Submitting to an Institutional Review Board

Human Research Regulatory Affairs Submitting to an Institutional Review Board
Purple hero (default)
Human Research Regulatory Affairs Submitting to an Institutional Review Board

There are several steps researchers need to take before submitting a new study request to an institutional review board (IRB), whether the IRB is within NYU School of Medicine or is one of the external IRBs we have contracted with. Learn more about the following steps:

Does Your Study Involve Human Subjects?

Before you begin a study, you should first determine whether your project meets the definition of human subjects research. The U.S. Department of Health and Human Services (HHS) Office for Human Research Protections provides graphic aids and guides that can help you determine whether a project involving human subjects must be reviewed by an IRB according to HHS regulations.

Federal regulations stipulate that an IRB does not need to review research if it does not involve human subjects. If your study does not qualify as human subjects research, your sponsor or a publication may require certification confirming this. In this instance, you complete our self-certification form or the quality improvement self-certification form.

The self-certification form may then be used as documentation that your study is not human subjects research and does not require IRB review according to both federal regulations and our policy. If you submit non–human subjects research to the IRB for review, you are asked to withdraw your submission and complete the self-certification form.

Which Type of Initial Review Does Your Study Require?

If your research does involve human subjects, the IRB can determine whether your research is exempt from IRB review or, if it is not exempt, requires full board or expedited review.

Exempt Status Determination

Although the IRB currently reviews all research involving human subjects, the regulations provide that certain human research activities, detailed below, may be eligible for a determination of “exempt” status by the IRB.

As a principal investigator, you may request exemption from review by submitting an application before initiating the study. Note that an exemption from IRB review does not equate to an exemption from the HIPAA requirement for authorization or waiver of authorization when the research involves a covered entity’s protected health information. Covered entities are defined in the HIPAA rules as health plans; health care clearinghouses; and health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.

Researchers who receive an exemption determination but whose research involves protected health information must still seek a waiver of authorization from the IRB or submit one of the following to the IRB for approval: a researcher representation form (for reviews preparatory to research or research involving decedents’ information) or a data use agreement form (where a limited data set will be used).

Data anonymization makes a protocol eligible for exemption from IRB review. For a protocol to qualify as “anonymized,” the data may not contain any ready identifiers or any linking code or field. Anonymized data are not automatically considered deidentified data under the privacy rule.

Under the privacy rule, a covered entity may share data without restriction only if the data have been deidentified. Deidentified data may contain linking codes not derived from any identifier (such as a social security number or medical record number) and not used for any other purpose, provided that the covered entity does not disclose the code key to the researcher or anyone else. Although deidentified data may contain linking codes that meet the above criteria, a deidentified data set may not contain any of the 18 identifiers listed in the privacy rule. Researchers may not create deidentified data for the purpose of using or disclosing such data to parties not identified in the authorization form, waiver application, or data use agreement, without the approval of the privacy officer.

The privacy rule permits a covered entity to disclose a limited data set to a researcher without authorization or waiver if the researcher has signed a data use agreement containing certain required elements. Limited data sets are not deidentified data but permit the researcher to receive certain identifiers that must otherwise be removed to render data deidentified (the identifiers permitted in a limited data set are listed in the privacy rule).

Researchers who are seeking a limited data set from a covered entity should submit a completed data use agreement form to the privacy officer for approval.

View a full list of HSS IRB exemption categories.

Expedited Review

Research activities that present no more than minimal risk to human subjects and involve only procedures listed in one or more of the categories determined by HHS may be reviewed by the IRB through the expedited review procedure authorized by HHS regulations 45 CFR 46.110 and 21 CFR 56.110. View a full list of the HHS’s Office for Human Research Protections expedited review categories.  

The activities listed should not be deemed to be of minimal risk simply because they are included on this list. Inclusion on this list merely means that the activity is eligible for expedited review when the specific circumstances of the proposed research involve no more than minimal risk to human subjects.

The categories on this list apply regardless of the age of subjects, except as noted. Expedited review may not be used when identification of the subjects or their responses, or both, would reasonably place them at risk for criminal or civil liability or be damaging to the subjects’ financial standing, employability, insurability, or reputation or when it would be stigmatizing, unless reasonable and appropriate protections will be implemented so that risks related to invasion of privacy and breach of confidentiality are no greater than minimal.

The expedited review procedure may not be used for classified research—that is, research requiring a security classification from the federal government—that involves human subjects. Investigators are reminded that the standard requirements for informed consent (or its waiver, alteration, or exception) apply regardless of the type of review used by the IRB—expedited or full board.

In addition, expedited review is appropriate for minor changes in protocols and consent forms proposed for previously approved research during the period (one year or less) for which approval is authorized. Changes affecting risk, benefit, discomfort, or subject protections are not “minor” changes. Minor modifications include, for example, administrative changes to the protocol, adding follow-up calls when gathering initial data by telephone, or certain changes in the scheduling of medications.

The Health Insurance Portability and Accountability Act (HIPAA), known as the privacy rule, allows an IRB to use expedited review procedures to grant a waiver or alteration of authorization when the research involves no more than minimal risk to the privacy of research subjects. Minimal risk is determined by reference to criteria enumerated in the privacy rule. The expedited procedures that an IRB may use to grant a waiver or alteration of authorization are the same as those permitted when an IRB grants a waiver of consent (such as review and approval by the chair of the IRB or the chair’s designee); however, the IRB’s findings justifying a waiver of authorization must be documented separately from its findings justifying a waiver of informed consent, where applicable.

Investigators who believe that their study is eligible for expedited review should indicate the specific category of eligibility on the application for new protocol review form. The IRB chair or designee determines whether expedited procedures are used. If they are to be used, the reviewer conducts a review according to the procedures and criteria set forth in the IRB’s policies and procedures manual.

Full Board Review

Human subjects research that is not classified as exempt or expedited requires full IRB review at a convened meeting. Investigators should allow a minimum of three weeks for an application to be scheduled for review at a convened meeting.

NYU School of Medicine’s IRB uses a primary reviewer system for full board reviews. At least one week before the meeting, IRB members scheduled to attend receive the application materials, including the application itself, the informed consent documents, and other materials such as advertisements and recruitment letters. Members designated by the chair as primary reviewers also receive the complete grant application, protocol, and (for investigational drug or device studies) the investigator’s brochure.

Primary reviewers lead the discussion of each project at a full board meeting. The board determines whether the project meets the criteria for approval or whether revisions to the study design are required. Informed consent documents are reviewed for accuracy, clarity, and the inclusion of required and optional elements of consent. At the discretion of the chair, voting may be by written ballot or a show of hands.

Majority rule determines the status of projects, which are placed by those present at the meeting into one of the following categories:

  • approved as submitted
  • conditionally approved, pending receipt of required minor revisions to study procedures, informed consent documents, or other written materials
  • deferred, pending review at a subsequent full board meeting after receipt of significant additional information or revisions
  • not approved

Written minutes of each full board meeting are provided and include the following information as it applies to each researcher’s own project:

  • attendance
  • the number of votes (without individual identification) to approve, table, disapprove, or abstain
  • the basis for requiring changes in or disapproving the research
  • the length of time until the next review
  • a summary of the discussion of controverted issues and their resolution

Using Research Navigator to Submit Your Study

To submit your study to IRB, faculty, staff, and partnering researchers use their Kerberos ID to log into Research Navigator. This program allows you to create a new study profile and manage the documents and data related to your study.

Through Research Navigator, you may need to submit additional forms, including the IRB addenda for vulnerable populations and requests for a waiver of authorization of informed consent, depending on the nature of your research.

You can also find guidance appropriate to your project in Research Navigator. If you have questions that are not answered there, email us at to schedule a time to meet with a staff member who can assist you with your submission.

Study teams should use Research Navigator to register each new and currently approved study involving human subjects. Submissions made through Research Navigator are automatically sent to the IRB. These submissions are also sent to all other Office of Science and Research administrative and ancillary review bodies, including the Clinical Research Support Unit, the Research Conflicts of Interest Committee (within the Conflicts of Interest Management Unit), the Protocol Review and Monitoring Committee, the Institutional Biosafety Committee, the Radiation Safety Committee, and the Embryonic Stem Cell Review Oversight Committee.

For a full overview of Research Navigator guidelines, faculty, staff, and investigators can log in using their Kerberos ID.

Financial Disclosure

Financial disclosure forms are required for all personnel listed on your IRB application at the time of a study’s new submission, a continuing review request, and any modification or amendment involving a change to your study staff. The IRB cannot review submissions that list faculty or staff but do not include their signed financial disclosure forms.

If a conflict is indicated on any of your financial disclosure forms, Research Navigator routes it to the Conflicts of Interest Management Unit for review. IRB approval cannot be issued until the unit makes a determination.