NIH Human Subjects Research Protections and IRB Requirements

Federal regulations governing human subjects research establish binding obligations on every institution receiving NIH funding, requiring formal review processes, documented informed consent procedures, and ongoing monitoring by independent oversight bodies. This page covers the regulatory framework, the mechanics of Institutional Review Board (IRB) operations, classification criteria that determine review pathways, and the structural tensions that arise when research flexibility meets participant protection. Understanding these requirements is essential for investigators, research administrators, and compliance officers working within the NIH-funded research enterprise.

• Definition and scope
• Core mechanics or structure
• Causal relationships or drivers
• Classification boundaries
• Tradeoffs and tensions
• Common misconceptions
• Checklist or steps (non-advisory)
• Reference table or matrix

Definition and scope

Human subjects research protections at NIH operate under a dual regulatory framework: the Federal Policy for the Protection of Human Subjects, commonly called the Common Rule and codified at 45 CFR Part 46, and the Food and Drug Administration's parallel requirements under 21 CFR Parts 50 and 56 for research involving FDA-regulated products. NIH's own policies layer additional requirements on top of these baseline federal rules.

A "human subject" under 45 CFR 46.102(e) is defined as a living individual about whom an investigator conducting research obtains data through intervention or interaction with the individual, or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens. This definition controls whether a project triggers federal oversight obligations — activities falling outside it may not require IRB review at all.

The scope of NIH's human subjects protections extends beyond the institution receiving the grant. Under 45 CFR 46.103, each institution engaged in federally funded human subjects research must maintain a written Federalwide Assurance (FWA) filed with the Office for Human Research Protections (OHRP). As of the most recent OHRP registry data, more than 9,000 domestic and international institutions hold active FWAs, reflecting the reach of NIH-connected research networks globally.

For a broader orientation to NIH's regulatory obligations and policy landscape, the NIH Policies and Regulations resource provides context on how human subjects rules fit within NIH's larger compliance architecture.

Core mechanics or structure

The Institutional Review Board is the primary structural mechanism through which compliance is achieved. An IRB is a formally constituted committee — required under 45 CFR 46.107 to include at least 5 members, at least 1 member whose primary concerns are in nonscientific areas, and at least 1 member who is not affiliated with the institution — that reviews proposed research before it begins and monitors approved studies on an ongoing basis.

IRB review operates through three procedurally distinct pathways:

Full Board Review applies to research involving greater than minimal risk. The full convened IRB must review and approve the protocol, with a majority of members present and approval by a majority of members present at the meeting.

Expedited Review is available for research involving no more than minimal risk and falling within one of the 9 expedited review categories published in the Federal Register (January 19, 2017). A single experienced IRB member conducts this review.

Exempt Determination applies to 8 categories of research explicitly enumerated in 45 CFR 46.104. Importantly, investigators do not self-determine exemption — under the revised 2018 Common Rule, an institutional determination is required.

Beyond initial approval, the IRB sets a continuing review interval not to exceed 1 year for studies requiring full board review, conducts post-approval monitoring, and reviews amendments to approved protocols. The IRB also holds authority to suspend or terminate approval under 45 CFR 46.113 when research is found to have caused unexpected serious harm or to be proceeding in violation of IRB requirements.

Causal relationships or drivers

The current framework emerged directly from documented failures in research ethics. The Tuskegee Syphilis Study, which ran from 1932 to 1972 and withheld treatment from 399 Black men with syphilis without their knowledge, prompted the National Research Act of 1974 (Public Law 93-348), which in turn mandated the National Commission for the Protection of Human Subjects. That commission produced the Belmont Report in 1979 — a foundational document identifying three core ethical principles: respect for persons (autonomy and informed consent), beneficence (maximizing benefits and minimizing harms), and justice (equitable distribution of research burdens and benefits).

The Common Rule's 2018 revision, which took effect January 21, 2019, was driven by changes in research practice, particularly the growth of large-scale genomic research, biospecimen banking, and secondary data analysis. The revision introduced the concept of broad consent for storage and secondary use of identifiable biospecimens, added a new exempt category for secondary research with identifiable data, and required single IRB review for most multi-site federally funded studies — a change designed to reduce duplicative oversight burden while maintaining substantive protections.

NIH-specific drivers include the agency's authority under the Public Health Service Act to impose grant conditions. NIH's Policy on the Use of a Single Institutional Review Board for Multi-Site Research, effective May 25, 2017, operationalized the single IRB requirement for NIH-funded multi-site studies, directly reshaping how institutions structure their oversight infrastructure.

Classification boundaries

The most consequential classification decision in human subjects research is whether a proposed activity constitutes "research" under the regulatory definition and whether it involves "human subjects." Both conditions must be met to trigger 45 CFR 46 requirements.

Research is defined under 45 CFR 46.102(l) as a systematic investigation designed to develop or contribute to generalizable knowledge. Activities that do not meet this definition — including quality improvement projects, public health surveillance conducted by public health authorities, and some program evaluations — may fall outside the regulatory framework entirely.

