Policies & Procedures
Update on the Final Rule and Introduction of the Ď㽶Đă IRB Flexibility Policy
 (a change in the regulations governing IRB activities, called the Common Rule) was initially slated to go into effect in January 2018, but its implementation was delayed just before the official-roll out and postponed until July 18th, 2018. On June 19th, U.S. Department of Health and Human Services  delaying the implementation of the Final Rule once again until January 21st, 2019, while allowing institutions to implement, at their discretion, three of the burden-reducing provisions of the Final Rule beginning on July 19łŮłóĚýfor all new studies. These provisions include:
- Use of the revised definition of “research,” which deems four categories of activities as not research (certain journalistic, public health surveillance, and criminal justice or intelligence activities)
- Eliminating continuing review for expedited studies and any full board studies that are in the Data Analysis Only phase
- Eliminating the requirement for IRB review of grant applications for research
Boston College will adopt these provisions for all new studies submitted on or after July 19th, 2018, regardless of funding source.
Additionally, institutions have some options for handling ongoing studies that were approved before July 19th, 2018. For example, they can continue to treat them under the “old rules” that were previously applied, wait until January 21st, 2019 to apply any changes, or begin to implement the burden-reducing provisions on July 19th, 2018.
We have decided that all existing expedited Boston College studies (submitted before July 19th, 2018), will undergo one final continuing review, after which they will no longer require continuing review in subsequent years, unless the IRB determines on a case-by-case basis that they require additional monitoring (due to the risk profile of the protocol).
New Boston College IRB Flexibility Policy
The Office for Research Protections at Boston College engaged in a benchmarking process over the past few months to see how our IRB’s policies matched up against those of some peer institutions. At Ď㽶Đă, a small proportion of our active IRB protocols are federally funded, which are the only protocols that must follow the federal regulations (the Final Rule). As an institution that has never “checked the box” on our Federal Wide Assurance with the Federal Office for Human Research Protections, Boston College has flexibility in how to treat our non-federally funded protocols. To date, the Boston College Office for Research Protections has chosen to treat all federally funded protocols in the same way as all other protocols, i.e., federal guidelines have been applied to allĚý±č°ů´ÇłŮ´Çł¦´Ç±ô˛ő.
In general, the fact that Ď㽶Đă has chosen to treat all projects as if they were federally funded is burdensome for researchers. In response, we have decided to implement a more flexible set of IRB policies to be applied to all non-federally funded research protocols, launching on July 19th, 2018.
What is changing under the Ď㽶Đă IRB Flexibility Policy?
We plan to incorporate a number of changes proposed in the Final Rule and apply them to all non-federally funded studies, including:
Broadening existing categories of exempt research
- The existing categories of surveys, interviews, educational tests, observations of public behavior (already exempt) will be expanded to include the collection of some kinds of sensitive and identifiable data. However, the following are still not allowed: interventions that do not fall into the definition of “benign behavioral intervention” (see below); the collection of biospecimens; linking to other personally-identifiable data; and research with children (except for educational tests)
- The scope of secondary data research (already exempt) will be expanded to allow: maintenance of identifiers if all study data is protected health information (PHI), and prospective data review (meaning data do not need to be “on the shelf” at the time of the study, as required pre-2018).
 Implementing a new category of exempt research
- The new “benign behavioral intervention” category permits data collection via an interaction (e.g., survey, interview, audio/visual recording) from adult subjects with prospective agreement. A “benign behavioral intervention” is defined as one that is brief in duration, harmless, not physically invasive, painless, not embarrassing or offensive, and not likely to have a lasting adverse impact. Example: having subjects solve puzzles under various noise conditions.
- However, the following are not included in this exempt category: research with children, deception, physiological data collection methods, linking to additional personally-identifiable data
Implementing minor changes to informed consent
- These are already implemented on our consent templates on the ORP website
Eliminating continuing review for most new studies
- Research that qualifies for expedited review will typically not need annual continuing review
- Studies in the Data Analysis Only phase will typically not need annual continuing review
- In rare cases, the IRB may require continuing review due to the risk profile of a protocol
- In the place of continuing reviews, we have developed a Quality Assurance Program which is detailed here.
Additionally, the Department Chair’s signature will no longer be required for protocol submission. The Department Chair will still receive notification of all submissions, but will not need to log into Cyber to electronically sign them. We expect this change to reduce delays in the submission process.
Please note that the amendment process for staff changes or any other protocol alteration has NOT changed.
We are excited about these changes and expect the new Flexibility Policy to reduce the administrative burden associated with research involving human subjects. As always, please contact us at any time with questions or feedback, and feel free to visit us during office hours or make an appointment with our staff.
