Institutional Review Board

Frequently Asked Questions




Online Research

Outside researchers

Is my project considered research involving human subjects?

The Code of Federal Regulations Title 45 Part 46 Protection of Human Subjects (45CFR46) provides definitions for research and human subjects:

  1. Research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. The concept of generalizability is usually applied to quantitative research, but in this sense also applies to qualitative research because of the expectation to contribute to knowledge.
  2. Human Subject means a living individual about whom an investigator conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information.
  3. See examples of research activities as applied to the federal definition of human subject research.

In order to determine if your project is Human Subjects Research, please submit the following form (Determining Research) to the IRB office to render that determination and allow us to provide documentation for your records.

What is informed consent and when is it needed?

In almost all cases, consent must be obtained from the research participants or their legally authorized representatives (parents or guardians) before participation in research begins.

The informed consent process is a basic ethical obligation for researchers. It consists of providing adequate information to the subject about the study, giving the subject the opportunity to consider options, responding to the questions the subject may have and ensuring that the subject or the legal representative understands the information. In addition, the process includes obtaining the subject's voluntary agreement to participate in the research, typically indicated by the subject's signature on the written consent document. After the subject's signature is obtained, the informational process should continue as required by the situation or the subject, both during and after the study.

For exempt research involving anonymous minimal risk survey data collection , the consent process may be as simple as having consenting participants read a document that includes the elements of informed consent and a statement advising them that completion of the survey indicates their consent.


Why do I need approval from the IRB for my research involving human subjects? I am an experienced researcher and I have never had to do this before.

The IRB policies and procedures apply to all research conducted by faculty, staff or students at Xavier University, regardless of experience and even if no federal funding is sought for the study. The federal government has mandated protection for human subjects in research since the mid-1970's as a recommendation of the Belmont Commission, whose function was to articulate the ethical principles of conducting research with human subjects. The principles of respect, beneficence and justice were published in the Belmont Report and adherence to these principles must be documented in each study conducted under the auspices of any agency receiving federal funds. The federal Office of Human Subjects Protections (OHRP) is the oversight agency for institutional review boards (IRB's) located in universities, hospitals and other agencies in which research is conducted. Although much discretion is left to the institution regarding the functioning of the IRB, the federal rules and regulations (45CFR46) mandate that certain protections must be verified by the IRB before data can be collected. Failure to comply places the institution at risk for the loss of federal funding and at risk for lawsuits by research subjects based upon ethical violations. In recent years, the OHRP has gradually begun holding universities accountable for ensuring compliance and federal funding has been halted in some institutions. As a result, Xavier University has developed policies and procedures designed to ensure compliance with the federal regulations. The IRB policies and procedures apply to all research conducted by faculty, staff or students at Xavier University, regardless of experience and even if no federal funding is sought for the study. As a result, Xavier University has developed policies and procedures designed to ensure compliance with the federal regulations.

What is Assent and when is it needed?

Because children have not yet attained legal age, the parent or legal guardian is asked to give permission for participation whenever a child is asked to take part in research. Federal regulations require, however, that children be asked to provide assent, or agreement to participate in the research, whenever they are capable of doing so. Age, maturity and psychological state need to be taken into account when determining whether to ask for assent.

Out of respect for developing persons, it is important to involve children in the decision-making process whenever possible. Though they may not be able to give legal consent, they have the ability to assent or to dissent. It is important to keep in mind that a child's failure to object to participation should not automatically be construed as assent. Assent implies the affirmative agreement of the children.

My research involves protected health information. What do I need to know?

The HIPAA Privacy Rule regulates the way certain health care groups, organizations, or businesses, called covered entities under the Rule, handle the individually identifiable health information known as Protected Health Information (PHI). See the Other Protections for Human Subjects in Research section of the IRB Policies and Procedures Manual.

Why does the IRB need details about my data analysis and study planning? What does that have to do with appropriate treatment of human subjects?

