business associates. A covered entity may be a business associate of another covered entity.
- Limited Data Set
- Defined as PHI that excludes direct identifiers of the individual or of relatives, employers, or household members of the individual. The limited data set must have all identifiers listed below removed, except the following:
- A unique identifying number, characteristic, or code (e.g., a registry or study number).
- In this instance, the unique identifying number refers to the code that is associated with the medical record and not a newly assigned research database code.
- Elements of dates (e.g., birth date).
- Town, city, state, and ZIP code.
- A unique identifying number, characteristic, or code (e.g., a registry or study number).
- A researcher with IRB approval and a Data Use Agreement between the researcher and the covered entity can use and disclose Protected Health Information that contains a limited data set without a HIPAA authorization or a waiver of consent granted by the IRB. The UNL Office of Sponsored Programs assists investigators in the development and execution of Data Use Agreements. Please contact the UNL OSP Awards team if a Data Use or Transfer Agreement is needed.
- Defined as PHI that excludes direct identifiers of the individual or of relatives, employers, or household members of the individual. The limited data set must have all identifiers listed below removed, except the following:
Key Information:
- At UNL, the following areas are considered covered entities:
- Barkley Memorial Center
- Health Plans (i.e. faculty/staff)
- Student Health Center
If you are affiliated with the Barkley Memorial Center, please ensure you are meeting your Departmental requirements for HIPAA. If you are designing research that will involve the Barkley Memorial Center, we encourage you to meet with representatives of the Center to discuss your project. The UNL IRB will require that specific permissions are documented as part of your IRB application if involving a patient population from the Barkley Memorial Center.
The HIPAA Privacy Rule applies to research use and/or disclosure of PHI, independent of the federal regulations for human subjects research. The following are examples of how the federal regulations for human subjects research (45 CFR 46) and HIPAA (45 CFR 160 & 164) intersect or remain separate:
- A human subjects research project utilizing PHI to identify eligible subjects or to create a research dataset, may require a waiver of HIPAA authorization. (In this case, the UNL IRB can provide the HIPAA waiver, alongside their review of the human subjects research approval requirements).
- A faculty member/department is contacted to provide data analysis of PHI on behalf of a covered entity through a contract. The faculty member/department is considered a Business Associate of the covered entity but they are not considered to be engaged in research because their work does not meet the definition of human subjects research. (The faculty member/department would be required to follow the HIPAA Privacy Rule requirements but not required to apply for IRB review and approval. In this case, the UNL IRB would not be involved in the review of the project requirements). If you believe a project you are involved with is similar to the above scenario, we encourage you to seek an official human subjects determination through an IRB application or by contacting the UNL IRB at irb@unl.edu.
The Privacy Rule also allows, without individual authorization, use and/or disclosure of private health information under a select few additional circumstances:
- Use/disclosure is solely for purposes preparatory to research, such as assessing the feasibility of conducting a study.
- Use/disclosure is solely for research on the protected health information of decedents (deceased individuals).
- Data is de-identified by the covered entity before being made available to the researcher (researcher never views PHI).
- A limited data set may be used/disclosed under the terms of a written data use agreement.
- A Waiver of Authorization has been approved by the UNL IRB or a Privacy Board.
Please be aware, even though individual authorization may not be required, additional permissions, approvals, or agreements may be necessary to obtain access to PHI.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #10.001 Use of Protected Health Information in Research and Registries
- 2018 Policy #10.001 Definition, Description, and Use of Protected Health Information Identifiers
Additional Guidance and/or External Resources:
- Office for Civil Rights (Main HIPAA site)
- Guide to Privacy and Security Learning Video
- HIPAA Privacy Rule Information from NIH
- HIPAA Privacy Rule Booklet for Research from NIH
Human Subjects Research
Human subjects research is a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Research must involve a living individual about whom an investigator (whether professional or student) conducting research obtains either data through intervention or interaction with the individual, or identifiable private information.
Other Related Term(s):
- Intervention
- Includes both physical procedures by which data are gathered (e.g., drawing blood) and manipulations of the participant or the participant’s environment that are performed for research purposes.
- Interaction
- Includes communication or interpersonal contact between investigator and participant.
- Private Identifiable Information
- Includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual, and which the individual can reasonably expect will not be made public (e.g., medical record information).
Key Information:
- All human subjects research conducted by UNL faculty, staff, students and/or affiliates must be reviewed and approved by the IRB prior to commencement of the research, including recruitment.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #3.001 Investigational Activities Requiring IRB Review and Approval
- 2018 Policy #3.001 Investigational Activities Requiring IRB Review and Approval
UNL Guidance for research involving human subjects and the IRB review process:
Informed Consent Process Best Practices
This guidance describes the consent process and outlines specific actions that should be taken by investigators to ensure that participants are properly consented before the research begins.
Part of conducting ethical human subjects research is ensuring your participants understand the research purpose and procedures, as well as their rights. Consider using a readability test tool to confirm how easy-to-read and comprehend the language is within your consent form. Acceptable readability scores will depend on the targeted population of a specific study. For general populations, a typical score might be around an 8th grade reading level. The IRB may request a readability score if there are concerns related to language used in a consent form. (per UNL HRPP 2018 Policy #9.002).
UNL Human Research Protection Program (HRPP) Policies and Procedures:
UNL Guidance for informed consent best practices:
Additional Guidance and/or External Resources:
- Microsoft Word includes built in readability scores for the Flesch-Kincaid Grade Level test and Flesch Ease test.
- Online readability test tool
- WebFX (Test language by URL or copy/pasting language into a text box)
- WebFX (Test language by URL or copy/pasting language into a text box)
International Council for Harmonization – Good Clinical Practice (ICH-GCP): Policy & Training Requirements
The International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use (ICH) is an international non-profit association that works to bring greater harmonization worldwide to ensure that safe, effective, and high quality medicines are developed and registered in the most resource-efficient manner (ICH Official web site. (n.d.). Retrieved September 25, 2020, from https://www.ich.org/page/mission). The ICH sets out a series of guidelines and standards for the conduct and reporting of clinical trials. These guidelines include Quality, Safety, Efficacy (where the Good Clinical Practice guidelines are included) and Multidisciplinary Guidelines along with various reporting standards.
Good Clinical Practice (GCP) is an international, ethical and scientific quality standard for designing, conducting, recording and reporting trials that involve the participation of human subjects. More recently, U.S. regulatory agencies and funding sponsors have begun to require components of the ICH-GCP in the conduct of clinical trials while also expanding the definition of a clinical trial broadly to encompass a larger variety of research including those projects we traditionally think of as social-behavioral research. Based on this expansion, UNL Research Compliance Services in conjunction with the UNL Institutional Review Board have worked together to ensure that all applicable clinical trials conducted at UNL meet the requirements of ICH-GCP E6R2.
For the purpose of compliance with the UNL Human Research Protection Program policy #3.019 titled, “International Conference on Harmonization – Good Clinical Practice (ICH-GCP) E6R2 Compliance,” this guidance will focus on requirements set forth under the Efficacy guidelines specific to GCP.
