What Activities Require VCU IRB Review?

The VCU IRB provides ethical oversight to all activities that meet the regulatory definitions of "research involving a human subject," meaning that any activity meeting both of the following definitions requires IRB review.

If an activity does not meet the regulatory definition of “research”, no IRB review is required. Similarly, if an activity is research, but it does not involve human subjects (as defined below), the research does not require IRB review. Failure to meet either definition means that the activity is not human subjects research.

NEW! If you need documentation from the IRB that your activity is not research or does not involve human subjects, use RAMS-IRB to submit a request for a determination. Learn how on our blog. RESEARCH (Systematic investigation designed to develop or contribute to generalizable knowledge) + HUMAN SUBJECT (Research about a living individual either through interaction or intervention OR use of identifiable private information) = IRB Review [View Image]

1. Is it Research?


Research: a systematic investigation designed to develop or contribute to generalizable knowledge.

  • A “systematic investigation” involves a predetermined system, method or plan for studying a specific topic, answering a specific question, testing a specific hypothesis, or developing theory. A systematic approach includes 1) the collection of information and/or biospecimens and 2) analysis, either quantitative or qualitative. Systematic investigations can also include research development, testing, and evaluation.
  • “Designed to develop or contribute to” refers to the investigator’s intentions when developing the protocol. Systematic investigations may be carried out for a variety of non-research purposes, but to meet this definition of “research,” one of the primary intentions of doing the project must be to develop or contribute to generalizable knowledge.
  • Generalizable knowledge is information that is collected or gathered to draw general conclusions or generalize outcomes beyond the specific group, entity, or institution. Generalizing outcomes might also occur through informing policy or informing professional knowledge in a discipline.

Activities That Are Not Research

Scholarly and journalistic activities

These activities include the collection and use of information that focus directly on the specific individuals about whom the information is collected (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship).

The focus of these scholarly and journalistic activities should NOT be on generalizing to other individuals. Whenever the focus is on understanding the beliefs, customs, and practices of the studied community or group, and not just to the individuals from whom the information was obtained, the activity would meet the definition of “research” and might require IRB review.

Public health surveillance activities

These activities must be conducted, supported, requested, ordered, required, or authorized by a public health authority. They should be limited to only those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance.

Public health surveillance refers to collecting, analyzing, and using data to target public health and disease prevention. Surveillance uses data from a variety of sources, including mandatory reporting of certain conditions, routine monitoring, vital records, medical billing records, and public health investigations.

Public health surveillance activities can include (but are not limited to) the following:

  • Collecting and testing information or biospecimens.
  • Collecting information about trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products.
  • Activities associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).

A public health authority is an agency or authority of the United States that is responsible for public health matters as part of its official mandate. A public health authority might be an agency of a state, territory, a political subdivision of a state or territory, an Indian tribe, a foreign government. It might also be a person or entity acting under a grant of authority from or a contract with such public agency.

Examples of public health surveillance activities that WOULD NOT be “research”:

  • Safety and injury surveillance activities designed to enable a public health authority to identify, monitor, assess, and investigate potential safety signals for a specific product or class of products.
    • For example, the surveillance activities of the FDA's Adverse Event Reporting System, the Vaccine Adverse Event Reporting System, Manufacturer and User Facility Device Experience database, the Medical Product Safety Network, and the Sentinel Initiative.
  • Surveillance activities designed to enable a public health authority to identify unexpected changes in the incidence or prevalence of a certain disease in a defined geographic region where specific public health concerns have been raised.
    • For example, the U.S. influenza surveillance system, which allows CDC to find out when and where influenza activity is occurring, track influenza-related illness, determine what strains of influenza virus are circulating, detect changes in influenza viruses, and measure the impact influenza is having on hospitalizations and deaths in the United States.
  • Surveillance activities designed to enable a public health authority to identify the prevalence of known risk factors associated with a health problem in the context of a domestic or international public health emergency.
  • Surveillance activities designed to enable a public health authority to locate the range and source of a disease outbreak or to identify cases of a disease outbreak.
  • Surveillance activities designed to enable a public health authority to detect the onset of disease outbreaks or provide timely situational awareness during the course of an event or crisis that threatens the public health, such as a natural or man-made disaster.
  • Surveillance activities designed to enable a public health authority to identify the prevalence of a condition of public health importance, known risk factors associated with a condition of public health importance, or behaviors or medical practices related to prevalence of a known condition of public health importance
    • For example, surveillance of the prevalence of tobacco use, exposure to secondhand smoke, lung cancer, or use of smoking cessation treatments.