There are two main reasons the IRB is concerned with these kinds of details. The first is to ensure that your project meets the definition of "research" that governs IRB functioning, which includes that the study must be "systematic." Our attention to these details is part of making sure that your study actually qualifies for IRB review. The second reason is much more critical. As the level of risk increases, it is incumbent on the IRB to ensure that the study being proposed is conducted in a fashion that is rigorous enough to provide scientifically meaningful results. Studies which pose heightened risk to participants but which do not demonstrate a rigorous approach to data collection, data analysis, or any other aspect of study planning, are problematic because they make it unlikely that the project will contribute to generalizable knowledge (another key facet of the Code of Federal Regulations definition of "research"). If the IRB determines that the project creates a risk for participants greater than the project's likely benefits to the larger community, the IRB has no choice but to disapprove the project. This is the core of human research protection. Please note that disapproving a study is not something our IRB (or any IRB) does lightly, and we will attempt to give researchers every opportunity to provide clarifications and updates to their methodology before a final vote to disapprove is made.

Can I have someone other than the individuals listed on my IRB documents provide statistical consultation on my analyses after data are collected?

Yes. However, if such an individual is either (a) allowed to view a copy of the data set that contains participant identifiers or (b) provided with a copy of the dataset that they may reasonably be expected to save to their local computer, that individual should be considered "Project Personnel" and their name and role in the project should be submitted to the IRB using a Modification Request Form, along with documentation of human subjects training (CITI certification).

What is the Federalwide Assurance number and the XU IRB registration number?

  • Federalwide Assurance number: FWA00010889
  • XU IRB registration number: IRB00004019

When does the IRB meet?

The IRB will meet on a monthly basis during the academic year. A meeting may be canceled at the discretion of the IRB chair if no full protocols are to be reviewed. Meeting dates are announced on the IRB web site.

Is there a time limit on IRB approval? Are there other limitations to IRB approval?

Studies determined to be exempt from review are not subject to IRB oversight, so a time limit is not applicable. Studies approved in the expedited or full board review categories are generally approved for one calendar year. If the IRB determines that special risks apply, approval may be granted for less than one year. At the end of the approval period (or upon completion of the study if completion precedes the approval expiration date), you must submit a Progress Report.

How long does a full IRB review take?

Researchers should submit their protocols at least one working week prior to the next scheduled IRB meeting in order to be considered for the agenda, and it is encouraged to submit the protocol at least two weeks prior to the meeting. Protocols received after the deadline will normally be delayed until the next scheduled meeting. The IRB chair will inform researchers within five (5) business days after the scheduled meeting the results of the IRB review of the protocols. (Exempt and expedited research will generally be reviewed without a meeting, but the researcher should still allow ten (10) business days for review.)

What kind of timeline should I plan on for IRB review?

It varies based on the project. As is noted elsewhere, our initial response for an Exempt-status protocol should usually come within a week. Expedited take a little longer, and Full Board longer still. Almost no study is approved without some number of clarifications being requested, however, so the initial response is not the end of the process. Depending on your schedule and your availability to write up your clarifications/update your protocol, it would not be uncommon for an Exempt-status study to take as long as 3-4 weeks from initial submission to final approval. For an Expedited or Full Board study, because multiple reviewers are involved, the initial review tends to take longer, and the response letters from our office are often more detailed. It is wise to not plan on beginning data collection until at least 4-6 weeks following your initial IRB submission for anything at the Expedited level, or 6-8 weeks at the Full Board level. This allows time for us to review your submission, you to revise based on our comments, and us to issue a second letter. Sometimes that second letter will be an approval, but it is not uncommon for there to be issues that remain unresolved, or for new issues to emerge based on changes made to the original protocol. We will turn things around as quickly as we can, but it is important to recognize that this is usually a multi-step process. Believe us - we'd like you to be approved almost as much as you'd like to be approved!

What about during summer?