Other Related Term(s):
- In general, Health & Human Services 45 CFR 46.102(b) defines a clinical trial as a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes.
- The FDA, the NIH and the International Committee of Medical Journal Editors (ICMJE) all use slightly different definitions of a clinical trial. When understanding if your project is subject to ICH-GCP guidelines, you must be sure to use the applicable definition. Please see the external links below when accessing the applicable definition.
- These definitions are also included on page 1 of the UNL IRB New Project Form application.
Key Information:
- Effective January 4, 2021: Any project defined as a clinical trial using one or more of the definitions set forth by the following agencies, sponsors or organizations will be required to meet all standards of the ICH-GCP E6 guideline as described in UNL HRPP policy #3.019:
- The Food & Drug Administration;
- Federal Funding agency that complies with the Revised Common Rule at 45 CFR 46 effective on or after January 21, 2019;
- National Institutes of Health, including Basic Experimental Studies with Humans (BESH) studies;
- International Committee of Medical Journal Editors (ICMJE);
- Any other funding agency or sponsor whose policy or contract requires adherence or defines a project as a clinical trial.
- Any investigator and/or staff who are involved in the conduct, oversight, or management of a Clinical Trial must complete and maintain GCP training every four years. This training is completed through the Collaborative Institutional Training Initiative (CITI).
- Any investigator conducting a Clinical Trial must register the clinical trial on ClinicalTrials.gov. For more information about registering your project on ClinicalTrials.gov, please see the topic ClinicalTrials.gov registration.
- Any project defined as a clinical trial must include specific information about the clinical trial in the participant consent form. Template language specific to these requirements is available via our Templates/Forms page.
- All clinical trials conducted by a UNL investigator must use the NIH clinical trial protocol template when submitting for UNL IRB review and approval. These templates are available our Templates/Forms page.
- Specific instructions on how to complete the UNL IRB new project form with the required NIH template is available via our Templates/Forms page.
- Most UNL investigators will use the Behavioral and Social Science Research (BSSR) Involving Humans protocol word template.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
Additional Guidance and/or External Resources:
- National Institutes of Health Definition of a Clinical Trial
- ICMJE Clinical Trials registration and data sharing guidance
- UNL IRB Templates/Forms Page
Legally Authorized Representative (Nebraska definitions) & Persons with Impaired Decision-Making Capacity
When conducting research involving persons with diminished capacity for judgement and reasoning, there are additional considerations for how investigators will meet the criteria for approval at 45 CFR 46.111(4) Informed consent will be sought from each prospective subject or the subject’s legally authorized representative, in accordance with, and to the extent required by, §46.116. Investigators are required to determine whether or not a potential participant has the capacity to provide consent, and if they do not, also make a determination on who might be the most appropriate person to consent on the participant’s behalf. Generally, this will be a Legally Authorized Representative (LAR).
The following definitions are based on Nebraska Revised Statutes and are important when determining who can consent of behalf of someone else for research purposes. These definitions may vary from state to state and so it is equally important to understand the requirements of each state wherein which your research is conducted if your project will involve persons with impaired decision-making capacity.
A Legally Authorized Representative can be:
- An individual or judicial or other body authorized under applicable law to consent on behalf of a prospective subject to the subject’s participation in the procedures involved in the research (45 CFR 46.102(c)).
- Parents
- Guardian(s) having legal custody of the decisionally impaired person;
- The court-appointed legal guardian of the decisionally impaired person in accordance with Neb. Rev. Stat. 30-2627;
- Any competent person or the Public Guardian may be appointed guardian of a person alleged to be incapacitated with exceptions (see policy below for exceptions), or,
- Persons who are not disqualified based on the exceptions and who exhibit the ability to exercise the powers to be assigned by the court have priority for appointment as guardian in the following order:
- (1) A person nominated most recently by one of the following methods:
- A person nominated by the incapacitated person in a power of attorney or a durable power of attorney;
- A person acting under a power of attorney or durable power of attorney; or
- A person nominated by an attorney in fact who is given power to nominate in a power of attorney or a durable power of attorney executed by the incapacitated person;
- (2) The spouse of the incapacitated person;
- (3) An adult child of the incapacitated person;
- (4) A parent of the incapacitated person, including a person nominated by will or other writing signed by a deceased parent;
- (5) Any relative of the incapacitated person with whom he or she has resided for more than six months prior to the filing of the petition;
- (6) A person nominated by the person who is caring for him or her or paying benefits to him or her;
- (7) The Public Guardian.
- (1) A person nominated most recently by one of the following methods:
- The individual authorized to consent on behalf of a decisionally impaired person pursuant to a legally effective Health Care Power of Attorney (POA-HC) or a durable power of attorney which includes the POA-HC.
An LAR should normally use “substituted judgement” where possible as opposed to “best interests”.
When thinking about who can consent on behalf of someone else, it should be noted that a power of attorney is a physical document that authorizes someone else to handle things like finances or health care, on a person’s behalf. A “power of attorney” is not an actual attorney or person. If a power of attorney is durable, that means it remains in effect if the person becomes incapacitated due to illness or an accident. A power of attorney expires if a person becomes mentally incompetent, while a durable power of attorney includes special wording that makes it effective even if that happens.
In Nebraska, a Power of Attorney is related to property and money and does not authorize that person to make health care (nor research) decisions. Whereas a Power of Attorney for Health Care is its own type of designation and it can be included in a durable power of attorney, or in any other form if it fully complies with Nebraska Revised Statutes.
Investigators should be careful not to confuse a potential participant’s capacity with competence. Capacity is an individual’s ability to make an informed decision. Competence is a legal state, not a medical one, and refers to the degree of mental soundness necessary to make decisions about a specific issue or to carry out a specific act. All adults are presumed to be competent unless adjudicated otherwise by a court.
Other Related Terms:
- Power of Attorney (per Nebraska Revised Statute 30-3401)
- Power of attorney authorizes another person (your agent) to make decisions concerning your property for you (the principal). Your agent will be able to make decisions and act with respect to your property (including your money) whether or not you are able to act for yourself. The meaning of authority over subjects listed on this form is explained in the Nebraska Uniform Power of Attorney Act. This power of attorney does not authorize the agent to make health care decisions for you.
- Power of Attorney for Health Care (per Nebraska Revised Statute 30-3402)
- A power of attorney executed in accordance with sections 30-3401 to 30-3432 which authorizes a designated attorney in fact to make health care decisions for the principal when the principal is incapable
- Also, per Nebraska Revised Statute 30-3404, The power of attorney for health care shall (1) be in writing, (2) identify the principal, the attorney in fact, and the successor attorney in fact, if any, (3) specifically authorize the attorney in fact to make health care decisions on behalf of the principal in the event the principal is incapable, (4) show the date of its execution, and (5) be witnessed and signed by at least two adults, each of whom witnesses either the signing and dating of the power of attorney for health care by the principal or the principal’s acknowledgment of the signature and date, or be signed and acknowledged by the principal before a notary public who shall not be the attorney in fact or successor attorney in fact.