The 2018 Common Rule reorganized exempt categories into 8 enumerated classes (45 CFR 46.104(d)(1) through (d)(8)), each with specific conditions. Key examples:

Vulnerable populations — including prisoners (Subpart C), pregnant women and neonates (Subpart B), and children (Subpart D) — trigger additional regulatory requirements beyond baseline 45 CFR 46 protections, and IRBs must apply the specific risk-benefit criteria contained in those subparts.

Tradeoffs and tensions

The human subjects protection framework generates genuine structural tensions that institutions and investigators navigate continuously.

Protection versus scientific efficiency: Stringent consent requirements and IRB review cycles can extend study timelines. The single IRB mandate was intended to reduce duplicative review in multi-site studies, but implementing institutions have reported variable experiences with the transition, including challenges in establishing reliance agreements between hundreds of institutions with distinct legal and compliance cultures.

Autonomy versus protection of vulnerable populations: Waiver of informed consent under 45 CFR 46.116(f) is permitted when research could not practicably be carried out without the waiver, among other conditions. Applying this provision to emergency medicine research, where enrollment must occur before consent can be obtained, creates tension between protecting individual autonomy and enabling research that could benefit the same population.

Data access versus privacy: Large-scale genomic databases containing identifiable or re-identifiable information from participants who consented under broad consent frameworks create ongoing tension. The NIH Genomic Data Sharing Policy, effective January 25, 2015, requires controlled access to identifiable genomic data but does not eliminate re-identification risk, which researchers have demonstrated using as few as 30–80 single-nucleotide polymorphisms.

Minimal risk determination: The regulatory definition of "minimal risk" — "the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life" (45 CFR 46.102(j)) — has been criticized for ambiguity. IRBs interpret this standard inconsistently across institutions, producing divergent outcomes for substantively identical protocols.

Common misconceptions

Misconception: Exempt research requires no IRB involvement.
Correction: Under the 2018 Common Rule, exempt determinations must be made by the institution or IRB — not by the investigator independently. Investigators submit for an exemption determination; they do not self-certify exemption.

Misconception: Quality improvement (QI) projects never require IRB review.
Correction: Whether a QI project requires IRB review depends on whether it meets the regulatory definition of research producing generalizable knowledge. QI activities that systematically collect data intended for publication or external dissemination may qualify as research. OHRP has issued guidance clarifying that the label "QI" does not automatically exclude an activity from regulatory coverage.

Misconception: IRB approval makes research ethical.
Correction: IRB approval establishes regulatory compliance but does not certify ethical perfection. The Belmont principles represent aspirational standards; the regulatory framework operationalizes minimum thresholds. Studies can be IRB-approved and still generate substantive ethical criticism from the research community.

Misconception: The Common Rule applies to all research at an institution.
Correction: The Common Rule applies to research conducted or supported by federal departments and agencies that have adopted it, and to research conducted at institutions that have extended the Common Rule to all research via their FWA. Institutions may limit their FWA to federally funded research, leaving privately funded research governed only by applicable state law and institutional policy.

Misconception: Continuing review is always required annually.
Correction: The 2018 Common Rule eliminated the mandatory continuing review requirement for research that has progressed to the point where only data analysis remains or involves only minimal risk research approved through expedited review, unless the IRB determines that additional oversight is warranted.

Checklist or steps (non-advisory)

The following steps reflect the standard procedural sequence for initiating NIH-funded human subjects research under the Common Rule framework:

1. Determine applicability: Assess whether the proposed activity constitutes "research" and involves "human subjects" as defined under 45 CFR 46.102.
2. Confirm FWA status: Verify that the institution holds an active Federalwide Assurance with OHRP, accessible through the OHRP FWA database.
3. Identify review pathway: Determine whether the protocol falls under full board review, qualifies for expedited review under one of the 9 enumerated categories, or may be exempt under 45 CFR 46.104.
4. Submit IRB application: File the complete protocol, including informed consent documents, data collection instruments, recruitment materials, and investigator credentials.
5. Address IRB contingencies: Respond to requests for modification or clarification within the timeframe specified by the IRB.
6. Obtain written IRB approval: Receive formal approval documentation specifying the approval date, expiration date, and any conditions attached to approval.
7. File NIH certification: For NIH grants, complete the Human Subjects section in the application and provide IRB approval certification as required. NIH's Grants Policy Statement specifies certification timing relative to award.
8. Implement protocol as approved: Any changes to an approved protocol — including changes to consent forms, study procedures, or personnel — require IRB review and approval prior to implementation, except when changes are necessary to eliminate immediate hazards to subjects.
9. Submit continuing review or progress reports: For studies requiring continuing review, submit before the IRB approval expiration date.
10. Report unanticipated problems: Report unanticipated problems involving risks to subjects or others to the IRB, as required under 45 CFR 46.108(a)(4), and to OHRP under applicable timelines.

Reference table or matrix

IRB Review Pathway Comparison

Key Regulatory Documents

Vulnerable Population Subparts Under 45 CFR 46