The IRB does not have scheduled meetings in the summer. Exempt and Expedited protocols will still get processed as quickly as possible (the IRB office is open most of the summer, and the Chair is accessible), but we strongly recommend planning on submitting anything that requires Full Board Review during the Fall or Spring semester. If you do submit a protocol requiring Full Board Review during summer, please be sure to contact the IRB office and/or the IRB Chair with any questions you might have prior to submitting, so that major areas of concern can be addressed and the number of iterations the review requires can be minimized. Because no IRB meetings are scheduled in the summer, the 6-8 week timeline for full-board review mentioned in another answer is unlikely to be met, and it is important that you do everything you can to make your initial materials as thorough as possible.

How can I minimize the number of letters I receive from the IRB during the review process?

Detail, detail, detail. The more you tell us about your study and how you will protect your participants, the fewer questions we will have. Most of the key things we need to know are mentioned in our application materials and the study summary document available on our website, but not every study fits cleanly into that framework. When in doubt, err on the side of giving us too many details. It is also perfectly fine to ask questions prior to submitting, in the interest of refining your materials prior to the first round of review.

What if I am planning a study involving human subjects and do not believe it meets these criteria or am not sure if it meets these criteria?

It is the responsibility of the IRB, not the researcher, to determine whether a study involving human subjects is considered research subject to the federal policy. If the research is not subject to the federal policy, it is determined to be exempt from review, but the study must be submitted to the IRB (IRB Submission Form) in order for the official determination to be made. The IRB Submission Form includes a section to aid researchers in determining if the project may qualify for exemption. The submission, review, and approval process for exempt research is generally fairly simple and does not require a meeting of the IRB since only one or two IRB members review the submission. (Use the Course Certification Form rather than the IRB Submission Form for courses incorporating course required student-conducted survey research that involves neither sensitive topic areas nor minor subjects. See below.


What if my study is not exempt?

Research that is not exempt is reviewed under one of two categories (or levels) of review, expedited review or full board review according to the policies of 45CFR46. The expedited review process is used for certain kinds of research involving no more than minimal risk or for review of minor changes to already approved research. Minimal risk is defined in the regulations as the probability and magnitude of physical and psychological harm that is normally encountered in the daily lives, or in the routine medical, dental or psychological examination of healthy persons. The expedited level of review does not require a meeting of the board but is subject to the same requirements for human subjects protection as studies requiring full board review. Research that does not meet criteria for either exemption or expedited review must undergo full board review which requires a meeting of the IRB. While the expedited review only requires review by two or three members of the board, the same requirements for human subject protection apply as apply to protocols requiring full board review. See the Types of IRB Review and Approval section in the IRB Policies and Procedures Manual for more information.

May I advertise to recruit participants for my study? May I recruit participants for my study before IRB approval?

Advertisements and consent forms must be approved by the IRB so these cannot be used until IRB approval is received. Under no circumstances may data be collected without IRB approval.

What if I want to change something in my study after the IRB has reviewed it?

If a modification to any approved study is planned, the modification must be approved by the IRB prior to implementation of the modification. Submit the Modification Request Form to initiate the review and approval process.
A modification is any minor change to an approved protocol that does not materially alter the study as originally approved. This may include the addition or removal of survey items, minor changes to recruitment materials, or the addition of data sources comparable to the original sample. Whether a modification is “minor” is always at the discretion of the IRB.
More substantial changes (e.g., changing variables, introducing new manipulations, the recruitment of a new sample that is sufficiently distinct from the original that it requires a new informed consent) will generally need to be submitted as part of a new protocol.

What is an adverse event and what do I need to do if one occurs during my study?

Injury to subjects, breaches of confidentiality and unapproved deviations from the protocol are examples of adverse events that must be reported to the IRB and the research halted if necessary. The researcher must immediately report such events to the IRB and submit the Adverse Event Report.

Can I use research assistants on my study, and if so, what does the IRB need to know about them?

The IRB needs to be made aware of anyone who will be interacting with participants and their qualifications to do so in order to ensure that the rights and safety of the participants will be adequately protected. As such, the use of research assistants has to be communicated to the IRB, and documentation on their having completed NIH training, as well as any study-specific training needed to adequately protect participants, must be provided. When possible, information about research assistant recruitment and status (i.e., graduate vs. undergraduate) should be provided.