- Finally, per Nebraska Revised Statute 30-3408, A power of attorney for health care may be included in a durable power of attorney drafted under the Nebraska Uniform Power of Attorney Act or in any other form if the power of attorney for health care included in such durable power of attorney or any other form fully complies with the terms of section 30-3404. (3) A power of attorney for health care executed prior to January 1, 1993, shall be effective if it fully complies with the terms of section 30-3404.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #5.005 Research Involving Persons with Impaired Decision-making Capacity
- 2018 Policy #5.005 Research Involving Persons with Impaired Decision-making Capacity
Additional Guidance and/or External Resources:
- AAHRPP Tip Sheet #26, “Reviewing Research Involving Adult Participants with Diminished Functional Abilities Related to Capacity to Consent”
- NIH Guidance, “Research Involving Individuals with Questionable Capacity to Consent: Points to Consider (November 2009)”
Lincoln Public Schools (LPS) Approval Processes
The University of Nebraska – Lincoln (UNL) and the Lincoln Public Schools (LPS) District have a long standing relationship and commitment of working together to achieve classroom success for all students, including the use of research to learn how to increase those successes. One important step in advancing research within the LPS District is to ensure all the correct approvals and permissions are obtained before any work (including access to buildings) begins.
The key information section gives a general overview, while the guidance document below will provide specific information regarding requirements, restrictions, and step-by-step instructions on how the UNL Institutional Review Board and the LPS Office of Assessment and Evaluation has worked together to streamline the approval process for research conducted within the District.
Key Information:
- All projects, including class projects, must be reviewed by the LPS District through the Office of Assessment and Evaluation prior to conducting any procedures within the LPS District and/or with LPS students, staff or faculty regardless of the UNL IRB review requirement. If your project does not require UNL IRB review, which most class projects do not, please contact the LPS Office of Assessment and Evaluation directly to inquire about the review and approval process.
- All projects being conducted within a LPS associated program (before or after school) will require review and approval by the LPS District through the Director of Assessment and Evaluation.
- Projects requesting to recruit directly through LPS require approval by the LPS District through the Office of Assessment and Evaluation.
- Research, including recruitment, cannot begin until the fourth week of school.
- No new research, including recruitment only protocols, can start during the fourth quarter.
- Ongoing research should try to avoid new data collection during the fourth quarter. Please review the LPS calendar for specific dates.
- All research projects that require UNL IRB review and LPS District review are reviewed through NuRamp.
- A background check may be required.
- A form of student assent will be required.
- Compensation during contract/school hours is restricted.
- Food items are restricted based on federal requirements.
UNL and LPS Guidance for research requiring both UNL IRB and LPS District review:
- UNL/LPS Research Review and Approval Steps – This guidance describes the steps all UNL researchers must take in order to receive approval through the UNL IRB and LPS District if your project involves human subjects. Please read this guidance document carefully as there is important information regarding dates, submission requirements and miscellaneous personnel requirements including background check requirements and building access.
- Lincoln Public Schools Guidelines for conducting research within LPS – this guidance describes requirements overseen by Lincoln Public Schools to conduct research within the District.
Multi-Site Research
For more information about Multi-Site Research, please visit our Single IRB (sIRB) | Reliance Agreements webpage.
National Institutes of Health (NIH) Proposal Requirements – Human Subjects
This guidance has been created to assist researchers in meeting the new 2018 NIH funding submission requirements. It does not address every aspect of the proposal questions that focus on human subjects research, rather, it is meant to help address the questions or requirements that the NIH has changed or required further clarification at the time of proposal.
We have also created language to assist PI’s in communicating dissemination plans and IRB policy requirements regarding clinical trial related questions that appear in the grant proposal.
*NOTE: Please remember that age of majority in Nebraska is 19 y/o. Thus, those younger than 19 are considered to be children and your project and IRB determination must address the vulnerable population information in the proposal if children are included.*
UNL Guidance and/or Resources:
Program Evaluation vs. Evaluation as Research
It can be difficult to discern between Program Evaluation and Evaluation as a form of research. These terms are used interchangeably. The differences may be subtle, but are especially important considering IRB approval is only necessary when a project meets the definition of both human subjects and research. Varying disciplines may have different definitions for program evaluation, evaluation, as well as research. The UNL IRB refers to U.S. Health and Human Services Office for Human Research Protections (OHRP) and The Centers for Disease Control and Prevention (CDC) for guidance to ensure consistency across project determinations.
Key Information:
- OHRP defines research as, “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.” By definition, this includes evaluation. Additionally, OHRP recognizes that things like quality improvement activities (program evaluation) are typically not seen as research subject to human subjects regulations. However, there are some cases where these activities are “designed to accomplish a research purpose as well as the purpose of improving the quality of care,” and in these cases, the regulations for the protection of subjects in research may apply.
- The CDC recognizes evaluation as a broad term that can be defined as research; and while program evaluations are a subset of evaluations, by their definition, they are generally not research. To help further clarify, the CDC Policy Distinguishing Public Health Research and Public Health Nonresearch states:
- “When the purpose of an evaluation is to test a new, modified, or previously untested intervention, service, or program to determine whether it is effective, the evaluation is research. The systematic comparison of standard or nonstandard interventions in an experimental-type design is research. In these cases, the knowledge gained is applicable beyond the individual, specific program. Thus, the purpose is to generate new knowledge or contribute to the knowledge in the scientific literature. Further, it is intended to apply the knowledge to other sites or populations.”
- “When the purpose is to assess the success of an established program in achieving its objectives in a specific population and the information gained from the evaluation will be used to provide feedback to that program, the evaluation, referred to as program evaluation, is nonresearch. In the nonresearch scenario, the evaluation is used as a management tool to monitor and improve the program. The evaluation activity is often a component of the regular, ongoing program. Information learned from the evaluation has immediate benefit for the program or the clients receiving the services or interventions. Interventions and services that are evaluated are never experimental or new; they are known (either from empirical data or through consensus) to be effective.”
Contact the IRB to assist with any decisions regarding whether or not a project is Program Evaluation. If an official decision is needed from the IRB, please submit a Determination Form via NuRamp.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #3.001 Investigational Activities Requiring IRB Review and Approval
- 2018 Policy #3.001 Investigational Activities Requiring IRB Review and Approval
Additional Guidance and/or External Resources:
- Centers for Disease Control and Prevention Program Performance and Evaluation Office
- Office for Human Research Protections Quality Improvement Activities
- CDC Policy Distinguishing Public Health Research and Public Health Nonresearch
Privacy vs. Confidentiality
The ideas of privacy and confidentiality are often used interchangeably, but it is important to understand that they are two distinct aspects of human subjects research. While privacy is specific to the person, confidentiality relates to the person’s data, records, or personal information. For IRB approval, as written in 45 CFR 46.111(a)(7), federal regulation stipulates the need for “…adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.”
