The Catholic University of America

Summary of Federal Laws


Compliance Partners

Associate Provost for Research

Director of Information Security

Related Policy

Protection of Human Subjects in Research

Institutional Review Boards (Federal Policy for the Protection of Human Subjects)

42 U.S.C. § 289; 45 CFR § 46.101 et. seq. (Health and Human Services)

21 CFR 50; 21 CFR 56 (FDA)

 Basic Policy and applicability

Any institution that engages in federally funded research involving human subjects must have an Institutional Review Board (IRB). An IRB is an administrative body established to protect the rights and welfare of human research subjects recruited to participate in research activities conducted under the auspices of the institution with which it is affiliated. The IRB has the authority to approve, require modifications in, or disapprove all research activities that fall within its jurisdiction as specified by both the federal regulations and local institutional policy. The Principal Investigator (PI) must obtain IRB approval before engaging in any human subject research. Research that has been reviewed and approved by an IRB may be subject to review and disapproval by officials of the institution. Institution officials may not approve research if it has been disapproved by the IRB.

45 CFR § 46.101 et seq. contains The Health and Human Services Policy for the Protection of Human Research Subjects which describes in detail the operation of the IRB. This Policy is also known as the Common Rule. The Common Rule is based on federal funding of research and applies to all research involving human subjects conducted or supported by any federal department or agency. The Common Rule also covers research using human specimens, such as cells, blood, tissues, hair clippings, etc. See The NIH web page on Research Using Human Specimens, Cell Lines or Data.

The Food and Drug Administration (FDA) has a separate set of regulations governing human subjects research (- 21 CFR 56 IRBs and  21 CFR 50- Informed Consent). FDA regulations are based primarily on use of FDA regulated products: drugs, devices, or biologics.

Note the definition of *human subject* will change effective 1-19-18 to the following: 

Human subject means a living individual about whom an investigator (whether professional or
student) conducting research:
(i) Obtains information or biospecimens through intervention or interaction with the
individual, and uses, studies, or analyzes the information or biospecimens; or
(ii) (ii) Obtains, uses, studies, analyzes, or generates identifiable private information or
identifiable biospecimens.”

The definition of “identifiable biospecimen” and “identifiable private information” will be re-examined within one year of publication of the rule and every four years thereafter. Broad consent, rather than study specific informed consent may be used for storage and secondary research of identifiable private information or indentifiable biospecimens. See the COGR Common Rule Overview for more on this.

History of the Common Rule

The Federal Policy for the Protection of Human Subjects (Common Rule) was adopted on June 18, 1991 and covers research supported by the Departments of Agriculture, Energy, Commerce, HUD, Justice, Defense, Education, Veterans Affairs, Transportation, and HHS, as well as NSF, NASA, EPA, AID, Social Security Administration, CIA, and the Consumer Product Safety Commission. The January 2017 changes to the Common Rule, most of which are effective January 19, 2018 are the biggest changes to the rule since 1991.The final rule does not extend coverage to non-federally funded clinical trials. 

University of Michigan has an excellent summary of the changes to the Common Rule. 


The rules contained in 45 CFR § 46.101  et seq. are enforced by The Office for Human Research Protections (OHRP). The responsibilities of OHRP include education, compliance oversight, and administration of the Assurances. (see below)


The rule adds to and modifies existing exemptions. For a full listing of all the exemptions see 45 CFR § 46.101 after 1-19-18. 

For a summary of changes to the exemption category see the Univeristy of Michigan summary page. 

For research that includes only interactions involving educational tests, survey or interview
procedures or observation of public behavior, identifiable information can now be used with
limited IRB review and appropriate privacy and confidentiality protections.

Exemptions do not apply to research involving prisoners, fetuses, pregnant women, or human in vitro fertilization or to research involving survey or interview procedures or observation of public behavior involving children except for research involving observations of public behavior when the investigator(s) do not participate in the activities being observed.

Assurances Required (45 CFR § 46. 103)

Any institution engaged in research covered by this law must provide written assurance to each department or agency head that it will comply with the Federal Policy for the Protection of Human Research Subjects. A current assurance on file with the HHS Office for Human Research Protections (OHRP) may suffice in place of individual assurances to each agency. This is known as the "Federalwide" Assurance. When the Federalwide Assurance is used, reports required by the law which must be submitted to the department and agency heads must also be sent to the OHRP.  See the HHS page on FWAs

In addition to the assurance, the institution must certify to the funding agency that the research in question has been reviewed and approved by the Institutional Review Board (IRB) for the school, and will be subject to continuing review by the IRB.