Examples of activities related to public health that WOULD meet the definition of “research” because the purposes, context, or nature of these activities is to create generalizable knowledge:

  • Epidemiological research
  • Research evaluations of public health surveillance activities
  • Subsequent research using information collected during a public health surveillance activity (e.g., genetic analysis of biospecimens)
  • Exploratory studies designed to better understand risk factors for chronic diseases, including genetic predisposition for chronic diseases;
  • Exploratory studies designed to elucidate the relationships between biomarkers of exposure and biomarkers of disease;
  • Exploratory studies of potential relationships between behavioral factors (e.g., diet) and indicators of environmental exposures.

Criminal justice activities

The scope of these activities is the collection and analysis of information, biospecimens, or records by or for a criminal justice agency. They must be authorized by law or court order and done solely for criminal justice or criminal investigative purposes. These activities are ones necessary for the operation and implementation of the criminal justice system.


Examples of authorized criminal justice activities that WOULD NOT be “research”:

  • The FBI is charged by law with setting standards governing the collection and processing of DNA biospecimens and information taken (forcibly if necessary) from certain federal and state criminal suspects or offenders incident to their arrest or conviction for prescribed offenses under the National DNA Identification Act of 1994 and other acts.
  • The FBI is charged by law with setting standards governing the collection and processing of fingerprints and related biographical information taken from federal and state criminal suspects or offenders and certain sensitive civil employment applicants.
  • Many criminal law enforcement agencies routinely collect human biospecimens at crime scenes from or relating to victims, suspects, and offenders both known and unknown. Incident to these activities, the FBI is also charged with maintaining, and authenticating through identification processes, the criminal record history of criminal offenders for federal government agencies and for the overwhelming majority of state governments that elect to participate and share information through those systems.

Examples of activities related to criminal justice that WOULD meet the definition of “research”

    • Social and behavioral studies of the causes of criminal behavior.

Authorized operational activities in support of national security missions

These activities would involve only authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.

Quality Improvement activities

Determining if an activity is research and/or quality improvement can be challenging. Most quality improvement efforts do not meet the definition of “research” because they are not designed to be generalizable. However, in some cases quality improvement activities are designed to accomplish a research purpose as well as the purpose of improving quality, and in these cases, IRB review would be required.

Please review the following guidance, Quality Improvement vs. Research and use the REDCap Decision Tool to determine if your activity likely needs IRB approval PRIOR to beginning the activity.

The intent to publish is an insufficient criterion for determining whether a quality improvement activity involves research. Planning to publish an account of a quality improvement project does not necessarily mean that the project fits the definition of “research” because people seek to publish descriptions of non-research activities for a variety of reasons, if they believe others may be interested in learning about those activities. Conversely, a quality improvement project may involve research even if there is no intent to publish the results.

Examples of other activities that generally do not meet the “research” definition:

  • Student projects conducted for a credit class assignment where there is no intent to contribute to knowledge in the field of study.
  • Medical case studies involving no more than two patients are not considered systematic investigations.
  • Program evaluation activities where the data will only be used internally and there is no intent to publish or present the outcome

2. Does It Involve Human Subjects?


Human subject: a living individual about whom an investigator conducting research:

  • i. Obtains information or biospecimens through an intervention or interaction with the individual and uses, studies, or analyzes the information or biospecimens