Privacy relates to the participant as a person and their physical privacy. Maintaining a participant’s privacy could include: | Confidentiality is the protection of participant data from unauthorized disclosure. Protecting confidential participant data could include: | |
• obtaining consent in a private office (not in a busy reception area) | • storing documents in a locked file cabinet or on a secure server | |
• leaving general messages on answering machines (not specific to the research) | • making sure only research team members have access to contact information, interview, and survey responses | |
• making social media post “unshareable” or not tagging someone in a social media post. | • deleting audio/video recordings as soon as transcription has been completed, when possible and no longer needed | |
The privacy of participants is addressed under the Description of Participants section of the new project form. | The confidentiality of the data is addressed in the Confidentiality & Data section of the new project form. |
Note: While both privacy and confidentiality are part of the criteria for approval, informing participants of the ways in which their data will be kept confidential is one of the required elements of consent. Section 45 CFR 46.116(b)(5) of federal regulation states that informed consent must include “A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.”
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- 2018 Policy #9.001 Required Elements for Informed Consent Documents
- Research Data & Security Guidance Topics (A-Z)
Research Records Best Practices
This guidance discusses the best practices for investigators to ensure quality research records and data integrity, in both paper and electronic formats.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #3.013 Research Records Retention and Security
- 2018 Policy #3.013 Research Records Retention and Security
UNL Guidance on research records best practices:
Re-Consenting/Re-Assenting Participants
Obtaining informed consent/assent is an ongoing process, not simply a document signed by the participant during enrollment in the research. To ensure the voluntary nature of participation in research, and to exhibit respect for the individual, as noted in 45 CFR 46.116(c)(5), there are times when participants must be provided new information when changes are made to the research that could affect their continued willingness to participate. The following guidance provides information on when re-consent might be necessary and the methods by which re-consent could occur.
Key Information:
- Minor updates to consent forms typically do not require re-consent and can be verbally explained to participants when appropriate.
- Significant changes to the protocol, including, but not limited to, a change in duration of the study or a major modification in methods being used, would likely require re-consent/assent for those subjects still participating in the research.
- The re-consent/assent process can occur verbally (either in-person or via telephone/Zoom), through revised consent/assent documents, or via an addendum to the consent/assent form.
- Regardless of whether re-consent is verbal or written, it should be documented in the research record.
The following are examples provided by the Office for Human Research Protections of circumstances where a participant’s continued willingness to participate in the research may be affected. These include, but are not limited to:
- Identification of new research-related risks.
- An increase in the frequency or magnitude of previously described risks (e.g., serious cardiac event, severe allergic reaction).
- Unanticipated problems that expose subjects to new risks, such as a data breach.
- A decrease in expected benefits to participation (e.g., limited efficacy of experimental therapy).
- A change to the research that results in increased burden and/or discomfort.
- Availability of new alternative therapies or treatments.
In these circumstances, participants, both current and future, must be notified. The method of notification must be approved via a change request submitted through the approved IRB protocol. Depending on what phase the project is in, as well as the potential severity of the circumstances, the following approaches may be used:
- Minor updates to consent forms typically do not require re-consent and can be verbally explained to participants when appropriate. For example, these notifications can take place at the next planned interaction with the subject.
- If participants have not yet been recruited, a full revision of the informed consent form is necessary.
- Changes that have the possibility of increasing risk to participants or could affect an individual’s willingness to participate should be communicated as soon as possible to participants already recruited via an addendum, and the informed consent form should be revised to include these changes and used with participants who have not yet been recruited.
- Once recruitment is completed and the intervention begins, participants should be notified verbally as soon as possible and should also be asked to sign an addendum explaining these new risks to indicate their willingness to continue.
- Any addendums signed by participants should be maintained as part of the research record and kept in alignment with the IRB-approved data storage plans for the project.
- For projects with a waiver of consent documentation, the requirement of a signed addendum can be waived as well if it would not be practicable to obtain signatures. However, participants should still be informed, if possible.
- The IRB maintains the right to request that a full re-consent procedure with a fully revised informed consent form be completed to ensure participant understanding when the changes are significant enough.
An addendum document should note the following information, at minimum:
- The project the addendum applies to, and the contact information of the investigators involved in the project in case participants have questions.
- A description of the purpose of the addendum as well as a list of what study procedures are being changed.
- A statement that the terms of the original consent form remain in full effect.
- A consent statement with signature and date lines or a statement that notes that consent is implied by continued participation, if the project has received a waiver of consent documentation.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- 2018 Policy #9.003: Telephone Consent
- 2018 Policy #9.004: Re-consent/Assent Research Participants
- 2018 Policy #9.005: Absence of Valid Consent: Re-Consent and Use of Data
Additional Guidance and/or External Resources:
Recruitment/Advertising
Forms of recruitment/advertisements can take on many modes and vary greatly depending on the specific project or goals of the research. Recruitment could be completed through fliers in the student union or departmental bulletin boards, newspaper, radio or television ads, direct mailings, email announcements, website postings, press releases, social media postings, brochures, postcards and verbal scripts, to name a few.
Key Information:
- Per human subjects regulatory requirements at 45 CFR 46, the UNL IRB is required to review and approve recruitment material/advertisements prior to use in order to ensure the protection of human subjects, equitable selection of subjects, and ensure the advertisements are free from coercive information or language.
- For Exempt projects only, the UNL IRB no longer stamps informed consent or recruitment documents. This means that members of our University and community could see documents (recruitment fliers posted on bulletin boards, etc.) that do not have an IRB approval stamp on them, if the project is certified as Exempt. If the document was revised based on a change made for an exempt project, the IRB may not require review, approval and stamping of the document. However, the specific document should still be appropriate for the project and should still be written in consideration of the “Dos and Don’ts” below.
- When using recruitment material/advertisements DO:
- Spell out acronyms
- Consider readability for communicating with the public
- Make updates to keep information current
- Provide balanced information
- Provide accurate information in alignment with the approved protocol
- When using recruitment material/advertisements DON’T:
- Use coercive or overly inductive content (threatening scenarios, glowing testimonies, overly positive or negative photos/images)
- Overemphasize payment (use larger/bolder font to call out remuneration amount)
- Use font or script that is difficult to read
- Post or utilize the advertisement without IRB approval (most will be stamped after approval)
- Use endorsements from other entities outside the NU system
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #3.016 Recruitment of Participants Through Advertisements
- 2018 Policy #3.016 Recruitment of Participants Through Advertisements
UNL Guidance related to recruitment and advertising:
- While researchers are NOT required to use them, the UNL IRB offers the following templates:
- If needed, see also our guidance on Exempt Research for more information
Secondary Information and Biospecimens: Use in Research and IRB Applicability
The following guidance utilizes terminology that can be found in our Data Identifiability Definitions A-Z guidance.
Research utilizing secondary information and/or biospecimens that were previously collected for research or non-research purposes and will now be used in the proposed research study may require IRB approval. Determining whether IRB review and approval of research involving secondary information and/or biospecimens is required is dependent on the availability or access to identifiers (directly or indirectly) and can be complicated. If you do not find an answer to your question in the below information, please contact an IRB coordinator.
Research utilizing secondary information and/or biospecimens may or may not be considered human subjects research. To determine whether or not IRB approval is necessary, you must first determine how the information and/or biospecimen is stored with respect to access to identifiers. Information and/or biospecimens are either de-identified, coded, or identifiable.
Key Information:
- A few questions to ask yourself when trying to decide if IRB approval or other agreements are necessary:
- How was the information and/or biospecimen originally collected?