Assurances must include at a minimum the following elements:

1) A statement of principles governing the institution in the discharge of its responsibilities for protecting the rights and welfare of human subjects of research conducted at or sponsored by the institution, regardless of whether the research is subject to federal regulation. This may include an appropriate existing code, declaration, or statement of ethical principles, or a statement formulated by the institution itself. This requirement does not preempt provisions of this policy applicable to department- or agency-supported or regulated research and need not be applicable to any research exempted or waived under § 46.101 (b) or (i).

(2) Designation of one or more IRBs established in accordance with the requirements of this policy, and for which provisions are made for meeting space and sufficient staff to support the IRB's review and recordkeeping duties.

(3) A list of IRB members identified by name; earned degrees; representative capacity; indications of experience such as board certifications, licenses, etc., sufficient to describe each member's chief anticipated contributions to IRB deliberations; and any employment or other relationship between each member and the institution; for example: full-time employee, part-time employee, member of governing panel or board, stockholder, paid or unpaid consultant. Changes in IRB membership shall be reported to the department or agency head, unless in accord with § 46.103(a) of this policy, the existence of an HHS-approved assurance is accepted. In this case, change in IRB membership shall be reported to OHRP.

(4) Written procedures which the IRB will follow (i) for conducting its initial and continuing review of research and for reporting its findings and actions to the investigator and the institution; (ii) for determining which projects require review more often than annually and which projects need verification from sources other than the investigators that no material changes have occurred since previous IRB review; and (iii) for ensuring prompt reporting to the IRB of proposed changes in a research activity, and for ensuring that such changes in approved research, during the period for which IRB approval has already been given, may not be initiated without IRB review and approval except when necessary to eliminate apparent immediate hazards to the subject. 

(5) Written procedures for ensuring prompt reporting to the IRB, appropriate institutional officials, and the department or agency head of (i) any unanticipated problems involving risks to subjects or others or any serious or continuing noncompliance with this policy or the requirements or determinations of the IRB and (ii) any suspension or termination of IRB approval.

All applications or proposals for research covered by this regulation must contain a certification that the application or proposal has been reviewed by the IRB.

An Assurance of Compliance will not be approved by the Office for Human Research Protections (OHRP) unless the Chair of the IRB and the Human Protections Administrator (Primary Contact) have completed the OHRP online training  or an equivalent training program.

Note that NIH requires education on the protection of human research participants for all investigators submitting NIH applications for grants or proposals for contracts or receiving new or non-competing awards for research involving human subjects. 

IRB Membership (45 CFR 46.107)

Each IRB shall have at least five members, varying backgrounds. While selection of the IRB should not be made on the basis of gender, efforts should be made to ensure that the IRB is not composed of either all men or all women. Each IRB shall include one member whose primary concerns are in scientific areas, and one whose primary concerns are in nonscientific areas. The IRB must include persons knowledgeable in assessing scientific research activities, applicable law, and standards of professional conduct and practice. The IRB must be able to properly judge the adequacy of information to be presented to subjects.

Each IRB shall include one member who is not affiliated with the institution, and who is not part of the immediate family of a person affiliated with the institution. An IRB member with a conflict of interest as regards to a particular project may not participate except to provide information. Outside non-voting individuals may assist in the review of projects when their expertise is needed.

IRB review of Research (45 CFR §§ 46. 108 -110)

The PI must submit the following information to the IRB: the full protocol describing the proposed project; a summary of the protocol as required by IRB procedures; a draft informed consent form and related information that will be provided to potential subjects during the recruitment process; the sponsor's information about investigational drugs, biologics or devices; a copy of text used to recruit potential subjects; a description of how potential subjects will be identified and enrolled; a copy of any federal grant applications seeking funds for the project; and a description of the PI's qualifications.

Unless expedited review is utilized, the research under question must be reviewed at convened meetings with a majority of the members present, including at least one member who is primarily a non-scientist. Majority approval must be received for the research to be approved.

An IRB must ensure that informed consent is in accord with the law, and require documentation of informed consent, or waive it when the law allows. (see 45 CFR § 46.117)

The IRB shall notify investigators and the institution in writing of the decision to approve or disapprove the proposed research activity or modifications required by the IRB. If the activity is not approved, the written notification must include a statement of the reasons for the denial, and give the investigator an opportunity to respond.

The IRB must conduct continuing review of research at intervals appropriate to the risk, but no less than once per year. The IRB has the authority to have a third party observe the consent process and research. 