More Policies and Procedures
HIPAA stands for the Health Insurance Portability & Accountability Act of 1996. You can read a summary of the law here. Among other things, HIPAA requires “covered entities,” such as health plans and most health care providers, to safeguard the privacy and security of individually identifiable health information that they create or receive. Notably, HIPAA prohibits covered entities from using or disclosing persons’ individually identifiable health information for purposes of research unless the covered entities satisfy certain requirements and conditions.
Boston College does not meet the criteria for being a covered entity under HIPAA. This means that Boston College does not have a regulatory obligation to comply with HIPAA. Regardless, we have an ethical obligation to safeguard all information we collect concerning research subjects, especially information generally regarded as private, such as health information.
Additionally, if you are planning to do research with a HIPAA covered entity, such as a hospital or health care plan, you likely will have to abide by HIPAA regulations in order to satisfy the covered entity’s requirements. Please contact the IRB so that we can help you determine if there is any additional paperwork that should be completed to obtain HIPAA-compliant authorizations or HIPAA waivers before beginning your research
Institutional Authorization Agreement
If you are conducting research at Boston College in conjunction with another university, hospital, or other institution that has an IRB, you may request an Institutional Authorization Agreement (IAA), also known as a Single IRB, Reliance Agreement, etc.
What is an IAA?
An IAA is an agreement between multiple IRBs to cede review to one of the IRBs engaged in the research (the IRB of record). An IAA is helpful because it takes the burden off the PI to have to submit revisions, amendments, etc. to multiple IRBs for the same study. With an IAA, the PI can submit any changes to ONE institution (the IRB of record), who then reviews and approves the protocol. The PI has the responsibility of sending the other IRBs (the relying IRBs) any updated approvals from the IRB of record to keep on file.
How do I decide who the IRB of record is?
Typically, the IRB of record is the IRB where the majority of the research will be conducted, the main funding recipient, or the institution that the main PI is affiliated with. It is generally up to the PI or IRBs to determine who the IRB of record is.
How do I request an IAA?
To initiate an IAA at Boston College, you must submit an application through CyberIRB. In CyberIRB, there is an option to begin an IAA application on the left side of the page. Click “Single IRB (IAA)” to begin the process. There are two options depending on who the IRB of record is.
If Ď㽶Đă is the IRB of record, you should select “Institutional Authorization Agreement – Ď㽶Đă.” This application is almost identical to our initial application, with one additional section that asks for the relying institution’s IRB information.
If Ď㽶Đă is the relying IRB, select “Institutional Authorization Agreement – Other.” This is a short form and simply asks for a brief description of the study and information about the IRB of record.
You must also upload your consent form(s), training certificates, and IRB approval from the other institution.
What happens next?
With the information provided, our staff will contact the other IRB and initiate the IAA. A form will be signed and sent between the institutions. Once the form is signed by all signatory officials, your IAA has been executed. We will send you the fully executed agreement via e-mail, and an official IRB approval letter (if we are the IRB of record). The amount of time this process takes is dependent on how quickly the other institution reviews and signs off on the IAA.
NOTE
IAAs are only executed between IRBs that are both engaged in the research. If you are simply recruiting participants and collecting data at another institution, but that institution is not engaged (researchers working on the study) in the research, it would simply be considered a research site, and an IAA would not be appropriate. (See here and here for OHRP’s definition of institutions engaged in research)
Boston College IRB Quality Assurance Program
With the impeding changes to the Common Rule and our newly drafted flexibility policy, the Boston College Office for Research Protections seeks to reduce the amount of time researchers need to spend on IRB-related paperwork while maintaining our commitment to protecting human subjects and complying with federal regulations. After benchmarking IRB practices at a number of peer institutions, we have developed a Quality Assurance Program (QAP) to provide internal oversight on compliance issues and record keeping with less administrative burden on researchers than the annual Continuing Reviews, which will be phased out for most expedited projects.
As researchers know, elimination of the Continuing Review requirement for a project does not affect a researcher’s obligation for maintaining records (e.g., current consent forms, up to date lists of research personnel), although the elimination reduces the number of forms that need to be submitted to the IRB. As outlined below, the QAP program consists of reviewing a small number of projects. If one of your projects is selected for QAP review, the process will be similar to a Continuing Review for that project.
We are hopeful that this policy will provide helpful guidance for researchers and administrators. We will seek input on the procedure so that it is maximally efficient.
How will protocols be chosen for the Quality Assurance Program?
Protocols will be chosen randomly, with a focus on expedited studies, although some exempt studies may be selected based on the risk profile of the research. For the 2018-19 school year, we anticipate randomly selecting a small number of studies each month from our database of all ongoing studies, but they can be studies that were initiated at any time (i.e., not limited to studies started in 2018-19). We will not select any closed protocols or protocols in the data analysis only phase.
What will happen once my protocol has been chosen?