- If a colleague originally collected the information and/or biospecimen, are they providing it to you with any restrictions? Did they collect the information and/or biospecimen under an IRB approved protocol?
- Are there sponsor, contractual or institutional restrictions on the use of the information and/or biospecimen?
- Is the information and/or biospecimen identifiable, coded, de-identified, or anonymous?
- Does the organization/agency that holds the information and/or biospecimen require IRB approval?
- Did the informed consent form that was originally signed by the participants allow for the sharing of the information and/or biospecimen?
- Is a Materials Transfer Agreement (MTA) or Data Transfer and Use Agreement (DTUA) required?
- Generally, the need for an MTA and/or a DTUA is at the direction of the organization providing the materials (e.g., usually biospecimens) and/or data, governed by their policies and procedures, and that organization is responsible for executing the agreement. If you are a UNL investigator receiving materials and/or data from another organization, be sure to ask if any agreement is required that governs the acquisition, storage, and use of the materials and/or data (e.g. where you can store the data, for how long, any publication restrictions, etc.).
- Investigators must inform the IRB if materials and/or data will be acquired and used in their human subjects research within the IRB New Project Form (Section 4) or a change request form, as applicable.
- If you are a UNL investigator sharing identifiable materials and/or data outside of the institution and your IRB approved research team, the same considerations should be afforded. Oftentimes, outgoing DTUAs are highly customized and require additional time to negotiate. Investigators should consider this additional time when working to meet specific project deadlines.
- If your research requires a DTUA please contact the Office of Sponsored Programs Awards Coordination Team at: UNLOSPAwards@unl.edu.
- If your research requires an MTA, please visit the NUTech Ventures website.
- The Federal Demonstration Partnership (FDP) website has helpful information on Data Stewardship including a DTUA Guidance Chart.
Guidance on how to submit a request for secondary analysis of information and/or biospecimen only:
With the above definitions in mind regarding the type of data with respect to identifiability, IRB review and approval is required when conducting research with human subjects (including identifiable information and/or biospecimens).
Only projects that meet the definition of research and human subjects require IRB approval. See the Guidance Topic: Human Subjects Research for specific definitions of research and human subjects. The Human Subjects Regulations Decision Charts are also available through the Office of Human Research Protections to illustrate IRB applicability. If a project does not require IRB approval, investigators are not required to submit an IRB application; however please be aware, IRB approval may not be granted if the research has already started or been conducted and the determination of IRB applicability was made incorrectly by the investigator.
When submitting an application for IRB approval using only secondary information and/or biospecimens the current application might not be as conducive to secondary research. The following tips might be helpful when drafting the application:
- Human subjects research projects must be submitted via NuRamp.
- Any sections that do not seem to apply to the research project because they are related to a primary data collection process should be answered as N/A if the section is an open textbox and is truly not applicable to the research.
- If the answer is a close-ended response (e.g., yes or no), then the question must be answered as best it can.
- Any clarifications that may be necessary regarding an N/A, yes, or no response can be submitted on page nine of the form.
- HRPP office/IRB will determine the appropriate category and review level upon project submission. For more information about review categories and the process, please see Review, Approval, and Post-Approval Requirements.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #8.002 Epidemiological Research Guidelines
- 2018 Policy #8.002 Epidemiological Research Guidelines
- 2018 Policy #8.010 Banking Human Biological Material for Future Research
- 2018 Policy #8.011 Use of Human Biological Material in Research
- 2018 Policy #8.012 Participant Registries and Data Repositories
- Pre-2018 Policy #10.001 Use of Protected Health Information in Research and Registries
- 2018 Policy #10.001 Definition, Description, and Use of Protected Health Information Identifiers
- Pre-2018 Policy #15.001 Human Research Compliance with Department of Education Regulations
- 2018 Policy #15.001 Human Research Compliance with Department of Education Regulations
Additional Guidance and/or External Resources:
- OHRP Guidance: Coded Private Information or Specimens Use in Research (2008)
- Department of Education Family Educational Rights and Privacy Act (FERPA)
- Summary of the HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule
- NIH Guidance: Private Information or Biospecimen Decision Chart
Single Institutional Review Board (sIRB)
For more information about the sIRB process, please visit our Single IRB (sIRB) | Reliance Agreements webpage.
Site Permission Documentation
Site permission documentation is required for both performance sites and for recruitment sites.
- Performance sites are those in which the investigators are using the site services, facilities, or personnel for research study purposes, such as data collection or consent.
- Recruitment sites are those where the investigators are simply providing research study information to individuals and are not considered performance sites.
Key Information:
- Performance Site Permission Documentation Requirements:
- All performance sites must be identified and updated in the NuRamp IRB application.
- Documentation of appropriate performance site permission, also known as site letters of agreement or endorsement, may come in different forms. This documentation is required to be uploaded within the IRB application before you are approved to start work at the site.
- Letters of support received for a grant are generally not considered to be sufficient as site permission documentation.
- The documentation should include acknowledgement of any specifications regarding the site’s own participation in the research project and what access, services, facilities, and/or personnel they are providing for the research project.
- A specific format is not required and may vary among the sites, such as a formal letter on organizational letterhead or a response to an email. A template site permission document for internal and external research sites is available on the Templates/Forms webpage.
- Email documentation should be legitimate. In other words, we will not accept the email copied and pasted into a Word document. The email should be uploaded as a PDF and include the appropriate signature line, title, and/or credentials of the signatory official/site administrator.
- Sometimes a permission letter might not suffice based on the collaboration between a research team and an external organization. In these cases, legal agreements may be needed depending upon the role of the organization.
- Recruitment Site Permission Documentation Requirements:
- Recruitment site permission documentation is expected to be obtained by the research team through appropriate mechanisms and stored by the research team within the research records.
- Depending on your recruitment plan that engages certain UNL offices, including offices within Student Affairs, recruitment permission documentation may be required prior to IRB approval.
- If Lincoln Public Schools (LPS) is a performance or recruitment site for the project, please see the Lincoln Public Schools (LPS) Approval Processes.
- If Barkley Speech Language and Hearing Clinic (BKC) is a performance or recruitment site for the project, you must provide an official permission letter from the BKC Director.
- If the UNL Athletic Department is a performance or recruitment site for the project, you must provide official permission documentation from the appropriate individual within the Department of Athletics. It is recommended to begin discussions with the Director of Nebraska Athletic Performance Lab (NAPL) to help navigate the correct permission route.
UNL HRPP Policies and External Resources for Site Permission Requirements:
- Pre-2018 Policy #3.003 Initial Application Submission, section 3.4
- 2018 Policy #3.003 Initial Application Submission, section 3.4
SMART IRB
For more information about SMART IRB and the Single IRB process, please visit our Single IRB (sIRB) | Reliance Agreements webpage.
Social Media
These types of platforms allow the user to share and consume information across their social network(s) and to join, create, and participate in a variety of groups or online communities. Examples of different social media sites include: Facebook, LinkedIn, Google+, Vimeo, Twitter, Digg, Flickr, and Pinterest.