The following language on continuing review has been added to 46.109 (f) 

(f)(1) Unless an IRB determines otherwise, continuing review of research is not required in the following circumstances:

(i) Research eligible for expedited review in accordance with §ll.110;
(ii) Research reviewed by the IRB in accordance with the limited IRB review described in § ll.104(d)(2)(iii), (d)(3)(i)(C), or (d)(7) or (8);
(iii) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study:
(A) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or 
(B) Accessing follow-up clinical data from procedures that subjects would
undergo as part of clinical care.

Unless the research is eligible for expedited review, all IRB members should receive and review a protocol summary and a status report on the progress of the research, including:

  • The number of subjects accrued;
  • A summary of adverse events or unanticipated problems involving risks to subjects or others, and any withdrawal of subjects or complaints about the research;
  • A summary of any relevant recent literature, interim findings, and amendments or modifications to research since last review;
  • Any relevant multi-center trial reports;
  • Any other relevant information, especially information about risks associated with the research; and
  • A copy of the current informed consent document and any newly proposed consent document.

At least one member should review the complete protocol and any modifications previously approved by the IRB. The minutes of the IRB meetings should document separate deliberations, actions, and votes for each protocol undergoing continuing review by the convened IRB. Unanticipated problems involving risks to subjects or others that is reported to the IRB must in turn be reported by the IRB to institutional officials.

Criteria for IRB approval of Research (45 CFR § 46.111)

Prior to approval of research, the IRB shall determine that the following requirements are satisfied:

1) Risks to subjects are minimized: (i) By using procedures which are consistent with sound research design and which do not unnecessarily expose subjects to risk, and (ii) whenever appropriate, by using procedures already being performed on the subjects for diagnostic or treatment purposes.

(2) Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result. In evaluating risks and benefits, the IRB should consider only those risks and benefits that may result from the research (as distinguished from risks and benefits of therapies subjects would receive even if not participating in the research). The IRB should not consider possible long-range effects of applying knowledge gained in the research (for example, the possible effects of the research on public policy) as among those research risks that fall within the purview of its responsibility.

(3) Selection of subjects is equitable. In making this assessment the IRB should take into account the purposes of the research and the setting in which the research will be conducted and should be particularly cognizant of the special problems of research involving vulnerable populations, such as children, prisoners,  individuals with impaired decision making ablity,  or economically or educationally disadvantaged persons.

(4) Informed consent will be sought from each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by § 46.116.

(5) Informed consent will be appropriately documented or appropriately waived in accordance with, and to the extent required by § 46.117.

(6) When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects.

(7) When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. (The HHS Secretary will issue guidance to IRBs in assessing what provisions are adequate)

(8) ) For purposes of conducting the limited IRB review required by § ll.104(d)(7)), the IRB need not make the determinations at paragraphs (a)(1) through (7) of this section, and shall
make the following determinations:
(i) Broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens is obtained in accordance with the requirements of
§ ll.116(a)(1)–(4), (a)(6), and (d); 

(ii) Broad consent is appropriately documented or waiver of documentation is appropriate, in accordance with § ll.117; and
(iii) If there is a change made for research purposes in the way the identifiable private information or identifiable biospecimens are stored or maintained, there are adequate
provisions to protect the privacy of subjects and to maintain the confidentiality of data.

(b)When some or all of the subjects are likely to be vulnerable to coercion or undue influence, such as children, prisoners, individuals with impaired decision making ability,  or economically or educationally disadvantaged persons, additional safeguards have been included in the study to protect the rights and welfare of these subjects.

Research covered by the policy may be subject to further review by the institution.

Suspension of Research (45 CFR § 46.113)

The IRB must have the authority to suspend or terminate research not conducted in accord with the IRB requirements.

45 CFR § 46.114 provides language to mandate single IRB approval for studies conducted under the policy and involving more than one institution.

Recordkeeping Requirements (45 CFR § 46.115)

The institution or the IRB must keep the following records:

1) Copies of all research proposals reviewed, scientific evaluations, if any, that accompany the proposals, approved sample consent documents, progress reports submitted by investigators, and reports of injuries to subjects.

(2) Minutes of IRB meetings shall be in sufficient detail to show attendance at the meetings; actions taken by the IRB; the vote on these actions including the number of members voting for, against, and abstaining; the basis for requiring changes in or disapproving research; documentation of specific findings required by the regulations, and a written summary of the discussion of controverted issues and their resolution.

(3) Records of continuing review activities.