  • ii. Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
  • An investigator is any individual who is involved in conducting human subjects research studies . Such involvement would include:
    • obtaining information about living individuals by intervening or interacting with them for research purposes;
    • obtaining identifiable private information about living individuals for research purposes;
    • obtaining the voluntary informed consent of individuals to be subjects in research; and
    • studying, interpreting, or analyzing identifiable private information or data for research purposes. Investigators can include physicians, scientists, nurses, administrative staff, teachers, and students, among others. (OHRP Investigator Responsibilities FAQs)
  • Intervention includes both physical procedures by which data are gathered (e.g., drawing blood) and manipulations of the subject or the subject's environment that are performed for research purposes.
  • Interaction includes communication or interpersonal contact between investigator and subject.
  • Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information.
  • Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (e.g., medical record information).
  • An identifiable biospecimen is a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen
  • The identity of the subject may be readily identifiable whenever:
    • Direct identifiers (e.g. names, phone numbers) are stored with the study data;
    • The study data is de-identified and the investigator has access to the key that links subject IDs with direct identifiers; OR
    • The investigator could probably re-identify individuals through deductive reasoning by using unique characteristics and combinations of data points within a dataset, even when direct identifiers are removed.

Activities that Generally Do Not Involve Human Subjects:

Research only using data about deceased individuals

  • Investigators accessing or using Protected Health Information about decedents for research purposes must submit a HIPAA Research on PHI of Decedents Certification Form.

Secondary data that are obtained by the investigator in a completely anonymous state when the investigator will have no access to the ability to re-identify individuals.

Secondary research involving non-identifiable newborn screening blood spots is not considered research involving human participants

  • The Newborn Screening Saves Lives Reauthorization Act of 2014 will no longer be effective following the effective date of the Revisions to the Common Rule, given that its changes applied only until changes to the Common Rule were promulgated.

3. Is VCU Engaged?

The VCU IRB must approve all research involving human subjects in which VCU is considered to be engaged. The University is engaged in research when one or more of the following apply:

  1. The human subjects research is sponsored by VCU;
  2. The human subjects research is conducted, in whole or in part, by members of the VCU faculty, staff or students acting in their university capacity regardless of the location of the research;

VCU faculty, staff or students are “engaged” in the conduct of human subjects research when interacting or intervening with a living individual for research purposes or when using identifiable private information or biospecimens about a living individual for research purposes.

VCU receives a direct federal award to conduct human subjects research, even when all activities involving human subjects are carried out by a subcontractor or collaborator.

4. Is It an FDA-Regulated Activity That Requires IRB Review?

The following clinical activities are not “research,” but FDA regulations require that they are reviewed by the IRB:

What Should I Do Next?

At VCU, investigators are responsible for determining whether an activity requires IRB review. However, investigators may submit their project to the IRB if they wish the IRB to make an official determination.

My Project Requires VCU IRB Review

(The project is or might be “research involving a human subject" and VCU is engaged)

If you have determined that IRB review is required, the next steps are to assess the project’s level of risk and what type of review is appropriate, Exempt, Expedited, or Full Board, and then to submit the study to the IRB electronically using RAMS-IRB. The IRB’s review decision will be sent in a letter to the Principal Investigator.

I Don’t Know Whether My Project Requires VCU IRB Review

If a determination cannot clearly be made, submit the project to the VCU IRB using RAMS-IRB and the IRB will make an official determination. If the activity is submitted to the IRB, the review decision will be sent in a letter to the Principal Investigator.

My Project Does Not Require VCU IRB Review

(The project is not “research involving a human subject" OR it is “research involving a human subject” but VCU is not engaged)

The project does not need to be submitted to the IRB. When an individual makes the determination that an activity does not constitute human subject research, the VCU IRB recommends that it be documented in writing (e.g. write a memo or note to file that explains how you think the definitions of “research” and/or “human subject” are not met). Then, request an acknowledgment/counter-signature from your Department Chairperson (or designee) to document that they concurred with your rationale. These records should be retained with other activity records. If an official determination letter from the IRB is required, submit the project to the VCU IRB using RAMS-IRB and the review decision will be sent in a letter to the Principal Investigator.


Other Resources

Refer to a Decision Chart provided by the Office of Human Research Protections (OHRP) to help determine whether an activity requires IRB review in most situations:

Who to Contact with Questions

If you have questions about whether your project needs VCU IRB approval, please contact ORSP at ORSP@vcu.edu or call 828-0868.

View graphic version