We will email you to notify you that your protocol was selected, and to set up a short meeting with you within 2 weeks of the email. We will ask you to send us copies of all consent forms and instruments that you are currently using, as well as a current staff list, and we will compare them to the versions that are currently approved. Our office will review of all of your protocol’s submissions, including the initial submission, and any continuing reviews or amendments. (You do not need to send us these things because we have them on file through Cyber IRB).
What will happen during the Quality Assurance meeting?
During this short meeting, at least one member of the Office for Research Protections staff will meet with the PI or a research team member of the PI’s choosing. The PI may invite any research staff of his or her choosing. You should be prepared to answer questions such as those listed in the . This is not an exhaustive list of questions, and you may not be asked all of these questions.
We will also solicit your feedback and ideas about the IRB process—what is working well and what could be improved—so that we can further refine our processes.
What will happen after the Quality Assurance Review?
The Office for Research Protections will write up a report that details the findings of the review and meeting no later than 2 weeks after the meeting date. In this report, we will describe when the meeting took place, a list of significant findings, such as whether your research is compliant with Ď㽶Đă and (if applicable) federal regulations and any discrepancies between the approved protocol and current practice. The report will also identify any areas where record keeping or practices could be improved, and will provide educational resources where necessary. If there are any discrepancies between your approved protocols and your research project, we will list those so that you can address them.
A draft of the report will first be sent to the PI for review. The PI can then approve it as is or suggest changes for accuracy. Once the ORP staff has drafted a final version of the report, a copy will be sent to the PI, the Vice Provost for Research, and the IRB Chair. If we have asked you to make any changes to your existing protocol or research practices, we will ask you to submit a letter detailing how those changes will be addressed within 2 weeks of receiving the report. If there are significant findings, the report may be reviewed either by the IRB staff, the IRB Chair, or convened IRB at its next meeting, as appropriate.
How do I know if my project needs IRB review?
Boston College administration relies on OHRP Guidance “OHRP Chart 1: Is An Activity Research Involving Human Subjects Covered by 45 CFR 46” to make determinations on IRB review requirements. Once you have consulted the OHRP Chart and you feel that your project meets the definition of research and qualifies for research with human subjects, your project will fall into one of three categories of IRB review: exempt, expedited or full board (more than minimal risk). Ultimately, all research studies that are submitted for IRB review are screened by OPR staff for the level of IRB review required.
If you have any questions about making a valid human research determination or which level of review your project qualifies for. please contact ORP. It is ultimately the responsibility of ORP staff to make valid human research determinations and decide which level of review is required. ORP staff would be pleased to assist you by phone at 617.552.4778 or email at irb@bc.edu.
Note about Funded Research: For externally funded research, please wait until funds have been awarded before submitting a protocol application to the IRB. Kindly note that you must submit the funding proposal for all federally sponsored research with your protocol application.
EXEMPTION REVIEW:
Some research may be eligible for an exemption from IRB review according to the rules stated in 45 CFR 46.101 (b) and for FDA governed research in 21 CFR 50 and 56. Research that is eligible for exemption may only be exempted by the IRB administration not the investigator.
Investigators must be aware that only minimal risk research qualifies for exemption from IRB review. Research that is officially exempted from IRB review requires no further interaction with the IRB or the Office of Human Research Participant Protection unless the PI would like to change study procedures or adverse events occur.
What is required for exempt review?
- Complete the IRB application in CyberIRB marking the "exempt" category.
- Complete the integrated research summary in CyberIRB.
- Upload any supporting documents into the supporting documents grid (informed consent, surveys, recruitment materials, instruments, site permission letters, IRB approvals from other institutions, etc)
- The training completion certificates for all research staff interacting with data. See the Training Policy on our main page for guidance and any exceptions.
- Via Cyber, sign the application and, if applicable, send it to the faculty research supervisor or Chair/Dean for signature.
EXPEDITED REVIEW:
All research studies that are submitted for IRB review are screened for the level of IRB review required. Minimal risk research that includes procedures outlined in the Expedited Categories, will be reviewed by one or two IRB members on an ongoing basis.
What is required for expedited review?
- Complete the IRB application in CyberIRB marking.
- Complete the integrated research summary in CyberIRB.
- Upload any supporting documents into the supporting documents grid (informed consent, surveys, recruitment materials, instruments, site permission letters, IRB approvals from other institutions, etc.).
- The training completion certificates for all research staff interacting with data. See the Training Policy on our main page for guidance and any exceptions.
- Via Cyber, sign the application and, if applicable, send it to the faculty research supervisor or Chair/Dean for signature.
FULL COMMITTEE REVIEW:
Any research activities that pose greater than minimal risk to participants must be reviewed at a convened IRB meeting. These reviews are called Full Board reviews. In some cases these studies require additional procedures to reduce risk. If you are planning a research study that may be greater than minimal risk, you may contact ORP for guidance.
Full board materials should be submitted via CyberIRB. You should follow the procedures for what is required for expedited review. Once your IRB application has been submitted, you will work closely with ORP staff on the next steps.
The IRB meets once a month on every 3rd Wednesday of the month. All materials must be submitted to ORP 10 business days prior to an IRB meeting date to be included in the agenda. If the materials are submitted and the application is incomplete, the protocol will not be able to be reviewed at that month's meeting. Instead, it will have to be revised by the PI and re-submitted for consideration of the next month's IRB meeting. No research may begin until final IRB approval has been granted.
ORP has a classification system for storing human subjects data. View our policy
Oral history activities, such as interviews that serve only to document an individual’s life history or general reflections on past events are not considered “human subjects research.” However, oral history that is meant to contribute to generalizable knowledge is subject to IRB review.
Example not requiring IRB review:
A history student plans to interview students about their reactions to the presidential election of 2016 to gather thoughts and feelings from that day.
Example requiring IRB review:
A history student plans to interview veterans to understand PTSD and help to inform the development of an intervention to assist those suffering from PTSD. The researcher also helps to understand predictors of PTSD based on the findings in the interviews.
It is common for researchers to give gift cards or small payments to research participants as an incentive. When working with the Departmental Research Administrator (DRA) to distribute these payments, the PI should not give the DRA any confidential information about the participants. Instead, the PI should give the DRA a list of ID numbers assigned to each participant. The PI should maintain a list of IDs and the name/contact information to which they are linked in a secure location. This should be maintained in a secure location for the life of the award plus three years after the final financial report is filed with the sponsor. Â
Guide to IRB Protocol Closure
When should I close an IRB protocol?
When you will no longer have any interaction with human subjects, and you will only be analyzing de-identified data, you should close your study. At this stage, participants will have finished all data collection activities, and no new enrollment may take place. Analysis of private, identifiable information must be completed before closing your IRB protocol. You should also close an IRB protocol if the study was canceled before you began to implement it.
How do I close an IRB protocol on Cyber IRB?
Log into your CyberIRB account, and locate your project under the “My Approved” tab. Once selected, click the “Closure” button on the left hand side of the screen. Fill out the short closure form, and submit it. It will then be reviewed by the IRB office and you will receive a confirmation when your project has been closed.
I am leaving Ď㽶Đă to go to another institution. What should I do with my IRB protocol?
If you have completed all interactions with human subjects and will only be analyzing de-identified data, you should close your protocol. If you plan to continue your project, you should contact the IRB at the institution to which you are moving. Follow their instructions for opening the study at the new institution. Please note you will need to submit a closure form through CyberIRB before moving to your new institution, because your CyberIRB access will end when you leave Ď㽶Đă.Â
I’m closing my project. What should I do with my data and consent forms?
If your study is funded, you should check with your funder to determine if there are any restrictions on where and for how long data should be stored. Otherwise, you must retain for at least three years following the completion of your project any records related to your research, including protocol documents, consent documents, and study data.
I’m a student and I am graduating. What happens with my Ď㽶Đă IRB protocol?
Once you leave Ď㽶Đă, the Boston College IRB can no longer have any oversight of your project. You should submit a project closure form through Cyber IRB if your study is complete and you will no longer interact with human subjects or analyze data with individual identifiers. If you plan to continue your study, and your continued work on the study would fall within the scope of your employment or other affiliation with a new, non-Ď㽶Đă institution, you should consult with your new institution’s IRB office to determine whether and how the new institution’s would want or need to review, approve and/or otherwise oversee your project. Once your affiliation with Ď㽶Đă ceases, the Ď㽶Đă IRB will no longer have oversight of your project.
If you plan to continue your study in your private, individual capacity, you will need to consider whether continued IRB oversight will be required. Note that a number of private IRBs offer
fee-based review and oversight of human subject research protocols. You may ask the Ď㽶Đă Office for Research Protections to consult with you on an informal basis regarding whether continued review by another IRB would be required or desirable.
I’m a faculty advisor, and my student has graduated. What are my responsibilities with regards to their data?
We recommend that you make contact with your former student, and confirm whether or not all data collection is complete, and whether analysis of any private or identifiable data is complete. If data collection and analysis of identifiable data is complete, you may submit a closure form through Cyber IRB on behalf of your student. If you would like to take over the project as PI and leave it open at Ď㽶Đă, you should have your student submit an amendment making you the new PI. If your student no longer has access to Cyber IRB, please email our office at irb@bc.edu so that we can request this change for you.
If I close my IRB protocol, can I still analyze the data for publication?
Yes, you can still analyze de-identified data and write up results for publication. Be aware that, in the case of funded projects, a funding agency might have asked for some control over your research results. For example, they might require you to submit a draft manuscript to them for review in advance of submission to any journal for publication. Please review the terms of your funding agreement or contact the Office of Technology Transfer and Licensing for guidance if needed.