(4) Copies of all correspondence between the IRB and the investigators.

(5) A list of IRB members in the same detail as described above under assurances.

(6) Written procedures for the IRB in the same detail as described above in assurances.

(7) Statements of significant new findings provided to subjects.

(8) The rationale for an expedited reviewer’s determination under § ll.110(b)(1)(i) that research
appearing on the expedited review list d
escribed in § ll.110(a) is more than minimal risk.

(9) Documentation specifying the responsibilities that an institution and an organization operating an IRB each will undertake to ensure compliance with the requirements of th

The records required by this policy shall be retained for at least 3 years, and records relating to research which is conducted shall be retained for at least 3 years after completion of the research. All records shall be accessible for inspection and copying by authorized representatives of the department or agency at reasonable times and in a reasonable manner.

General Requirements for Informed Consent (45 CFR § 46.116 and 46.117)

Basic elements of informed consent, which is required for all human subject research, is as follows:

(1) A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's participation, a description of the procedures to be followed, and identification of any procedures which are experimental;

(2) A description of any reasonably foreseeable risks or discomforts to the subject;

(3) A description of any benefits to the subject or to others which may reasonably be expected from the research;

(4) A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;

(5) A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;

(6) For research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained;

(7) An explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights, and whom to contact in the event of a research-related injury to the subject; and

(8) A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.

Additional elements of informed consent that may be appropriate in certain situations are listed in 45 CFR § 46.116. Specific rules for when a waiver to some of the consent provisions may be approved by the IRB are also contained in this regulation. Note that any waiver must be thoroughly documented by the IRB, including the findings justifying the waiver. In order to ensure IRB access when necessary to identifiable patient information (e.g. review of an adverse event) the consent form should include permission for access to medical records and other relevant study information by the IRB committee.

Informed consent must be documented by the use of a written consent form approved by the IRB and signed by the subject or his/her legal representative. The consent form should include an expiration date that matches the expiration of the IRB's initial approval of the study (no more than one year). Informed consent must be legally effective under applicable state law. Exceptions to the requirement of informed consent are contained in 45 CFR § 46.117.


Limitation on use of federal funds (45 CFR § 46.122)

Federal funds may not be expended for research involving the use of human subjects unless all of the above requirements have been met. 

Research involving a vulnerable population (45 CFR § 46.201 et seq)

Additional conditions apply when the research involves pregnant women, human fetuses, neonates, prisoners or children. See 45 CFR § 46.201 et seq.

Guidance, and Regulations published in the Federal Register

Six Month Delay of Compliance Provisions, with three burden reducing provisions that may be used in the interim, 83 Fed. Reg. 28497, June 19, 2018. This rule delays the general compliance date for the 2018 Requirements for an additional 6-month period, until January 21, 2019. As a result of this delay, regulated entities will be required, with an exception, to continue to comply with the requirements of the pre-2018 version of the Federal Policy for the Protection of Human Subjects (the “pre-2018 Requirements”) until January 21, 2019. The one exception to this general rule is that institutions will be permitted (but not required) to implement, for certain research, three burden-reducing provisions of the 2018 Requirements during the delay period (July 19, 2018, through January 20, 2019). Those three provisions are: The revised definition of “research,” which deems certain activities not to be research covered by the Common Rule; the elimination of the requirement for annual continuing review with respect to certain categories of research; and the elimination of the requirement that institutional review boards (IRBs) review grant applications or other funding proposals related to the research.


Final Rule, Federal Policy for the Protection of Human Subjects, 82 Fed. Reg. 7149, Jan. 19, 2017.

These new regulations are scheduled to become effective on 19 January 2018, except for the single-IRB review requirement, which will take effect on 20 January 2020. 

Since the Common Rule was promulgated, the volume and landscape of research involving human subjects have changed considerably. Research with human subjects has grown in scale and become more diverse. 
Examples of developments include: an expansion in the number and types of clinical trials, as well as observational studies and cohort studies; a diversification of the types of social and behavioral studies
being used in human subjects research; increased use of sophisticated analytic techniques to study human biospecimens; and the growing use of electronic health data and owith human subjects has grown in scale and become more diverse. Among other changes, the final rule adopts new requirements to improve  informed consent forms and the consent process itself.  The final rule establishes new exempt categories of research based on their risk profile.

McDermott, Will & Emery, HHS Finalizes Toned Down Version of Common Rule Overhaul, Feb. 6, 2017. 

