The Final Rule preamble states that for certain exempt categories of research, a limited IRB review should be done to ensure that there are adequate provisions to protect the privacy of subjects and to maintain confidentiality of data in the proposed research.

Guidance regarding “adequate provisions” will be issued by HHS but might address:

• The extent to which identifiable private information is or has been de-identified and the risk that such de-identified information can be re-identified;
• The use of the information;
• The extent to which the information will be shared or transferred to a third party or otherwise disclosed or released;
• The likely retention period or life of the information;
• The security controls that are in place to protect the confidentiality and integrity of the information; and
• The potential risk of harm to individuals should the information be lost, stolen, compromised, or otherwise used in a way contrary to the contours of the research under the exemption.

Limited IRB review is a condition for exemption of the research activities under the following categories at Colorado State University:

Category #2: Identifiable and sensitive educational tests, survey procedures, interview procedures, or observation of public behavior

Category #3: Identifiable and sensitive benign behavioral interventions

The requirement for limited IRB review is triggered when:

1. The information obtained is recorded by the investigator in such a manner that the identity of the human subjects can readily be ascertained, directly or through identifiers linked to the subjects, AND
2. Any disclosure of the human subjects’ responses outside the research would reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, educational advancement, or reputation.

When changes to research are proposed that fall within the scope of the limited IRB review requirement (e.g., storage or maintenance, privacy and confidentiality), the changes must undergo limited IRB review and be approved before implementation (except when necessary to eliminate apparent immediate hazards to subjects).

The IRB must conduct a limited review using expedited procedures. Thus, the review may be performed by the IRB Chair or “one or more experienced reviewers.from among members of the IRB.” Under limited review, reviewers can approve or require modifications in research but may not disapprove the research. Disapprovals must be by the convened IRB.

To clarify that IRBs have the authority needed to conduct limited IRB review, the Final Rule modifies the IRB authorities listed in 46.109 (approve, require modifications in, or disapprove research) by adding “including exempt research activities under 46.104 for which limited IRB review is a condition of exemption.”