*NOTE: The following information has been developed in reference to National Institutes of Health resources on Social Media and also with consultation and review from a UNL IRB sub-committee on Social Media.*
Key Information:
Use of social media is an important and somewhat new tool in conducting research involving human subjects (recruitment, data mining etc). However, it should be noted that use of social media in research is much different than the other tools frequently used such as printed advertisements, posters, or radio/television ads. Information contained in non-social media tools are typically controlled text or in a template format that does not allow for a great deal of variation.
Social media tools, on the other hand, allow for greater manipulation and variation of context, information, and how audiences or individuals are targeted to receive research information. With this in mind, the UNL IRB does not want to hinder or restrict research involving the use of social media but does require further details in the project application regarding the plan for use of social media in a given project.
Depending on the project parameters and how social media will be used (i.e., recruitment only vs. data collection), the PI will be asked to detail or consider some or all of the following within the IRB application:
- Investigators are not permitted to accept “friend requests,” nor “friend” others.
- Provide a description of the general message that will be sent to potential participants.
- What specific information is going to be collected?
- Demographic information?
- Status updates?
- Pictures?
- How is the information going to be collected?
- How is the information going to be used?
- What is the usefulness of this data collection method?
- Why is use of social media important for this research (scientific justification)?
- What are the strategies for maintaining participant confidentiality?
- How will third party information be handled?
- Consider access to public profiles vs. private profiles
- How will participant informed consent be gained?
- Will third party participants be informed of the research?
- If so, describe the procedures that will be followed.
- What is the length of time that will be needed for proper data collection, (e.g. two weeks, one month, six months)?
- Will minors be included in the data collection? (In the state of Nebraska, age of majority is 19 years).
- Description of any experimental design features that will be utilized.
- What is your typical access to this population and data?
- Could this population and data be accessed by other methods?
- Is there an alternate research design that wouldn’t use social media sites?
- Is social media being used as a recruitment method?
- Is this data being used as a secondary data set?
Additional Guidance and/or Resources:
The National Institutes of Health also provides the following questions to use as a guide when planning to use social media as a tool to conduct human subjects research:
- Have I considered the full implications of privacy in this new and less-controlled environment?
- The Principal Investigator (PI) and Institutional Review Boards (IRB) should assure the procedures followed adequately protect the rights and welfare of the prospective subjects as well as the accuracy of information for decision making standards.
- I need to carefully consider how my materials will be used.
- Although there has been a historic division between ads that are “purely informational” and “recruitment” ads, in the social media environment, this is much harder to distinguish and monitor. The outreach itself to groups or individuals with disease-specific interest may already allow for intrusion into personal privacy and result in disclosure of personal medical information not only to the PI but others.
- Have I controlled my informational data in a locked format?
- With interactive media, the location of the information is not static — (as it is in printed posters, flyers, web sites), so it is recommended that this information be provided in a controlled pdf, or other locked format, for distribution.
- Have I made the contact for further information site protected for the privacy of interested individuals?
- Any contact information (such as a web mailbox) should bring the interested person behind a security wall for any further information exchange.
- Do I clearly understand that the interactive nature of social media escalates the speed of interaction, allowing for greater opportunities for errors in protecting private information? Have I planned to obviate those errors?
- Have I accounted for problems related to the portability and secure handling of information, including the encryption of all government laptops, the encryption of sensitive information during transport, including but not limited to transport across the network or on portable media, and the reporting of unintended breaches of sensitive personal information in the government’s possession?
- Have I included my complete strategy for use of the social media and my strategies for protection of privacy and strategies for informed consent explicitly in my proposal to the IRB?
- Have my team and I clearly understood the invasive nature of joining groups (i.e., support groups, disease groups, advocacy groups, etc.) for the purpose of recruitment?
Students as Research Participants in the Classroom Environment
Students as research participants, in the classroom environment, introduce unique challenges depending on who is conducting the research, how recruitment occurs, and what information will be used and/or collected. Instructors, other researchers, and even other students could be conducting research in the classroom. The following is intended to provide items to think about when designing research in the classroom. Students as research participants could be participating as (a) members of a specific class in which the instructor or researchers are assessing learning process and outcomes from the class, or (b) as a convenient sample to collect data on a study not related to the specific class.
Other related term(s):
- Undue Influence
- The Office of Human Research Protections defines undue influence as an offer of an excessive or inappropriate reward or other overture in order to obtain compliance. For example, an investigator might promise psychology students extra credit if they participate in the research. If that is the only way a student can earn extra credit, then the investigator is unduly influencing potential subjects. If, however, she offers comparable non-research alternatives for earning extra credit, the possibility of undue influence is minimized. In addition to undue influence that can arise with the offering of rewards, undue influence also can be subtle. For example, patients might feel obligated to participate in research if their physician is also the investigator, or students might feel pressure to participate in research if everyone else in the class is doing so.
- Coercion
- The Office of Human Research Protections defines coercion as an overt or implicit threat of harm is intentionally presented by one person to another in order to obtain compliance. For example, an investigator might tell a prospective subject that he or she will lose access to needed health services if he or she does not participate in the research.
Key Information:
When the instructor is also the researcher, unique challenges exist in protecting the student participants. Faculty are in a position of authority. Students might feel pressured to enroll in the study simply because their professor is the researcher, or because their peers are participating. In these circumstances, undue influence could be perceived, even if it is unintentional. Following are items to think through and include in the research proposal and/or informed consent documents.
- Recruitment:
- Recruitment should be done by someone other than the instructor. If the Principal Investigator (PI) is the instructor, but the Co-Investigator(s) or Secondary Investigator (SI) as named in NuRamp, is not involved in the course (teaching and/or grading), the SI could be the individual who recruits, obtains consent, and collects data when necessary and vice versa. The PI could conduct these activities if the SI is the instructor.
- If both the PI and SI are involved in teaching and grading the course, then an outside neutral party should complete these activities. This could be another faculty member, a graduate assistant, someone in the department office, etc.
- Even if data is collected anonymously, someone else should still announce the research.
- In certain cases where the researcher is also the instructor, the instructor should not be present during consent or data collection as well. This would be comparable to how course evaluations are administered. If the evaluation is not administered electronically, the instructor leaves the room, students complete the evaluation, and place the evaluation in an envelope. Someone else (possibly the student) then delivers the completed surveys to the department office. This process should minimize any potential undue influence and/or coercion.
- Many research opportunities are now posted on-line. When announcing opportunities, instructors who are PIs should make sure students know of all the various research opportunities available to them
- Consent:
- When possible, the identity of those who consented/did not consent should be protected until after the semester is over and grades are submitted. The individual who is recruiting and obtaining consent should store the signed informed consent documents until after grades are submitted. At that point, the signed documents can be provided to the PI/SI/instructor. If data is collected online, PI/SI/Instructor should not have access to who participated in their particular study until after grades are completed or participation credit should be provided to instructors without them knowing specific studies completed by students.
- There are cases where this is not possible. In some research, the person who is the instructor/researcher needs to know who the participants are prior to the end of the semester. In these cases, the project should explain how the participants will be protected from coercion and/or undue influence. For a student population, their biggest concern might be how their decision to participant/not to participate could impact their grades.