Hogan Lovells HHS Overhauls the Common Rule to enhance protection for Human Subjects in Research, Feb. 6, 2017. 


Selected Case Law:

Washington University v. Catalona, et. al., (C.A. 8th Cir.) June 20, 2007

Grimes v. Kennedy Krieger Institute, Inc.,

782 A. 2d 807, (2001) reconsideration denied (Oct 11, 2001) In a case of first impression, the Court of Appeals of Maryland addressed the topic of consent to nontherapeutic research using minors. In this case, certain rental properties were to have only partial lead abatements performed, and landlords were to receive public funding by way of grants or loans to aid in modifications. The research institute required the landlords to rent the premises to families with young children, and the children's blood level was monitored as a way of determining which types of lead abatements were useful in minimizing the presence of lead in children. Children were thus encouraged to live in housing where the possibility of lead dust was known to be likely, so the researchers could compare the lead dust content of their blood with the level of lead dust in the housing over a two year period. The EPA helped fund this study, and the Johns Hopkins Institutional Review Board approved the research protocol. Two parents of children involved in the study sued the Institute for negligence after their minor children were found to have elevated levels of lead in their blood. The record indicates that in at least one instance the parent was not informed of her child's elevated level of lead until 9 months after the testing showed this to be the case. In addition, the consent form did not directly inform the parents of the fact that it was contemplated that some of the children might ingest lead dust particles, and that one of the reasons the blood of the children was to be tested was to evaluate how effective the various measures of lead abatement would be.

In a 98 page opinion, the Court overturned the judgment of the lower court granting summary judgment to the Institute. Significant among the Court's holdings were the following:

  • In Maryland, a parent, or other guardian cannot consent to the participation of a child or other person unable to enter a contract [under legal disability] in nontherapeutic research or studies in which there is any risk of injury or damage to the health of the subject. The Court stated that consent of the parents can never relieve the researcher of the duty to see to the harmlessness of nontherapeutic research. (page 75 online opn.)
  • Informed consent agreements in nontherapeutic research projects, under certain circumstances can constitute contracts. When the parents signed the consent form, both KKI and the parents made representations amounting to a bilateral contract. When informed consent involves obligations and confers consideration on both researcher and subject (or parents) this can result in the creation of a contract. (pp. 63-64 online opn.)
  • Research agreements can, as a matter of law, constitute special relationships giving rise to duties, and breach of those duties may constitute negligence when the researcher breaches his/her duty to the research subject. The trial court erred in holding that such a relationship cannot arise between a researcher and the subject of the research. (pp. 64-67 online opn.)
  • Government regulations (here 45 CFR § 46.101) impose a standard of care and require fully informed consent. These regulations can create duties on the part of researchers towards human subjects out of which special relationships arise. Such duties and relationships are consistent with the Nuremberg Code. In this case there was ample evidence for the trier of fact to find a special duty existed. (pp. 68-74 online opn.)

A concurring opinion agreed with the finding of a special relationship creating a duty of care, but would have avoided addressing the question of whether or not the informed consent agreements created legally binding contracts.


Federalwide Assurance Instructions

COGR Feb. 2017 summary of Common Rule changes

OHRP training modules

NIH Genomic Data Sharing 

The NIH GDS Policy applies to all NIH-funded research (e.g., grants, contracts, and intramural research) that generates large-scale human or non-human genomic data, regardless of the funding level, as well as the use of these data for subsequent research.  For background read "The Immortal Life of Henrietta Laks".

IRB Resource Page: Run by historian Zach Schrag, includes many articles, book reviews, posted materials, and a great blog.

AAUP Report: Research on Human Subjects, Academic Freedom and the Institutional Review Board

The report recommends that federal regulations be changed to allow research on autonomous adults without IRB review when the methodology consists entirely in collecting data by surveys, conducting interviews, or observing behavior in public places.

CITI Training

Although CITI is a not for profit organization, CITI does charge an institutional user fee of $1000 per year per institution to offset the administrative costs of running the course site. This also includes the set up fee for your institutional page. There are no limits on how many people from your institutions may use the course site. The user fee also includes institutional access to the CITI Refresher Course and the new International Course site. Many schools use this program for Human Subject Research Training.

Association for the Accreditation of Human Research Protection Programs (AAHRPP)

OHRP Human Subject Regulations Decision Charts

Public Responsibility In Medicine and Research A professional organization for IRB professionals. Contains links to training materials on HIPAA for Human Research Protection Programs.

OHRP Compliance Oversight

The Belmont Report




updated 7-1-18 mlo