Since you ask about data analysis, if I decide to do additional analyses, does that mean I need to submit a Modification Request Form to the IRB to get the new analyses approved?

If you are doing additional analyses to clarify findings in an IRB-approved study, no. The IRB needs to be notified of any modification that substantively changes your data collection (including addition of new data collection sites, changes in methodology that impact participant experiences, etc.) or increases the level of risk for participants; conducting follow-up analyses on your data set as part of an approved research protocol does neither of these things. If you decide to use the same dataset to address a new research question, however, that new study should be submitted to the IRB using normal procedures. Assuming you have de-identified your data set, such follow-up projects are generally reviewable as Exempt or Expedited studies.

What changes qualify as a modification and what changes require a “new” protocol? Why?

A modification is any minor change to an approved protocol that does not materially alter the study as originally approved. This may include the addition or removal of survey items, minor changes to recruitment materials, or the addition of data sources comparable to the original sample. Whether a modification is “minor” is always at the discretion of the IRB. If you make changes that materially impact the experience of participants (e.g., changing variables, introducing new manipulations) or that add new participant populations, it is likely that your study will need to be reviewed as a new protocol.
It is important that the IRB thoroughly and accurately document review of research as it is conducted. Such review protects both participants and the university.

I teach a course in which my students engage in instruction-related research involving human subjects. Do all of these projects need IRB approval?

You must submit a Course Certification Form every two (2) years. If more than one instructor teaches the course, each instructor must submit a form. The submission of this form will certify to the IRB that the instructor is fully cognizant of the policies of Xavier University with respect to the protection of human subjects in research and will exercise reasonable and customary instruction supervision in an attempt to ensure that all student research projects will be conducted in compliance with these guidelines. Student-conducted studies which fall under the category of full board review must be submitted to the IRB even if the course is certified. All human subject research studies conducted to satisfy master's thesis or doctoral dissertation requirements must be submitted to the IRB.

Can I collect data from my own students?

The IRB actively discourages investigators from collecting data in their own classes. This is viewed by many as coercive, because as the instructor of the class, the investigator has non-trivial power over the students. There is at least subtle pressure present, in such situations, which may cause students to feel compelled to take part even if they do not actually wish to do so. Someone other than the lead investigator should handle the recruitment and collection of data, with the lead investigator absent from the room so that students feel free to decline to participate without fear of reprisal. In some cases, a department administrative assistant or faculty colleague has done this on behalf of an investigator. The investigator should not have access to the data until after grades are submitted at the end of the semester, and this should be communicated to student participants. Doing so ensures that students feel confident that their decision to participate or not participate has no impact on their grades.

I am a adjunct faculty member at Xavier University and am doing research.  Can/should I submit to the Xavier IRB?

It depends on whether you are acting as an “employee or agent” of Xavier University in the conduct of your research. If any of the following is true, then Xavier University would be “engaged in” the research, and our IRB should be a reviewing body of record: 

  • If you are conducting your research on behalf of Xavier University. (If you are doing research as part of your responsibilities for any other institution, including one that you personally own, it is not “on behalf of” Xavier.)
  • If you are exercising institutional authority or responsibility in the conduct of your research. (If you are conducting research as part of your role as an adjunct faculty member, this would be the case.)
  • If you are conducting your research as part of performing institutionally designated activities. (If you are conducting research because you have been instructed by your department that this is expected of adjuncts, this would be the case.) 

If none of these apply, then our IRB would not be an appropriate reviewing body.

Our IRB reserves the right to determine applicability of our oversight on a case-by-case basis. When in doubt, please ask.

Can I use online data storage sites, and if so, what do I need to do to protect the security of my data?

Researchers are responsible for protecting the privacy and confidentiality of their study-related data, whether it is in tangible (e.g.. interview transcripts) or electronic format. Regardless of format, all data must be securely stored so that only those who are authorized to do so can access the information. Storing data online is acceptable as long as measures are taken to ensure that its security is protected.

For additional information regarding storing data online at Xavier, please see Xavier’s Cloud Storage Policy. Only Xavier approved online storage locations are permitted.

Additional Security Practices

Researchers can implement additional strategies to protect the security of data stored in any Xavier approved online service. These include:

  • Password-protect all devices (i.e.. computers, tablets, smart phones) that can be used to access the data (Carney et al., 2000).
  • As with hard copies of research materials, information containing identifiers should be stored in files that contain no other information (Carney et al., 2000). An additional level of security can be added by password-protecting the individual files (i.e.. a feature of Microsoft Word).
  • Avoid sharing files with research team members by email attachment or emailing a hyperlink to the files.

Can I use MTurk ( for online data collection?

Use of any online data collection tool must be evaluated by the IRB on a case-by-case basis. The mturk site serves as a front-end that can connect prospective employees/research participants to employers/researchers. The site was not designed with research such as yours in mind, in all likelihood. Rather, it was created as a means by which ?micro-tasks? could be presented to a large and willing audience of potential employees. That it has become increasingly common as a ?research gateway? represents an evolution of the tool, and one that IRBs are keeping a close eye on. Like any tool, it must be used with caution and with the utmost care for the rights of research participants.

When using, please bear in mind that it is (as of this writing) a subsidiary of, and captures all of the information about its users that Amazon captures. The privacy page ( makes it very clear that information mturk has about its users includes (but is not necessarily limited to) names, email addresses, and telephone numbers. In order to use mturk and get paid, your prospective participants must also provide the system with their social security number. In other words, mturk knows a great deal of identifying information about your participants.

In order to protect your participants? privacy, then, you cannot collect any sensitive information within the mturk site. For purposes of our IRB, anything you might ask as part of a typical research process that goes beyond what the owners of would otherwise know about your participants qualifies as ?sensitive information.? As such, any actual surveys, questionnaires, or other research materials must be hosted on a site other than (e.g.,,,, You can link to such sites as part of setting up your HIT on mturk, and data collected on those sites will not be accessible to or archived by the owners of mturk. In the interest of caution, whenever possible, create hyperlinks to external websites using the secure transfer protocol (https://) rather than the standard, non-secure transfer protocol (https://)

The IRB does not explicitly regulate the amount of payment that can or should be offered to your participants via mturk. In deciding on an appropriate amount to offer for your task, please keep in mind both the length of time required and the relative rigor of the task, as these are factors that we will be considering in reviewing any mturk-related submission. A two-minute task that offers a reward of $5, for example, clearly constitutes a situation of excessive inducement and would be viewed by our IRB as potentially manipulative. On the other hand, a sixty-minute task that pays only $.02 would constitute exploitation of your participants, and also be viewed as problematic. Please provide a rationale for why the level of payment you have chosen for your study is appropriate, based on what you are requiring of participants in terms of both time and effort.

I am working on a project with faculty from another university. If my co-investigators receive IRB approval from their university, do I still need to submit the protocol with the Xavier University IRB?

Yes. The federal guidelines are meant to be a starting place from which institutions should develop their own policies and procedures regarding the use of human subjects in research. Since the XU IRB would not know if another institution's policy is compatible with ours, the XU IRB will conduct its own review of the project. If available, the researcher should submit the other institution's IRB approval to the XU IRB.

I am a [professor/staff member] at Xavier and I recently received a request from a non-Xavier researcher to distribute information about a study to my [students/colleagues]. They have IRB approval from their home institution. Does this need to go through Xavier's IRB before I send it out?

Unless someone employed by or acting on behalf of Xavier University is engaged in the research (that is, involved in the conduct of the study), our IRB does not need to be a reviewing body of record. Remember that you are under no obligation to distribute any research conducted by individuals who contact you, but that any research distributed must have been reviewed by the researchers' "home" IRB.

I am a researcher at another institution and would like to collect data at Xavier. Do I need to go through your IRB?

If no one at Xavier is serving as an investigator in conducting the study, our IRB is not an appropriate reviewing body because Xavier University would not be “engaged in” the research. You must still have IRB approval from your home IRB, or another accredited IRB.