- There are cases where the students would be most protected when signed informed consent is not obtained. This will greatly depend on the data collected for the project. For example, if the research involves the collection and use of private identifiable information covered under the Family Educational Rights and Privacy Act (FERPA), signed consent must be obtained.
- Extra credit and research credit opportunities:
- Extra credit opportunities may or may not be included in the syllabus. The points awarded for extra credit would not be included in the amount of points available in the course. Research credit would be included in the syllabus. Students would need to complete the research credit as part of the course. These points would be a part of the overall total points available in the course. The rest of this section will refer to ‘credit’ as the two opportunities are similar.
- Credit opportunities should not create a situation where student participants are unduly influenced to participate. For example, to a student who is failing a course, the offer of 200 points for participating in research when the total class points equal 400 points could unduly influence the student. UNL HRPP Policy 5.006 titled, “Research Involving Extra Credit Compensation” indicates that the amount should be no more than 2% of the overall course grade.
- Participation in research should be voluntary. Students should not be forced to complete a specific study in order to earn the credit. When subjects pools are used, other research opportunities should be available to the students. Also, non-research opportunities should be available for students to earn credit without participating in research. For example, students who do not want to participate in research could submit a 1-page research paper as the alternative.
- Non-research opportunities should be equal in time and effort to participating in the research. If this is not possible, non-research opportunities should take less time and effort.
- When needed, the instructor could be given a list of names so that credit can be awarded. However, they should not be told if the person consented to the research or if they completed an alternative activity.
- Use of classroom activities, grades, etc.:
- The research might include the use of classroom activities, grades, etc. without any additional effort on the part of the students. This should be made clear in both the NuRamp new project form (e.g., IRB application) and the informed consent document.
- The informed consent document should also be clear if the student must complete certain activities for the class but can opt out of having their data used in the research. Students must be given the opportunity to say no to the research component to ensure voluntary participation.
- It could be that a combination of course activities and non-course-required activities will be used in the research. If this is the case, it needs to be made clear in the informed consent document what is required for class and what activities are not part of the course requirements. This information needs to be included in the NuRamp new project form as well. Please be aware, the IRB as part of their review, may request to review the course syllabus as supplementary material and/or for documentation purposes.
- If the research involves the collection and use of private identifiable information including grades, demographic records obtained from student transcripts, records via Canvas, and other records available via Student Information Systems that would be considered covered under FERPA, signed consent will be required.
- Students in the classroom environment may be recruited to participate in research that is not related to the course:
- If the research is directly related to the course, the research may qualify for Exempt Review under category 1. UNL HRPP Policy 4.001 titled, “Exempt Research” describes the exemption categories. If this is the case, minors can be included in the research without obtaining parental consent or requesting a waiver of parental consent.
- If the research is not directly related to the course, the additional requirements of parental consent or waiver of parental consent may need to be met.
- If the research is not course related, but will be conducted during class time, please consider the following:
- Will students miss any instruction time while completing the research activities? If so, what will they be missing?
- Please note: This may be a consideration when conducting the research in K-12 schools but might not be a concern when participants are students in a post-secondary classroom given the differences in environments and coursework and/or instructional delivery practices (e.g., Synchronous vs. Asynchronous virtual instruction).
- If a survey is distributed during class time, a suggestion is that all students return a survey. Those who do not want to participate can return the survey blank. This will prevent the student from disclosing that they are/aren’t participating based on whether or not they return the survey. It will also minimize the coercion and/or undue influence to participate.
- When the instructor is not part of the research team, the instructor may be responsible for managing any alternative activities to earn the credit. They may be given the completed alternative activity to enter credit for completion.
- Miscellaneous Considerations
- Course instructors, if they are also conducting the research, should not be present during the recruitment/consent process or data collection when at all possible.
- Course instructors, if they are also conducting the research, may not use classroom artifacts, grades, or other institutional data without permission. Appropriate access to student information for non-research purposes does not equate to permission to use it for research purposes.
- When the researcher is not the course instructor:
- The researcher could recruit, consent, and collect data.
- Considerations for opportunities for credit as described above must still be implemented.
- When the researcher is not the course instructor:
- FERPA-regulated data that are requested from the Registrar’s office can only be provided to University Faculty and Staff (including post-doctoral positions) as authorized officials. Please be aware, the Registrar might not release identifiable records (other than public directory information) about students to other students (TA’s, graduate research assistants, undergraduate research assistants) and other arrangements may be necessary if the data request is for a student project. For more information, please refer to the FERPA A-Z Guidance.
- Participants could be compensated or provided with an incentive other than credit. These need to be explained as well.
Regardless of what procedures are used, student participants need to understand and feel comfortable that they can decline participation and their grade will not be impacted.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Policy #4.001 Exempt Research
- Policy #5.006 Research Involving Extra Credit Compensation
- Policy #15.001 Human Research Compliance with Department of Education Regulations
Additional Guidance and/or External Resources:
Terms and Conditions (Outside Entities)
Research projects involving human subjects can often involve interactions with external entities (companies, institutions, or websites) outside of the University of Nebraska (NU) system. If a proposed project is being reviewed by the IRB that could potentially violate the Terms and Conditions of an outside entity, the UNL IRB will review the request, in consultation with NU General Counsel’s Office, and determine whether or not the project can move forward as proposed. Terms and Conditions (T&C’s) is language that is included in a contract or agreement that stipulates what a user/person can and cannot do and what the entity can and cannot do.
It is not the practice of the IRB to approve projects that violate the Terms and Conditions of another entity.
Other Related Term(s):
Also referred to as Terms of Service (TOS).
Examples:
- The T&C’s of a university library stipulates a maximum amount of research article archives that can be downloaded by a single user. A user downloads more archives than permitted and is considered to be in breach of contract.
- The TOS of a website stipulates fake accounts cannot be created. A user creates a fake account for research purposes and is considered to have violated the TOS of the website.
Tips for Student Researchers
Students often complete projects that involve human subjects research through, for example, a capstone, thesis, or dissertation which require IRB approval. The below information is intended to provide basic steps and assistance for student researchers to accomplish their project(s) in the time allotted. Please remember that class projects typically do not require IRB approval because they do not meet the regulatory definition of research at 45 CFR 46.102.
Please review the topics available through the IRB website drop down menu to find further information regarding definitions, when IRB review and approval is required, and what review categories are applicable (Exempt, Expedited, Full Board).
Key Information:
- The overall IRB review process for students does not deviate from the normal process followed for faculty or staff projects requiring IRB review. Each student researcher is expected to follow all current IRB policies and procedures for IRB initial approval, continuing review, change requests, and other project matters.
- Students are allowed to function as the Principal Investigator (PI) and may be listed on the application/protocol as the PI. However, a UNL faculty member-advisor must provide appropriate oversight of the project and be listed as the Supervising Investigator (i.e., Secondary Investigator as described in the IRB application).
- While the PI listed for an IRB project typically assumes overall responsibility, it is the Supervising Investigator’s responsibility to supervise the project and provide necessary advice regarding the design and conduct of the study along with advising on applicable IRB requirements and federal regulations. Faculty who assign or supervise research conducted by students or staff have an obligation to consider carefully whether those individuals are qualified and have the training to adequately safeguard the rights and welfare of participants.
- In addition, the IRB recognizes the time constraints associated with student projects that must begin and be completed within a single semester. While the IRB will make every effort to work with students and Supervising Investigators to process review and approvals promptly, it is recommended that those submitting for IRB approval, plan for and allow adequate time for the review process (anywhere from 2 weeks to two months depending on the project parameters, review type (Exempt vs. Expedited vs. Full Board) and adequacy of the submission).
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #3.008 Qualifications and Responsibilities of Research Personnel
- 2018 Policy #3.008 Qualifications and Responsibilities of Research Personnel
- Pre-2018 Policy #8.001 Students as Researchers
- 2018 Policy #8.001 Students as Researchers
UNL Guidance for IRB Approval:
- Identify a Supervising Investigator. Typically this is the Committee Chair, but every department might be a little different as to who may qualify for the role as a Supervising Investigator on the IRB application.
- Meet with your Supervising Investigator to formulate your research question and study design.
- This could include development of survey questions, survey instruments, and interview questions, identifying your subject population, recruitment strategies, and data analysis plans. *NOTE: while IRB staff are happy to help clarify what information is required for IRB approval, it is not the staff’s responsibility to assist in the design of your project. This should be developed in conjunction with your advisor and/or Supervising Investigator/committee.
- Begin your IRB application in NuRamp (URL: https://nuramp.nebraska.edu/), the electronic research system at UNL.
- You are required to submit specific information regarding the project including site information on where you will be performing the research, specific site approval letters, as applicable, informed consent documents, recruitment materials such as flyers, posters, ads, and specific survey/interview/focus group questions. Templates are available on the Templates/Forms IRB webpage.
- Complete online human subjects CITI training. (This must be completed prior to receiving IRB approval.)
- Review the UNL IRB webpage Review, Approval and Post-Approval Requirements for detailed, step-by-step instructions on how to submit an application, what happens during a review, after approval, and investigator responsibilities after approval.
Waivers of Consent
The following guidance is written using the Revised Common Rule under the 2018 Requirements. If your research is ongoing under the Pre-2018 requirements and has either been granted a waiver, or will request one in the future, please refer to the Pre-2018 Requirements policy linked below.
For non-Exempt (i.e., Expedited or Full Board) human subjects research projects, there may be circumstances where a research project calls for a waiver of consent or consent documentation. In these circumstances, federal regulations at 45 CFR 46.116 allow the IRB to approve a consent procedure that omits some, or alters some or all, of the elements of informed consent, and the federal regulations at 45 CFR 46.117 allow the IRB to waive consent documentation requirement of obtaining a signed consent form.
Key Information:
The IRB has the authority to grant three types of waivers:
- Waiver of the informed consent process altogether, including child assent, participant consent, or parental consent;
- Waiver or alteration of an element of informed consent such as the purpose of the research if the project involves a form of deception or the duration of participation; and/or
- Waiver of consent documentation (i.e., signature).
A waiver is not a type of document for participants to sign; rather in the context of IRB review of research involving human subjects, a waiver refers to a decision made by the IRB to allow the researcher to not obtain consent or alter consent elements.
If your research proposes to waive or alter consent, justification meeting certain criteria is required. In accordance with 45 CFR 46.116(f)(3)(i-v), to qualify for a Waiver or Alteration of Consent, your research must meet all of the following requirements, as applicable:
- The research involves no more than minimal risk to the subjects.
- The final decision regarding whether or not your project is minimal risk is made by the IRB; however, in preparation or planning for submission of an IRB application and a request for a waiver, minimal risk is defined at 45 CFR 46.102(j) as “The probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.”
- In general, all projects reviewed using the Expedited method of review must meet the definition of minimal risk.
- The research could not practicably be carried out without the waiver or alteration.
- “Practicably” is defined by the Merriam-Webster dictionary as “capable of being put into practice or of being done or accomplished.” Please note that this is not the same as “practical.”
- A scientific justification may be necessary to explain why the research would not be feasible, or would be compromised, if informed consent or elements of consent were required. Consider the scientific validity of the research based on the methodology and generalizability of the research and whether the objectives and aims of the research would be compromised if informed consent or an element of consent were required. For projects where the justification is to intentionally deceive a participant, all requirements as related to Deception are required to be met.
- While it may be easier or faster to conduct your research if consent or certain elements of consent were waived, a waiver will likely not be granted solely for the purpose of convenience, cost, or speed.
- If the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format.
- Consider your study procedures when working with identifiable information. What is the purpose of this information? Do you need to keep information identifiable across multiple surveys and/or interviews and/or biospecimens in order to connect them later? Scientific justification based on the study design and/or methodology will be necessary, so consider whether you require identifiable information in order to perform the study.
- The waiver or alteration will not adversely affect the rights and welfare of the subjects.
- Make sure to consider any federal, state, or local laws that provide rights to potential subjects to require informed consent, whether subjects would consider their rights to be violated if they were made aware of the waiver, or if the waiver could have the potential to cause adverse consequences to subject welfare or general well-being.
- Whenever appropriate, the subjects will be provided with additional pertinent information after participation.
- Consider whether your research may require adebriefing process or provide study information to the subject after the research is conducted This may be necessary if the research involves deception or if information is obtained during the study that would directly impact the safety or welfare of the subject.
There also may be circumstances in which your research may qualify for a waiver of consent documentation, or where consent signature may not be required. In these circumstances, in accordance with 45 CFR 46.117(c)(1)(i-iii), the IRB may waive the requirement for investigators to obtain a signed informed consent form when:
- The only record linking the subject and the research would be the informed consent form, and the principal risk would be potential harm resulting from a breach of confidentiality. Each subject (or legally authorized representative) will be asked whether the subject wants documentation linking the subject with the research, and the subject’s wishes will govern.
- The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context.
- For example, if you are doing an online survey, you may have participants press an “I Agree” button, or simply state that by taking the survey you are consenting, in lieu of having participants type their name.
- If the subjects or legally authorized representatives are members of a distinct cultural group or community in which signing forms is not the norm, the research presents no more than minimal risk of harm to subjects, and there is an appropriate alternative mechanism for documenting that informed consent was obtained.
- In these situations, verbal consent is often presented and documented by the investigators in the research records. When considering this criterion, please ensure that the other sections of the protocol fully detail all of the steps that will be taken to ensure that participants understand what is being asked of them and that their consent is clearly confirmed.
Note: Even though participants will not be signing documentation if this waiver is granted, the IRB per 45 CFR 46.117(c)(2) may require the investigator to provide subjects or legally authorized representatives with a written statement regarding the research. This may be in the form of a copy of the consent information or, in the case of online surveys, a statement indicating that participants can print a copy of the informed consent form for their records.
Any of the above informed consent waivers can be requested within the Informed Consent section of the New Project Form via NuRamp.
UNL Human Research Protection Program (HRPP) Policies and Procedures:
- Pre-2018 Policy #9.006 Waiver or Alteration of Consent
- 2018 Policy #9.006 Waiver or Alteration of Consent
Additional Guidance and/or External Resources: