Institutional Review Boards

An IRB is an institute’s committee with the responsibility to review that institution’s research projects involving human subjects, primarily to assure the protection of the safety, rights and welfare of the human subjects.

AAPOR Guidance for IRBs and Survey Researchers

I. Introduction

This statement is prepared as an aid to researchers and Institutional Review Boards (IRBs) in their deliberations about whether appropriate consideration has been given to the protection of human subjects when a study involving survey interviews or questionnaires is proposed. Consistent with the recommendations of a 2003 National Research Council report (http://www.nap.edu/openbook.php?isbn=0309088526), we encourage IRBs to provide a review process that is commensurate with the level of risk associated with the specific research design proposed. The guidance is based on extensive experience with surveys by the members of our association and is intended to address a wide range of situations. Since it cannot address the particulars of every case, AAPOR, through its Standards Committee, would be glad to assist you if asked about a specific research proposal. Because the Federal regulations specifically require that IRB members possess expertise or consult with experts in the areas of research that they review, we invite you to contact us to assist with reviews if survey research expertise is not available on your local IRB or in your institution.

Human subjects protection is an ever-evolving topic, so AAPOR updates this document periodically to reflect new knowledge, regulations, and best practices.  We encourage researchers and IRB members to stay up-to-date on major developments in the regulatory environment, such as proposed revisions to the Common Rule (National Research Council 2014).

II. Survey Participation: Risk and Benefits

Participation in surveys rarely puts respondents at more than the minimal risks of everyday life. This fact is recognized explicitly in the Federal regulations which list surveys as examples of research that may be exempted by the IRB or handled with an expedited review process. Unless the intended participants are minors, in many cases, surveys meet the requirements for exemption provided in 45 CFR 46.101b and presented in the category description below.

Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless:

(i) information obtained is recorded in such a manner that human participants can be identified, directly or through identifiers linked to the participants; and
(ii) any disclosure of the human participants’ responses outside the research could reasonably place the participants at risk of criminal or civil liability or be damaging to the participants’ financial standing, employability, or reputation. [Emphasis added]

Participation in certain surveys can, however, put respondents at significant risk when, for example, the inquiry concerns stigmatizing or illegal activity and inadequate attention is paid to ensuring respondent anonymity or the confidentiality of responses. We discuss various questions about surveys below to highlight this distinction.

1.    Does simply asking a question cause some respondents mental distress? Our experience indicates that some questions may cause momentary unhappiness when asked. Unemployed persons may become upset in talking about being fired or out of work. People may become unhappy talking about their own illness or that of a friend or relative. However, these risks are well within the range of day-to-day experiences and activities. There is no known case of any person sustaining any lasting physical or psychological harm from a survey interview. On the contrary, many people report that talking about themselves and their problems is therapeutic. Analysis of response rates across studies indicate that people are more willing to be interviewed about their work or health, and to spend a longer time giving interviewers what might be considered “personal information” than they are to talk about public affairs or foreign policy.

2.    Does answering a question cause some respondents mental distress? Respondents have significant defenses against becoming embarrassed by answering a survey question. They can decline to answer if they wish to do so. There is substantial evidence that respondents do choose not to answer when questions that appear to be threatening are asked of them. Interviewers — strangers to the respondent — are trained to remain neutral and to treat each answer as legitimate no matter what is said. It is still possible, however, that some respondents who choose to answer a threatening question may feel temporary embarrassment. There is, again, no known case of any lasting physical or psychological harm from participating in a survey interview. There are sensitive topics however, such as questions about disaster survival, suicide ideation, or domestic violence victimization that may cause respondents more than temporary distress. In these cases the researcher must ask whether the benefits of the research outweigh the risks and should have resources available to offer the respondent in the possible event of extreme distress such as hot line number referrals or on-call social workers or other qualified counselors.

3.    Are there risks to respondents who admit to illegal or stigmatizing behavior? On some occasions, researchers must ask about matters such as tax evasion, illegal drug use, domestic abuse or HIV-related behaviors. Such surveys can pose significant risks to respondents since they may suffer adverse consequences if individual identities and responses are disclosed. In all surveys, but particularly in these atypical cases, two issues need to be examined by the researcher and the IRB:

1.    Have sufficient steps been taken to protect the identity of respondents and the confidentiality of their answers?

2.    Do the anticipated benefits to society outweigh the risks?

The ability of IRBs to assess the risks involved in a survey is bolstered when there is mutual understanding and trust with the researcher. We encourage researchers to work with IRBs to develop procedures to expedite implementation of non-substantive changes that do not increase risk to respondents. Minor modifications to protocols such as deleting a survey question or grammatical changes to wording that do not increase the level of risk to the respondent could conceivably be allowed with appropriate notification after the fact if the IRB in question knows the researcher is familiar with the Common Rule and keeps the rights and welfare of the respondent foremost in his or her mind.

It is essential in all surveys that the researcher separate all personally identifiable information (“PII”) (e.g., name, date of birth, home address, email address, telephone number, if known) from the interview itself as soon as it is no longer needed, typically, immediately after the survey has been conducted or the interview has been verified. (Verification is a standard quality control procedure following face-to-face interviewing and is normally conducted soon after the initial interview is completed.) The identifying information (if it needs to be retained) must be stored separately from the interview data in secure files. The level of security needed should be determined according to the level of risk assumed by the respondent and the likelihood that efforts will be made (by, say, law enforcement personnel) to access the identifying information. In cases where data are linked over time, for example in panel studies, identifiers may need to remain with the data for longer periods. In these cases, data security and storage must be a priority.

Additional special measures should be considered to ensure confidentiality of responses in the rare cases where surveys pose significant risks to respondents, or when respondents have been promised confidentiality (see “How much should survey respondents be told?” below). In these cases, the researcher should review alternative methods to ensure that respondents cannot be identified through analysis of the data file alone. The methods may involve adding random noise to the file, suppressing variables, altering demographic information according to a coded system, top-coding/bottom-coding responses or some other procedure. For ensuring confidentiality in published tabular data, additional methods such as controlled rounding as described by Cox (1987) should be considered. AAPOR can recommend consulting support for researchers and IRBs to decide on appropriate methods for treating data files and tabular data in these special survey situations.

For surveys conducted on paper, researchers should ensure that PII is kept separate from the survey responses.  In the case of computer-assisted data collection (whether using desktop or laptop computers, or smartphones or other mobile devices) researchers should employ appropriate encryption and other measures to secure the data on these devices. Researchers should also consult their IT staff for assistance in applying data security steps.

Electronic data collection via the Internet, email and SMS has increased in recent years and also presents special challenges for data confidentiality. When any PII or personal health information (“PHI”) is being collected in Internet-based tools, researchers and IRBs should make sure that appropriate security measures are in place to safeguard both the transmission and storage of survey responses. Such safeguards might include encryption during transmission, storage of data on secure servers, and provision of firewalls to protect data from unauthorized access. Special considerations are necessary when PII is collected using hosted services, where the data reside on a vendor’s servers, outside the control of the researchers. For more on special issues related to Internet research, see Kraut et al. (2004) and Singer and Couper (2011).

Electronic data collection through social media platforms such as Facebook, LinkedIn, Twitter, etc., poses special problems related to privacy of those persons connected to survey respondents through the social media who have not explicitly consented to participate in the study. Researchers should consider the types of PII and confidential data that will be gathered on third parties via the consenting participant’s social networks and whether third party consent is recommended or required by their IRB.  Similarly, placement of computer cookies in respondents’ computer environment or in their third party social media connections without explicit consent should be assessed relative to written informed consent requirements by their IRB.  If collecting data from a social media site, it is recommended that a qualified expert carefully review and advise on the terms of service (TOS) for any restrictions the site may have for researchers.

The availability of geocoded respondent information using geographic information systems (GIS) presents new challenges with respect to data disclosure.  Researchers need to assess if tabular data or maps contain enough information to identify an individual participant in a study.  For example, if a map showed respondents in a specific housing unit or on a block with enough other information to determine their identity, such as being the only household on a given block, IRBs would consider them to be a potential disclosure risk.  Similarly, care needs to be taken with tabular information containing longitude/latitude coordinates or geographic codes at detailed levels that may increase the risk of disclosure.

Many survey participants report that they enjoy the survey process. This enjoyment and the sense of good feeling they get from helping the research enterprise make surveys possible. The pleasure is probably temporary; no systematic evidence of long-term benefits from survey participation has been collected, though such benefits are possible. (The tangible benefit of payments made to respondents to compensate them for their participation or as a token of appreciation are not considered by IRBs to be a benefit of the research.  This topic is discussed at length in Section V below.)

The most obvious benefits of surveys are those to the researcher and to society. Surveys are powerful tools capable of providing generalizable information on a variety of aspects of the human condition when designed and fielded using sound, rigorous methods. Survey data are essential to advancing our understanding of health and disease, explanations of social, psychological, economic and political processes, and evaluation and improvement of public policy. Even where the benefits of surveys are not immediately apparent, the potential benefits clearly outweigh the minimal risk of harm to respondents in the majority of surveys.

In the case of surveys that do pose substantial risks for respondents, the societal benefits are usually, if anything, more clear cut. Studies of HIV-related behavior, for example, are conducted so that better methods of disease tracking and prevention can be developed. These studies are conducted with appropriate safeguards for anonymity and confidentiality to minimize respondent risk, which is potentially very great. When the risks to respondents are not appropriately considered in a survey design, however, the study should not be conducted.

III. Informed Consent

In virtually all survey-based studies, the key elements of consent can be provided to respondents in a concise way at the beginning of a survey in the brief introductory statements of a telephone interview, in a cover letter for a self-administered survey or in the introductory screen in a web survey. This is true regardless of level of risk, and is consistent with the contemporary view of consent as an ongoing process rather than a document. The main elements of consent are: an explanation of the purpose(s) of the study, the approximate amount of time it will take, a description of what the respondents will be asked to do, a description of any foreseeable risks or discomforts, a description of any benefits to the respondents or others, a statement describing the confidentiality of responses, and a statement of the voluntary nature of participation. In face-to-face and telephone surveys, contact information should also be available upon request for questions about the research and about respondent rights. In self-administered and electronic modes, this information can be included in the written introductory information.

It is useful to discuss informed consent in surveys using the questions: Who can give consent? How does a survey respondent indicate consent? How much information about the study must be provided to a survey respondent, and when? Included in this discussion should be consideration of the language, culture and literacy level of the target population.

As a general principle, consent can be obtained from adult respondents who can understand the benefits and risks of the survey. Except in the special cases where parental consent itself could pose risks (e.g., studies of child abuse), parental consent must be obtained prior to administration of a survey to a minor and assent (agreement to participate) should be obtained from the child or teen. The age of majority at which a person is considered old enough to legally make their own decisions varies slightly from state to state in the U.S., and from country to country. Researchers should be aware of the age of majority in the geographic region(s) where they are collecting data.

Special consideration must be given to studies being conducted by someone with authority over potential respondents (e.g., teachers, employers, physicians). In these cases, it is particularly important that the respondent recruitment procedures evidence no coercion, either explicit or implicit. Further, it is essential that the researcher make a clear demarcation between research questions and issues arising out of the authority relationship. When the person with authority is a medical provider, there must also be a clear distinction between any medical care being provided for the research and any medical care that is recommended as a form of treatment. As a general rule, we discourage persons with authority over potential respondents from recruiting participants or administering surveys themselves if they will have knowledge about who did and did not participate or have access to individual responses.

In most surveys, respondents indicate their consent by agreeing to participate at the beginning of the interview, and/or by answering questions as they are asked or that appear on a paper or electronic questionnaire. Thus, people may consent to all of an interview, to part of it, or to none of it, depending on how they respond to requests from the interviewer. We should note that significant numbers of people who are approached to participate in surveys refuse to do so or refuse to answer individual questions. There is no evidence that people feel coerced to participate in survey research. Unlike much medical research, which requires “all or nothing” cooperation, surveys permit respondents to opt out easily of parts of the measurement process if they so desire.

Federal regulations (CFR 46.117c) on human subjects protections recognize that written consent forms are not necessary or desirable in every research setting. The regulations provide that, while written consent is the norm in much research involving humans, IRBs may waive requirements for documentation of informed consent if they find that the research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context. When the written consent form is the only source of identifying someone as a research participant, documentation of informed consent may also be waived.
These conditions describe the vast majority of surveys. As noted above, few surveys pose risks greater than those that the respondent would confront in everyday life. Further, in many contexts, signed consent forms may increase risks to respondents if confidentiality is breached (e.g., research on illegal behavior, health, immigrants, etc.) and reduce cooperation unnecessarily. For example, Singer (1978) conducted an experiment showing the need for a signed consent form reduced response rates by six percentage points. In later research, Singer (2003:280-81) reported that 13 percent of respondents who said they would be willing to take part in a hypothetical survey would be unwilling to sign the consent form. Nonresponse is a primary source of error in surveys, and we attempt to keep it at a minimum so that our samples will be representative of the populations of interest. Signed consent forms, in the case of the typical survey, can increase nonresponse error and increase the burden on respondents without the gain of protecting respondents from significant risks.

Moreover, beyond the possible negative effects of requiring written consent, telephone surveys using random-digit dialing – a common approach in survey research – cannot incorporate signed consent in the protocol prior to the initial contact since respondents’ names and addresses are unknown to the researcher. Requiring signed consent prior to the beginning of an interview would, for all practical purposes, make many telephone surveys impossible. Thus, a waiver of documentation of consent is typically the most desirable approach for survey protocols – especially those utilizing telephone and electronic modes.

Even in that small percentage of surveys that do pose more than minimal risks for respondents, the Federal regulations (CFR 46.117c) allow IRBs to waive requirements for signed consent if they find that the proposed research cannot practicably be carried out without the waiver. These types of surveys require a more extensive discussion of risks and benefits with the respondents than do the usual minimal risk surveys. We encourage IRBs to work with the researcher and with the AAPOR Standards Committee to identify means of providing an adequate informed consent process other than the signed consent form when that method would threaten the viability of the research.

We firmly believe that potential respondents should understand the risks and benefits of surveys, particularly in those rare cases where surveys do, in fact, pose more than minimal risks. In order that the goal of informing respondents not interfere with sound research practice, we must use information methods that do not unduly exacerbate nonresponse bias, jeopardize the measures of knowledge, opinion and behavior in the survey, or induce unnecessary anxiety in respondents.

Researchers and IRBs should consider, in other words, the impact of an informed consent procedure on the objectives of the research. In the normal survey that presents minimal risk, lengthy and detailed information about the objectives of the survey and the questions to be asked is apt to discourage respondent participation and responses without safeguarding respondent rights. In these surveys, the usual practice of a short introduction about the purpose of the study, the approximate amount of time it will take, the sponsor and/or responsible survey organization, and the general topics to be covered is typically deemed sufficient. Respondents should be told their participation is voluntary and they can skip questions they choose not to answer. The goal of the introductory statement and the reminders about the voluntary nature of response is to help ensure respondent autonomy without affecting substantive responses. If appropriate, at the end of the interview, respondents can be debriefed to see if any of the matters covered were upsetting, to give further information on study purposes, or to see if respondents have any further questions.

Information about confidentiality is often included in the survey introduction presented to respondents. This information should be consistent with the procedures actually taken to protect confidentiality and should reflect the degree of confidentiality that can reasonably and legally be promised. More detailed methods of informing respondents may be considered when survey participation does pose substantial risk. The goal here is to provide information necessary for informed choice without unduly increasing nonresponse or response error, which can render survey efforts useless. Each case will have its own unique problems, and so it is difficult to suggest a standard approach. In broad terms, respondents should be informed in an introduction to the survey that the instrument will cover some sensitive topics, but they should not be told so much as to bias their answers (e.g., they should not be informed of the study hypothesis).

This treatment of informed consent in surveys that pose more than minimal risk is necessarily brief given the case-by-case nature of unusual risk. It is important for IRBs to work with the researcher in such cases to craft a procedure that protects respondents from harm while minimizing response and nonresponse bias.

IV. Mandatory Reporting

In the course of completing interviews in some studies, respondents may provide information that triggers the mandatory reporting requirements for situations such as child abuse, child neglect, elder abuse or intent to harm oneself or others. If the content or subject of a study is likely to elicit such disclosure and mandatory reporting is compelled, this likelihood must be disclosed as a risk to participants in the consent information. Participants must be informed that there are circumstances where breach of confidentiality is required by law. Reconciling the seemingly disparate responsibilities of confidentiality and mandatory reporting can be a challenging balance.  The additional concerns of response and nonresponse bias increase the complexity of this issue.

Many professionals are subject to legal requirements to report the intent to harm oneself or others. IRBs generally expect that professionals conducting research will comply with their professional reporting requirements, and although the legal requirements to do so when acting as a researcher may not always be clear, there is an argument that the ethical obligation remains even if no clear legal requirement exists. Similarly, if a study includes testing for medical conditions (beyond collecting self-reported information), such as certain sexually transmitted diseases or tuberculosis, the medical reporting requirements remain in effect and the consent information must indicate the requirement to report the findings to the appropriate state office.

Consent forms should inform participants of these reporting obligations in any study in which reportable information is likely to be evoked.  An example of such language is:

There is one exception to confidentiality.  If information is revealed about [child abuse or neglect, elder abuse or neglect, or potentially dangerous future behavior to others, etc. as applicable], the law requires that this information be reported to the proper authorities.

There is no need to include this information about reporting requirements if the study design is unlikely to elicit reportable information.  It is also important to note that Certificates of Confidentiality (issued by NIH to provide protection to researchers against being compelled in any federal, state, or local civil, criminal, administrative, legislative, or other authority to identify the subjects of research) do not apply to or allow exceptions to mandatory reporting laws.  Requirements differ by state and sometimes even county so if an investigator is conducting data collection that is likely to require mandatory reporting, the laws/requirements for all jurisdictions must be reviewed for all locations in order to include the applicable legal risks in the consent documents across locations. Resources for information on reporting laws include:

Department of Health and Human Services Information on Child Abuse and Neglect Reporting
https://www.childwelfare.gov/systemwide/laws_policies/statutes/manda.pdf#Page=7&view=Fit

National Conference of State Legislatures Child Abuse and Neglect Reporting State Statue Overview
http://www.ncsl.org/research/human-services/child-abuse-and-neglect-reporting-statutes.aspx

National Center on Elder Abuse Resources
https://ncea.acl.gov/

IV. Compensation & Incentives

The practice of offering compensation or financial incentives in survey research has increased considerably over the past decade. Owing to a variety of factors, researchers frequently find it necessary to offer incentives in order to obtain sufficient participation in a study.  Incentives may be in the form of cash, gift cards, checks, or non-monetary items (such as t-shirts or other gifts).  For research governed by IRB review, researchers need to justify payments based on several variables. There are two key dimensions of concern when designing protocols that include payments to participants. The first is ethical and the second is legal/regulatory.

Although payment practices are not directly addressed in the current Federal regulations concerning ethical treatment of research participants, they can become a concern if they are deemed to constitute undue inducement to participate in a study.  As outlined in the OHRP IRB Guidebook (1993), the concerns are twofold: 1) would the payments “blind” potential participants to real risks or impair the likelihood that they consider the risks fully, and 2) would the payment induce participants to lie or conceal information that might render them ineligible to participate in the research.  With respect to the former issue, research suggests that the typical incentives used in surveys are not coercive (Singer and Bossarte 2006).

The regulatory issue is that there are no specific guidelines for what constitutes an appropriate level of payment or incentive for a given study. IRBs typically look to accepted standards and norms for their community along with specific study factors. A relatively limited commitment of time (e.g., 30 minutes or less) and minimal risk will usually result in approvals of minimal incentive amounts (e.g., <$25) unless the target population is from a high income stratum (e.g., physicians) where higher incentive amounts are common. Small incentive amounts are referred to as “de minimis” payments at some institutions. If the survey data collection is part of a more complex or longitudinal design requiring other more time-consuming practices like diaries or changes in regular routine, higher amounts may be appropriate. As outlined in the OHRP IRB Guidebook, researchers will likely find that views on appropriate payment levels differ across IRBs. Some IRBs may endorse the view that the key aspect of the process is the informed consent – arguing that participants are free to choose to participate as they see fit if the consent is complete and easily understood.  Others may be more concerned with ensuring that high levels of payment do not affect the ability of participants to make a choice that is informed and voluntary (that is, that the level of payment is not so high as to result in undue influence). As suggested in the OHRP IRB Guidebook section on incentives, key questions should be considered. The questions most relevant for the majority of studies in survey and public opinion research are:

Are recruitment procedures designed to assure that informed consent is freely given?

What special safeguards are included to protect the rights and welfare of participants who are likely to be vulnerable to coercion or undue influence (e.g., children, prisoners, pregnant women, persons with physical or mental illness, and persons who are economically or educationally disadvantaged)?

Are any incentives likely to unduly influence a prospective participant’s decision to participate?

Answering these questions will help researchers successfully justify the use of incentives and compensation in their studies.

Although most survey and public opinion studies fall into the minimal risk category for IRB purposes, we encourage researchers to address all ethical issues relevant to IRB review, including those concerning participant payments.  We also encourage researchers to work with their institutional financial officials to assist them in setting reasonable maximums for participant payments and establishing record-keeping policies that balance confidentiality and financial requirements. A thorough examination of any ethical dimensions of the payments along with a review of all applicable institutional policies and guidelines will help ensure that incentives serve to maximize the quality of the research in accordance with all relevant institutional requirements.

V. Conclusion

Surveys comprise a large portion of research involving human subjects. We in AAPOR believe that it is essential to protect the autonomy of potential respondents and to handle with utmost care the personal information they provide to us. The very existence of the survey as a research tool depends upon a firm foundation of public support. We endorse the aims of human subjects protection regulations and the efforts of institutional review boards to apply them. We want to work with IRBs and researchers to see to it that human subjects protections are applied in a manner that serves the ends for which they were intended. This goal requires distinguishing between surveys and other types of research involving humans, and between the vast majority of surveys that pose little risk and those that pose some risk to respondents. The survey profession has developed methods for ensuring respondent anonymity and confidentiality, and for allowing respondents to express a thoughtful decision to participate or not participate. These procedures differ from those employed in some other forms of research with humans, but they are effective. We urge IRBs to judge how well the survey designs you review embody the principles we have presented here – principles that embrace the fundamental protection process as set forth in the Federal regulations. Finally, AAPOR stands ready to serve as a resource when questions arise about the particulars of any survey design. We can supply advice or consulting support to work out the particulars of difficult survey problems that occasionally arise when balancing good research design and human participant protections.

References

Duncan, G.T., Elliot, M., and Salazar-González, J.-J. (2011). Statistical Confidentiality; Principles and Practice. New York: Springer.

Cox, L.H. (1987). A Constructive Procedure for Unbiased Controlled Rounding. Journal of the American Statistical Association 82: 520-524.

Internal Revenue Service. Instructions for Form 1099-MISC. Available at http://www.irs.gov/instructions/i1099msc/ar02.html

Kraut, R.M., Olson, J., Banaji, M., Bruckman, A., Cohen, J., and Couper, M.P. (2004). Psychological Research Online: Report of Board of Scientific Affairs’ Advisory Group on the Conduct of Research on the Internet. American Psychologist, 59 (2): 106-117.

National Research Council. (2003). Protecting Participants and Facilitating Social and Behavioral Sciences Research. Panel on Institutional Review Boards, Surveys, and Social Science Research, Constance F. Citro, Daniel R. Ilgen, and Cora B. Marrett, eds. Committee of National Statistics and Board on Behavioral, Cognitive, and Sensory Sciences. Washington, DC: The National Academies Press.

National Research Council. (2014). Proposed Revisions to the Common Rule for the Protection of Human Subjects in the Behavioral  and Social Sciences. Committee on Revisions to the Common Rule for the Protection of Human Subjects in Research in the Behavioral and Social Sciences. Board on Behavioral, Cognitive, and Sensory Sciences, Committee on National Statistics, Division of Behavioral and Social Sciences and Education, Board on Health Sciences Policy, Institute of Medicine. Washington, DC: The National Academies Press.

Office for Human Research Protections. (1993). Institutional Review Board Guidebook. Available at
http://wayback.archive-it.org/org-745/20150930181805/http://www.hhs.gov/ohrp/archive/irb/irb_guidebook.htm

Singer, E. (1978). Informed Consent: Consequences for Response Rate and Response Quality
in Social Surveys.
 American Sociological Review 43: 144-162.

Singer, E. (2003). Exploring the Meaning of Consent: Participation in Research and
Beliefs about Risks and Benefits.
 Journal of Official Statistics, 19:273-86.

Singer, E., and Bossarte, R.M. (2006). Incentives for Survey Participation; When are They ‘Coercive’? American Journal of Preventive Medicine, 31 (5) 411-418.

Singer, E., and Couper, M.P. (2011). Ethical Considerations in Web Surveys. In M. Das, P. Ester, and L. Kaczmirek (eds.), Social Research and the Internet.  New York: Taylor and Francis, pp. 133-162.

American Association for Public Opinion Research, 2014

IRB FAQs for Survey Researchers

Most surveys do meet the federal definition of research. In defining human subjects research activities, two separate determinations must be made. The first determination is whether or not the activity can be considered research. If the answer is “yes,” investigators must follow up with a second determination: Does the research involve human subjects? Both determinations must be made using the definitions of the terms “research” and “human subjects” in 45 CFR 46.102 (a-j):

Research: “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research, whether or not they are conducted or supported under a program which is considered research for other purposes.” Investigators unsure of whether an activity constitutes human research should contact their IRB.

Human subjects: “living individual(s) about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information.” Activities in which a researcher collects private, identifiable information about third parties would meet the definition of “human subjects.”
Examples of activities that do not meet these definitions would be (1) ad hoc evaluations of a workshop or symposium (not a systematic investigation), (2) sample surveys on employee satisfaction within one company if the goal is to identify areas for improvement within that company (not designed to contribute to generalizable knowledge) or (3) an analysis of 1880 census records (not information about living individuals). At some institutions, surveys conducted by students for a class project that will not produce a thesis or scholarly publication may be considered to be non-research; check with your institution to learn local practice with regard to student survey projects.

Yes, all research projects, including those that you think will be exempt, must be submitted to the IRB for initial review.  Some types of research are exempt from the regulations that govern and empower IRBs, and the regulations allow other types of research to be reviewed in an expedited process. Many survey projects are eligible for exemption.  However, the determination of exempt status (and the type of review that applies) rests with the IRB or with an administration official named by your institution. The determination does not rest with the investigator. Therefore, all projects must be submitted to the IRB for initial review. Some IRBs have special forms or sub-forms for requests for exemptions while others use the same application materials for all projects. Regardless of the form, nearly all IRBs use an expedited process for the initial review of protocols that are headed for exempt status, allowing fairly rapid determination of exempt status for proposed studies that unambiguously meet the criteria for exemption.  Of the criteria listed below, most survey research falls under Category 2.

NOTE: Exemption categories cannot be applied to research involving fetuses, pregnant women, children, human in vitro fertilization, or prisoners. In the case of studies where pregnant women might be part of the subject pool (e.g., RDD or other surveys) but are not a target population, some IRBs may deem the study as eligible for exemption while others may not.

Exempted projects must meet one or more of the following criteria listed in 45 CFR 46.101(b):

Category 1 – Research conducted in established or commonly accepted educational settings, involving normal educational practices.
Category 2 – Research involving the use of educational tests, survey procedures, interview procedures, or observation of public behavior, unless: (a) information obtained is recorded in such a manner that the human subjects can be identified, directly or through identifiers linked to the subjects; and (b) any disclosure of the human subjects’ responses outside the research could reasonably place them at risk of criminal or civil liability or be damaging to their financial standing, employability, or reputation.

Category 3 – Research involving the use of educational, survey procedures, interview procedures, or observation of public behavior that is not exempt under Category 2 above if: (a) the subjects are elected or appointed public officials or candidates for public office; or (b) federal statues(s) require(s) without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter.

Category 4 – Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to them.

Category 5 – Research and demonstration projects which are conducted by or subject to the approval of department or agency heads, and which are designed to study, evaluate, or otherwise examine: (a) public benefit or service programs; (b) procedures for obtaining benefits or services under those programs; (c) possible changes in or alternatives to these programs or procedures; or (d) possible changes in methods or levels of payment for benefits or services under those programs.

Category 6 – Taste and food quality evaluation and consumer acceptance studies.

Not necessarily. Federal regulations allow expedited review if the protocol meets one or more of the specific criteria listed below. The process varies from institution to institution but typically, a subcommittee of the IRB, the IRB chair or his/her designee reviews protocols and may either approve them or refer the protocol to the full Board for review at the next meeting. The categories for expedited review are as follows (45 CFR 46.110(a)):

Category 1 – Clinical studies of drugs and medical devices only when (a) the research is on drugs for which an investigational new drug application (21 CFR 312) is not required or (b) the research is on medical devices for which (i) an investigational device exemption application (21 CFR 812) is not required or (ii) the medical device is cleared/approved for marketing and the medical device is being used in accordance with its cleared/approved labeling.

Category 2 – Collection of blood samples by finger stick, heel stick, ear stick, or venipuncture from (a) healthy, non-pregnant adults who weigh at least 110 pounds for whom (i) the amounts drawn do not exceed 550 ml in an 8 week period and (ii) collection does not occur more frequently than 2 times per week or (b) other adults and children, for whom, considering the age, weight, and health of the subjects, and the collection procedures, (i) the amount of blood to be collected does not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and (ii) collection does not occur more frequently than 2 times per week. (Note: Children are defined as “persons who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted.”)

Category 3 – Prospective collection of biological specimens for research purposes by noninvasive means.

Category 4 – Collection of data through non-invasive procedures (not involving general anesthesia or sedation) routinely employed in clinical practice, excluding procedures involving x-rays or microwaves. (Note: Where medical devices are employed, they must be cleared/approved for marketing.)

Category 5 – Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected, solely for non-research purposes (such as medical treatment or diagnosis).

Category 6 – Collection of data from voice, video, digital, or image recordings made for research purposes.

Category 7 – Research on individual or group characteristics or behavior or research employing survey, interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies.

According to the Federal regulations and Category 7, most survey research that is not otherwise exempt is eligible for expedited review. However, the expedited review procedure may not be used “where identification of the subjects and/or their responses would reasonably place them at risk of criminal or civil liability or be damaging to the subjects financial standing, employability, insurability, reputation, or be stigmatizing, unless reasonable and appropriate protections will be implemented so that risks related to invasion of privacy and breach of confidentiality are no greater than minimal.” (63 FR 60364, November 9, 1998)

Yes, though in some circumstances IRBs can waive the requirement for this to be a written document. The informed consent process is a basic ethical obligation for researchers. It consists of providing adequate information to the subject about the study, giving the subject the opportunity to consider options, responding to questions the subject may have and ensuring that the subject or the legal representative (parent or guardian) understands the information (see 45 CFR 46.116).

Consent must be obtained from the research subjects or their legally authorized representatives (parents or guardians) before participation in research begins. The regulations refer to a signed consent statement (45 CFR 26.117(a)). However, the regulations also provide for some flexibility. If requested by the investigator, the IRB may waive the signature requirement for certain types of minimal risk research, such as surveys. This is referred to as a waiver of documentation of consent. Even when documentation is waived, the informed consent process must still occur. For example, IRBs have approved waivers of documentation when an introductory letter or introductory paragraph includes the elements of consent required.

According to 45 CFR 46 Section 46.117 (c), an IRB may waive the requirement for the investigator to obtain a signed consent form for some or all subjects if it finds either:
the research presents no more than minimal risk and
the research involves no procedures for which written consent is normally required outside of the research context
or
the principal risks are those associated with a breach of confidentiality concerning the subject’s participation in the research and
the consent document is the only record linking the subject with the research.

Most survey research meets the requirements for waivers of signed consent, because surveys conducted outside of a research context rarely require written consent. However, it is important to note that it is the investigator’s responsibility to request waivers of documentation of consent, and the investigator’s rationale for a waiver may or may not be compelling to the IRB.

The following elements of consent are required by the Federal regulations (45 CFR 46.116(a)). The first set lists the requirements for all research. The second set is required only if deemed appropriate or applicable by the IRB.

(1) a statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject’s participation, a description of the procedures to be followed, and identification of any procedures which are experimental;

(2) a description of any reasonably foreseeable risks or discomforts to the subject;

(3) a description of any benefits to the subject or to others which may reasonably be expected from the research;

(4) a disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject;

(5) a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained;

(6) for research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained;

(7) an explanation of whom to contact for answers to pertinent questions about the research and research subjects’ rights, and whom to contact in the event of a research-related injury to the subject; and

(8) a statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.

Additional elements to be added as deemed appropriate by the IRB

(1) a statement that the particular treatment or procedure may involve risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) which are currently unforeseeable;

(2) anticipated circumstances under which the subject’s participation may be terminated by the investigator without regard to the subject’s consent;

(3) any additional costs to the subject that may result from participation in the research;

(4) the consequences of a subject’s decision to withdraw from the research and procedures for orderly termination of participation by the subject;

(5) a statement that significant new findings developed during the course of the research which may relate to the subject’s willingness to continue participation will be provided to the subject; and

(6) the approximate number of subjects involved in the study.

Yes. If there is a compelling reason to waive one or more elements, then the IRB may do so (45 CFR 46.116(d)). In the context of minimal risk survey research on mundane topics, where potential subjects might refuse to participate rather than listen to a lengthy informed consent process, an investigator might wish to minimize respondent time burden by requesting a waiver of one or more elements in the oral consent process and offering instead to provide the information in response to a subject’s question. For example, some IRBs have agreed to waive the required “explanation of whom to contact for answers to pertinent questions about the research and research subjects’ rights” if it is available to any subject requesting it. Importantly, it is the investigator’s responsibility to request waivers of consent or any specific elements of consent, and the investigator’s rationale for a waiver may or may not be compelling to the IRB.

The Federal regulations (45 CFR 46.116(d)) state that IRBs may approve a waiver of consent or any specific elements of consent if the IRB determines:

That no more than minimal risk to research subjects would be involved.

That the rights or welfare of subjects would not be adversely affected.

That the research could not be practicably conducted without a waiver.

Additionally, regulations require that, if appropriate, there be a plan to provide the waived consent information to subjects after the conclusion of the study. This would be the case for studies that involve deception.

In many cases, documentation of consent (the signature on a physical consent form) may be waived for questionnaires or interviews. Unless there is more than minimal risk, many IRBs will waive the documentation and allow the investigator to provide the relevant consent information in the form of a cover letter, introductory statement (in an interview), or introductory screen display (in a Web survey). Examples of “IRB-approved” consent documents for different forms of data collection are available on the AAPOR website. In cases where there is greater than minimal risk, a waiver of documentation may still be appropriate if the survey is anonymous because the signed consent form would be the only part of the study that identifies a subject. In other cases (e.g., surveys of minors), many IRBs will require documented permission granted by the parent or guardian.

Minimal risk means that the probability and magnitude of harm or discomfort anticipated are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests (45 CFR 46.102(i)). Most, but not all, surveys meet this definition.

According to the Federal regulations (45 CFR 46.101(b)), survey research may be exempt from the regulations unless “the information obtained is recorded in such a manner that the human subjects can be identified, directly or through identifiers linked to the subjects” or if “federal statute(s) require(s) without exception that the confidentiality of the personally identifiable information will be maintained throughout the research and thereafter.” The former refers to anonymous research. Anonymous means entirely without name or identifier, so the individual cannot be discerned in any way by anyone. No one can link an individual person to the responses of that person, including the investigator. For this reason, face-to-face interviews are never anonymous. If phone numbers or other identifiers are not stored, then RDD telephone interviews could be considered anonymous. Mailback questionnaires are considered anonymous only if no tracking codes are utilized.

Web-based surveys that are accessed through a common URL for the survey (instead of via individualized passwords or tracking codes) may be considered anonymous if they do not ask the respondent for any identifying information. However, some Web survey tools collect the IP address of the respondent’s computer, and this factor must be considered when determining the anonymity of the data collection process. Depending on the survey’s content, IRBs have sometimes allowed IP addresses to be collected and have still considered the protocol to be anonymous if the IP addresses are promptly removed from the file, or if investigators pledge not to use the IP address information to determine respondent identities. The IP address on the Web server is thus sometimes treated in a manner similar to the phone number stored in the CATI system in an RDD telephone interview. If using a commercial vendor to conduct a Web-based survey, be sure to read the terms of service to find what they record, collect, use, sell, etc. and decide what should be told up front to respondents.

“Confidential” means that the investigator can (or could) identify individuals who participated in a study, perhaps through a code, however the investigator will not share the confidential information to other than authorized individuals. Although the identities may be recorded, data can be kept confidential if they are carefully coded, if face sheets (paper questionnaire cover sheets with respondent identifiers) and consent documents are separated from survey instruments, if computer printouts that show respondent identifiers and other papers are properly disposed, if access to identifiable data is limited, if research staff are educated about the importance of protecting confidentiality, and if records are stored in secured locations. More elaborate procedures may be appropriate for research involving sensitive data that may involve a greater risk should confidentiality be breached, and investigators may want to seek Certificates of Confidentiality to protect such data from subpoena.

However, unless federal statutes mandate this confidentiality (e.g., statutes surrounding the decennial census), confidential surveys that are not anonymous are not eligible for exemption using these criteria. Confidential surveys may, however, still be eligible for exemption if any disclosure of the human subjects’ responses outside the research could not possibly place them at risk of criminal or civil liability or be damaging to their financial standing, employability, or reputation.

Yes, you need parental consent. Because children have not yet attained legal age, the parent or legal guardian is asked to give permission for participation whenever a child is asked to take part in research (45 CFR 46.408(b)). Federal regulations require, however, that children be asked to provide assent, or agreement to participate in the research, whenever they are capable of doing so. Age, maturity and psychological state need to be taken into account when determining whether to ask for assent (45 CFR 46.408(a)). Out of respect for developing persons, it is important to involve children in the decision-making process whenever possible. Though they may not be able to give legal consent, they have the ability to assent or to dissent. It is important to keep in mind that a child’s failure to object to participation should not automatically be construed as assent. Assent implies the affirmative, explicit agreement of the child.

Usually children who are age seven and older are asked to provide verbal assent or, in some cases, sign an assent form, which is stated or written in language appropriate to the ages and conditions of study subjects. The assent should include a description of the study and describe any inconveniences and discomforts subjects may experience. IRB requirements may vary regarding the age at which a signed form is required.

NOTE: While parental consent is usually required, all states have an ‘emancipated minor’ status for youth under 18 that meet certain conditions. In those cases, the child has the legal authority to provide informed consent, and parental consent is not required.

Yes. The project may not meet the definition of human subject if the questions are not about any individual (attributes, attitudes, or private knowledge). However, this determination is sometimes difficult to make and the decision rests with the IRB, not with the investigator.

Yes. All research must be reviewed by the IRB. If the project is minimal risk, then it may qualify for exemption or be handled in an expedited review by the IRB. The specific decision rests with the IRB or with an administration official named by your institution, not with the investigator.

It depends. This question deals with an issue known as third party consent. Although the Federal regulations do not deal with this issue explicitly, the question has received increasing discussion over the last several years. Many IRBs would conclude that, when an investigator conducting research obtains identifiable private information about a living individual, that individual becomes a research subject, regardless of whether that person is the individual with whom the investigator is having an interaction. For example, if the research involves asking the primary subject to provide identifiable private information about a third party (also known as a secondary subject), that third party then becomes a subject in the research. As such, all of the regulatory requirements for protecting that individual obtain.

IRBs may differ in their interpretations of “identifiable private information.” To better understand the issues of interpretation, consider two examples: (1) an unemployed person provides household income information for a two-person household in which only one household member is employed; (2) a mother provides health information about the father of her child. In the first example, the information is identifiable, but may not be considered private. In the second example, the information is private, but may not be considered identifiable if no identifying information was gathered about the father. However, if an IRB determines that these examples represent “identifiable private information” (as it may reasonably do), then the Federal regulations require informed consent from the employed person or the father before such questions are asked of the unemployed person or the mother.

The IRB can determine whether informed consent needs to be sought from third party subjects. The IRB can also determine whether this consent may be waived. The Federal regulations (45 CFR 46.116(d)) state that IRBs may approve a waiver of consent if the IRB determines that the research poses no more than minimal risk to the secondary subject, that the rights or welfare of the secondary survey would not be adversely affected, that the research could not be practicably conducted if consent from the secondary subject were required, and that, if appropriate, there be a plan to provide the waived consent information to the secondary subject after the conclusion of the study.

Investigators whose research may involve secondary subjects are encouraged to contact the IRB to discuss how to best protect the rights and welfare of these subjects in a given project. Other information on the issue of third party information is available at:

https://osp.od.nih.gov/clinical-research/privacy-and-confidentiality-in-research/

During their review of research, IRBs are expected to make a determination about whether any risks to subjects are reasonable relative to the expected benefits. When determining whether the risks to subjects are outweighed by the benefits of the research, the IRB may take into account the merits of the scientific design (45 CFR 46.111(a)(2)). If the scientific merit is deemed marginal, then the IRB may determine that there will be no benefit and that any risk is therefore unwarranted.

Rather than reject marginal research outright, some IRBs will tell investigators how to improve the scientific merit of the research. The regulations specify that the IRB must include persons knowledgeable in the specific research areas being reviewed (see 45 CFR 46.107a), with sufficient “experience and expertise to promote respect for its advice and counsel.” Although many issues are common across social science methods, some are not. In cases where expertise is lacking on an IRB, the IRB should seek consultation from experts outside the IRB for assistance in a review. Investigators should consider asking about expertise and suggesting colleagues that might be knowledgeable about the specific research areas being reviewed. Investigators can also direct the IRB to the AAPOR website for additional information and assistance regarding issues related to human subject protections when utilizing survey methods.

Under the current system, IRBs have local control and review protocols in the context of the local and community attitudes. Hence, approval from an IRB in another place or institution is not considered sufficient if there is also a local IRB in place. Therefore, protocols require review at the investigator’s institution even if they have been reviewed and received approval from a co-investigator’s IRB. IRBs do, however, have the option of relying on another qualified IRB in order to avoid duplication of effort (45 CFR 46.114). Don’t expect your IRB to defer jurisdiction if you have direct contact with the subjects. But if you are only acting in an advisory role, only adding a few questions to an omnibus survey, or only engaged in analysis issues, then your limited role in the research may convince your IRB to rely on the qualified IRB at another place or institution. The regulations permit, but do not encourage, such actions for cooperative research projects.

Yes, if the survey is for a research purpose. Computer- and Internet-based research protocols must address fundamentally the same risks (e.g., violation of privacy, legal risks, psychosocial stress) and provide the same level of protection as any other types of research involving human subjects. All studies, including those using computer and Internet technologies, must (a) ensure that the procedures fulfill the principles of voluntary participation and informed consent, (b) maintain the confidentiality of information obtained from or about human subjects, and (c) adequately address possible risks to subjects including psychosocial stress.

Electronic recruiting and data collection pose some additional challenges to human protections primarily in the area of confidentiality. The key challenges can be broken down into 4 areas:

RECRUITMENT: Computer- and Internet-based procedures for advertising and recruiting potential study subjects (e.g., Internet advertising, e-mail solicitation, banner ads) should follow the IRB guidelines for recruitment that apply to any traditional media, such as letters, telephone scripts, newspapers and bulletin boards. Authentication – that is, proper qualification and/or identification of respondents – is a major challenge in computer- and Internet-based research and one that threatens the integrity of research samples and the validity of research results. Researchers should take steps to authenticate respondents. For example, investigators can provide each study subject (in person or by letter) with a Personal Identification Number (PIN) to be used for authentication in subsequent computer- and Internet- based data collection.

DATA COLLECTION: It is often recommended that any data collected from human subjects over computer networks be transmitted in encrypted format. This helps insure that any data intercepted during transmission cannot be decoded and that individual responses cannot be traced back to an individual respondent. In addition, if the content of the responses would pose risk to the respondents if the information were shared, it is recommended that the highest level of data encryption be used, within the limits of availability and feasibility. It should also be noted that encryption standards vary from country to country and that there are legal restrictions regarding the export of certain encryption software outside the US.

SERVER ADMINISTRATION: It is recommended that for online data collection a professionally administered survey server be used or that: a) the server is administered by a professionally trained person with expertise in computer and Internet security, b) access to the server is limited to key project personnel and is configured with firewalls to minimize the possibility of external access to the server data, c) there are frequent, regularly scheduled security audits of the server, and d) the server is subject to the periodic security scans.

DATA STORAGE/DISPOSAL: If a server is used for data storage, personal identifying information and IP addresses should be kept separate from the data, and data should be stored in encrypted format. Data backups should be stored in a safe location, such as a secure data room that is environmentally controlled and has limited access. Competent data destruction services should be used to ensure that no data can be recovered from obsolete or discarded electronic media. For projects that are minimal risk, if these data security safeguards cannot be put in place, then language in the consent information should be added indicating that complete confidentiality cannot be guaranteed and/or that encryption of responses is not provided.

In some cases, the IRB may want only an explicit statement in the consent information indicating that risks are minimal and are no greater than those encountered in day-to-day life. In other cases, even demographic items might be viewed as “potentially harmful” by some IRBs if, for example, knowledge of income, religious affiliation, or educational attainment might pose a social risk in some contexts if the data were made public. In these cases, the introductory consent information might include disclosure that general items about income and education will be included in the interview. For other surveys of more sensitive topics, possible harms include embarrassment, psychological distress, or discomfort as a result of question content (e.g., surveys of private behaviors, abuse, or crime victimization). Some IRBs may require investigators to include the explicit statement that respondents may skip any item that they do not wish to answer. Additionally, mere contact may put a potential subject at risk depending on the survey and its target population. For example, the act of contacting individuals who have completed rehabilitation programs could be damaging if their families did not have knowledge about their treatment. All of these potential risks will be important to the IRB and will need to be anticipated and addressed by the investigator in order to provide adequate subject protections.

Investigators sometimes want access to existing records in order to identify potential subjects or in order to conduct research. If the investigator will record subjects’ names (either for further record review or for personal contact), this activity requires IRB review. The IRB will determine whether the consent of subjects should be sought before the researcher gains access to the records; in some cases, a waiver can be granted. When determining whether it is appropriate to waive the requirement to obtain consent from these subjects, the IRB considers the sensitivity of the information being recorded, the vulnerability of the subject population, and other risks to the subject. The IRB also considers whether the rights or welfare of the subjects would be adversely affected by the waiver, the purpose for which the investigator wants access to the information, and the practicability of conducting the research without the waiver. In some cases, consent cannot be waived. For example, the Buckley Amendment [the General Education Provisions Act (20 USC 1232), also known as FERPA] requires written parental permission for release of records or identifiable information about children in public schools. It is also important to note that recent HIPAA (Health Insurance Portability and Accountability Act) regulations are applicable to most medical records and may impact access and/or the ability of IRBs to grant consent waivers.

The Privacy Rule is a Federal regulation under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 that governs the protection of individually identifiable health information. The Rule was enacted to increase the privacy protection of health information identifying individuals who are living or deceased, and to regulate known and unanticipated risks to privacy that may accompany the use and disclosure of personal health information. The Privacy Rule is a regulation in addition to the Common Rule (45 CFR 46).  Whenever the Common Rule and the Privacy Rule do not agree, researchers should follow the regulation that provides the higher privacy protection.

HIPAA directly regulates three types of organizations that are defined as covered entities:

  • Health care providers (both individuals and organizations who directly provide health care to patients)
  • Health plans (insurers and payers)
  • Health care clearinghouses (billing services)

While most AAPOR members conducting health research will not be employed by a covered entity, the source of their human subject data may come from a covered entity and therefore the researcher must be prepared to follow the applicable Privacy Rule requirements when such data involve Protected Health Information (PHI). PHI includes all individually identifiable health information transmitted or maintained by a covered entity, for living and deceased individuals, regardless of form.

There are several ways that researchers can obtain PHI from a covered entity while following the Privacy Rule.

  • If a researcher only needs existing data and does not need to further contact any individuals, the covered entity can provide the data de-identified. De-identified data no longer include variables that may be necessary for research. Therefore, the Privacy Rule also allows a covered entity to provide a Limited Dataset that can retain:

·         Dates
·         Geographic information (but not street address)
·         Other unique identifying numbers, characteristics or codes
A limited dataset is designed to be used one time (so no follow-up can be done) and the recipient of the limited dataset must sign a Data Use Agreement that defines who will have access to the PHI, how the PHI will be used, and prohibits re-identifying individuals or using the information to contact individuals.

  • If the researcher plans to build their respondent database through a review of records containing PHI, and does not need to see the names of all potential respondents, then the study invitation can be made through the covered entity and contact information for only those individuals who want to proceed with the study would be provided to the researcher.
  • If a covered entity receives written authorization from an individual to provide their data for a specified purpose, then that PHI can be provided to a researcher.
  • A covered entity’s IRB can grant a waiver of authorization when the following conditions are met:
  • There is no more than minimal risk to privacy based on a plan to protect any identifiers, a plan to destroy identifiers ASAP, and a written assurance that the PHI will not be re-used or disclosed except as required by law or for authorized oversight of the research.

·         The research could not be done without the waiver of authorization.
·         The research could not be done without this PHI.

If a researcher’s company is hired by a covered entity to perform a service that involves PHI on behalf of the covered entity, the Privacy Rule considers that organization to be a Business Associate and the two organizations need to complete a Business Associate Agreement (BAA) before any PHI can be provided. The BAA will describe how the researcher will receive, protect and return the PHI following the guidelines of the covered entity.

Yes. The definition of research in the Federal regulations includes research development, testing, and evaluation (45 CFR 46.102(d)). Some IRBs might not consider such studies research if they are not systematic but overall, pilot studies and feasibility studies, including those involving only one human subject, require the same scrutiny as full-scale research projects. Pilot studies should be identified as such in applications to the IRB. Ordinarily the data collected from subjects in a pilot or feasibility study are not used for study findings.

Yes. The definition of research in the Federal regulations includes all research. However, the review process varies across institutions. If a “survey” is done for a class project, does not include vulnerable populations, is minimal risk, and will not be presented or published (e.g., as a thesis or scholarly paper), then some IRBs do not define the work as research and do not require formal review. Other IRBs review all student projects, including classroom demonstration projects.
Therefore, it is important to review your institutional policies and to provide adequate time for preparation of applications and review when planning student projects.

Many professionals are subject to legal requirements to report the intent to harm oneself or others. Most IRB committees expect that professionals conducting research will comply with their professional reporting requirements and although the legal requirements to do so when acting as a researcher may not always be clear, there is an argument that the ethical obligation remains even if no clear legal requirement exists. Requirements differ by state and sometimes even county so if an investigator is conducting data collection that is likely to require mandatory reporting disclosure, the laws/requirements for all jurisdictions must be reviewed for all locations in order to include the applicable legal risks in the consent documents across locations. Regardless of mandatory reporting requirements, most survey centers train their interviewers to refer respondents to local crisis hotlines or other appropriate local agencies (e.g., domestic violence intervention number) if acute distress or danger is apparent during an interview.

Yes. The recruitment protocol would need to either screen out Facebook users under age 18 or obtain permission from the parent or legal guardian. The Children’s Online Privacy Protection Act (COPPA) mandates that websites that collect information about users (like Facebook) are not allowed to sign on anyone under the age of 13, but many Facebook users are in the 13 to 17 age range and need to be duly protected in survey recruitment.

It is necessary to consider how much information is presented on a map that could potentially reveal the identity and Personally Identifying Information (PII) of a survey participant, including if it would be possible to determine the housing unit in question.  Convey to the IRB the geographic detail in the presented information and how that relates to risk e.g., “we present thematic maps at the Census tract level, which are coarse enough in our case to carry no risk of disclosure by themselves.”

For many health studies, in addition to collecting survey data the researcher may want to collect some biological specimens from the respondents, such as urine, blood, buccal cells, or hair. While these biospecimen provide a valuable source of information when studying health conditions, they also present many issues of concern to the study participants. Unless the biospecimen are absolutely required from every respondent, it is good practice to have the specimen collection require its own opt-in on the consent form, by either having the respondent check a box or sign a separate consent statement on the form. This way, respondents who want to participate without contributing a biological specimen can do so, with a sense of assurance that their specimens will not be required.

Consent forms need to also address the additional concerns that participants have about contributing a biological specimen, including:

  • Why the specimen is needed
  • What specific tests will be done on the specimen
  • Who will be collecting the specimen – what their training or qualifications are
  • Where the specimen collection will take place
  • What precautions will be taken to ensure the collection will be safe and pain free
  • What risks are involved with the specimen collection
  • If anyone will be looking at the respondent’s DNA or conducting any genetic tests on the specimen
  • If the sample will be stored after it is tested for this study
    • If stored, how long it will be maintained
    • If stored, whether it will be identifiable
    • If stored, who can use the specimen in the future and for what purposes
  • If not stored, when and how the specimen will be disposed
  • Whether respondents can later change their mind about storing the specimen

Most biological specimen collections can still be considered minimal risk by an IRB as they pose no greater harm than encountered during a regular visit to a health care provider when collected by qualified individuals in a safe environment.

Yes. The mobile nature of cell phone technology allows for a respondent to be engaged in numerous activities and to be physically present in various locations that would not normally be expected with other modes of administration (e.g., fixed landline or paper questionnaire). In particular, the operation of a motor vehicle or any type of potentially harmful machinery by a respondent during a research interview presents a potential hazard to the respondent and to anyone else in the general vicinity of the respondent (e.g., fellow passengers in the car). However, even if someone is merely walking about while speaking on their cell phone, this could increase their chances for physical harm occurring. Any researcher who conducts a survey that reaches people on a cell phone should take appropriate measures to help protect the safety of the respondent and whoever else may be nearby. Merely asking respondents whether they are operating a motor vehicle is insufficient because the potential risks from distraction are not limited to driving. Questions about specific activities also suggest inappropriately that the researcher is in the best position to make judgments about the respondent’s safety. It is suggested that researchers leave the responsibility for determining safety to the respondents themselves and encourage respondents to consider their own safety by asking about it directly (e.g., ―Are you in a place where you can safely talk on the phone and answer my questions?). If respondents indicate that they cannot safely talk, contact should be quickly ended, and interviewers should not extend the contact at that time by attempting to schedule an appointment for a callback.

The fact that cell phone survey respondents are often reached outside their homes also raises privacy concerns. Whenever it is appropriate and based on the nature of the topics being surveyed, researchers should design their cell phone questionnaires so that answers to sensitive questions may be provided in a nondisclosive categorical format (e.g., answering with a “A, B, C” or “1, 2, 3”) rather than voicing more disclosive responses. It is recommended that checks on safety and privacy be made independently and at different stages of the interview. For example, a question about safety could appear immediately after a brief introduction, and/or midway through the questionnaire. Questions about privacy could follow a description of the survey, which would permit respondents to make informed decisions about the risks of disclosure. For additional information regarding legal and ethical issues surrounding cell phone surveys, the 2010 AAPOR Cell Phone Task Force Report is recommended.

One might think that exempt status would give the investigator complete freedom over the conduct of the research, but the IRB retains an interest in the exempt study and at least some authority over its conduct.  At present, there seems to be considerable local variation in the amount of control exercised by the IRB over an exempt study and, conversely, the amount of flexibility that is afforded to the investigator.  At many institutions, exempt studies are not subject to annual re-review but may be exempted for several years if the protocol does not change.  Of course, if any unanticipated adverse events occur during the course of an exempt study, the IRB must be promptly notified.

Of particular importance for survey researchers is the ability to modify a protocol, including changes to the questionnaire or interview script, survey invitations and reminder notices.  The quality of surveys is clearly improved when investigators can make small changes—without undue delay—during the process of questionnaire expert review, survey pretesting or production.  Practice currently varies substantially across institutions as to whether such changes require advance written IRB approval (as would likely be the case for an approved, non-exempt study), or whether some changes can be made in exempt studies without advance written approval.  At institutions where advance approval is required, the process for approval of such modifications is generally an expedited process.  Where changes are allowed without advance approval, the IRB may require that notice be given after the change (for example, by submitting the final version of the questionnaire for the IRB’s records on the project).  The scope of allowable changes for an exempt study also varies across institutions.

When it comes to flexibility in modifying protocols for survey research studies, informal and unwritten understandings seem to be the norm, especially for investigators with broad experience in conducting exempt studies and good records of cooperation and compliance.  Inquire locally to learn the approach being used at your institution with respect to minor modifications of questionnaires, survey invitations and reminders in exempt and non-exempt studies.

Yes. Interviewers are required to have HSP training. In essence, anyone who has contact with human subjects during the course of a research project is considered “key personnel” for the purpose of this rule. While all key personnel must be trained, the NIH does not endorse any specific educational programs. Institutions have the freedom to determine what programs are appropriate for fulfilling the education requirement.

Several options are available, including developing your own in-house training and testing program. Others include, but are not limited to:

  • Require staff to read the textbook: Protecting Study Volunteers In Research: A Manual for Investigative Sites (3rd ed.), Dunn, C.M., & Chadwick, G.L. (2004), Boston: CenterWatch, Inc.
  • Require staff to complete the Collaborative Institutional Training Initiative’s (CITI) Social and Behavioral Research training module. This can be tailored to your institution’s needs.  Indeed several institutions require only a short version of the CITI Social and Behavioral Research training which includes only a few of the most relevant modules for interviewers. These often include: History & Ethical Principles, The Regulations and the Social/Behavioral Sciences, Assessing Risks, Informed Consent, and Privacy and Confidentiality.
  • Require staff to complete NIH’s free tutorial – Protecting Human Research Participants (http://phrp.nihtraining.com/users/login.php).

The regulations do not directly address payment of subjects. Whether or not individuals are paid for participating in research can depend on a number of factors, including availability of funds and the extent of effort on the part of study subjects. When subjects are reimbursed for direct expenses incurred due to research participation (e.g., parking and transportation), there is no ethical debate. However, IRBs will pay particular attention to incentive payments (e.g., payments for participation) to determine whether they could have an undue coercive effect on a prospective subject’s ability to make an informed, voluntary choice about taking part in research. This is especially important when participation may include more than minimal risk or low income subjects are involved.

If compensation or the use of incentives is to be part of your study, it is important to include specific information in the IRB application and to provide detailed information about payment (including terms) in the informed consent information.

Payments and compensation for research participants are viewed by most institutions as subject to Internal Revenue tax laws (the guidance about research participants was clarified by the IRS in 2008). Hence, most institutions now have policies or guidelines that apply to the use of payments for research participants. Some institutions have a ceiling on the amount an individual may earn in any one study or during a given length of time (e.g., per year, per semester).  Some have maximums for any given study (some as low as $25) that trigger a requirement to obtain the participant’s Social Security Number (SSN) and contact information and possibly a signed IRS W-9 form.  Current tax laws require that institutions issue a 1099-misc form to each person who is paid $600 or more in a given year. Although few research participants would reach this level of payment for any given year, many institutions issue guidelines about maximum payments to assure that such payments can be tracked by the institution. These requirements are often at odds with the protection of participant identity and minimizing risk of breach of confidentiality.  Because the public has been appropriately educated not to disclose their SSN except to select financial or government officials, the requirement that participants in the research supply the researcher with this information can represent a significant obstacle to participation and may increase the risk of a breach of confidentiality. Researchers should, therefore, structure their use of incentives so as to avoid making such requests of prospective respondents.

To satisfy internal audit requirements, most institutions require careful record-keeping for handling incentive payments.  Whether utilizing gift cards, checks, cash or non-cash gifts, a process should be developed for reconciling the amount of incentive payments provided with the number of participants receiving such payments. That is, the investigator should be able to produce a record indicating the participant names (or ID numbers) and the amounts they received – or the gift card code assigned to them.  Accounting for all cash or gift cards in undeliverable mail packets would also be needed.

Additionally, using incentives can involve handling large amounts of cash or large numbers of gift cards (e.g., enclosing a two-dollar bill in each of 1,000 mailing pieces will require handling of $2,000). It is important to confirm that all institutional policies for secure handling of cash or gift cards are being followed. Key concerns are likely to be: having a safe or other secure location for storage of cash or gift cards, need for security personnel when receiving or transporting cash or gift cards, and security of questionnaire packets (in mail-back modes) that include cash or gift cards.

It is important to note that participants who “win” prizes from sweepstakes or drawings used as an incentive are also subject to these tax laws. Hence, a participant who receives a tablet or other electronic device may exceed the minimum payment amount for research participants and be subject to the reporting requirements for the institution.

Finally, some institutions also categorize any student research participation incentives as part of the total amount of money awarded in any financial aid package. Therefore, incentive payments may impact the amount of tuition or other offsets awarded to the students who are paid to participate in a research study. This may serve as a negative unintended consequence of using financial incentives for some student populations.

Additional IRB Resources

Here are some more useful resources for dealing with human protections/IRB issues: