IRB Help, Processes, and Approval Timelines

The following resources contain information on KSU Policies, Common Mistakes and Questions, the IRB Process and more. We encourage you to review these resources to learn more about human subjects protections, processes, and approval timelines. If you need help don't ever hesitate to contact us at or call 330-672-2704. 

Kent State University FAQs and Policies:

IRB and Human Subjects Definitions
Protected Health Information (PHI) and HIPAA Compliance

What is Protected Health Information?

  • PHI is individually identifiable health information held or transmitted by a covered entity or its business associates, in any form or media, whether electronic, paper, or oral. More information can be found on the Health and Human Services website.

What is the Health Insurance Portability and Accountability Act (HIPAA)?

  • National standards to protect an individual's medical records and other personal health information and applies to health plans, healthcare clearinghouses, and those health care providers that conduct certain health care transaction electronically. The Rule requires appropriate safeguards to protect the privacy of PHI and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients' rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.   
  • HIPAA has three components, all of which are enforced by the federal Office for Civil Rights:
    • HIPAA Privacy Rule: protects the privacy of individual identifiable health information.
    • HIPAA Breach Notification Rule: requires covered entities and business associates to provide notification following a breach of unsecured PHI.
    • HIPAA Security Rule: sets standards for the security of electronic PHI.

How do I know if I am affected by the HIPAA privacy rule?

  • The HIPAA privacy rule affects research and researchers when:
    • Research requires access to and/or use of PHI that is created or maintained by covered entities, or
    • A covered entity or component of KSU performs research that creates or generates PHI.

What should I do if my research involves access to PHI?

  • You should review the relevant KSU policies on PHI/HIPAA protected information. 
  • Work with the privacy and security officers in advance of submitting your IRB application. 
  • IRB Policy
  • University Policy 
Research Involving Children

What are the consent requirements for working with children?

  • Generally, prior to consenting/assenting anyone under the age of 18 into a research project, investigators must seek the permission of the child’s parents/guardians through the use of a parental consent form. Assent is required of children age 12 years and younger in additional to parental permission. Assent is a child’s affirmative agreement to participate in research. Informed consent is required for children aged 13 to 18 and is required in additional to parental permissions.

Are there any other University policies I need to be aware when working with minors?

What special protections for Children as Research Subjects are required?

Do I need a letter of support to recruit children from schools?

  • Yes. If you plan to recruit children form a school (inclusive of high school, middle school, elementary and pre-k schools) your submission must be accompanied by an acceptance letter from the school’s principal or superintendent. If it is not practical to obtain an acceptance letter prior to approval please notify the reviewer/Office of Research Compliance.

Does the Protection of Pupil Rights Amendments (PPRA) affect my research? 

Do any of the exemption categories apply to research on children?

  • Yes. All elements of Category 1, 4, and 5. Category 2 research (educational tests, surveys, interviews, public behavior observation) applies only when procedures are limited to the observation of public behavior in which the investigators do not interact with the children or educational testing. Research involving surveys or interviews with children, or observation of public behavior when investigators interact with children, does not qualify for exempt status under this category

Does the Children's Online Privacy Protection Act (COPPA) apply to research? 



What must be included in research advertisements?

  • The IRB must approval all recruitment plans and advertisements prior to use. Please see our forms page for additional guidance and templates. In general, all non-exempt study advertisements must include,
    • Name of PI and contact information and institution
    • Title and purpose of the project and disclosure that project is for research
    • Inclusion/exclusion criteria in summary form
    • Brief listing or summary of procedures,
    • Time commitment
    • Potential compensation
    • Additional information – should not emphasize compensation or use catchy or enticing language or graphics.

May I use social media to recruit?

  • Yes, but it is important to understand the platform (to help ensure privacy and confidentiality) that is being used.
  • Many researchers use social media as part of their recruitment strategy. If your research recruitment plans include using social media (Facebook, Twitter, blogs, Instagram, etc.) you must submit a description of your plans (i.e., platforms, frequency of posting, and process of corresponding), copies of the exact text (including pictures) proposed for use during recruitment. Recruitment strategies using social media platforms should, whenever possible, follow the basic standards used for any other form of research recruitment. To help ensure privacy and ensure that potential participants are fully informed about the study, the IRB typically requires that initial posts on social media be more general in nature and allow users to link to a site that contains more detailed information about the study (consent form, eligibility requirements, etc).
  • The IRB does not endorse posting directly/publicly to any individual or organization’s social media account without prior authorization- such plans will be reviewed in context of the entire project.
  • To further help protect the privacy of participants, the IRB does not typically endorse the use of social media as a form of two way communication or the use of private accounts.
  • Please see our forms page for additional guidance and templates. 
  • Additional Guidance  0Mtg/internet_research.pdf

Are recruitment templates available?

  • Yes, visit the templates section of our forms page
Misc. Issues and A/V Guidance

What is FERPA and does it apply to research?

  • The Federal Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student records, both financial and academic. FERPA laws apply to research projects. For more information and to learn if FERPA rules apply to your research, click here.
  • If you will be using FERPA protected information as part of your study, we recommend working with the FERPA officers in advance of submitting your IRB application. 

Should I submit an amendment or a new application?

  • The general rule of thumb is that if you change any two of the three Ps (purpose, population, procedure) with one amendment request you need to submit a new application. If you change any two of the three over multiple amendment requests or if you are unsure if you need to submit a new application or an amendment, please contact the Office of Research Compliance.

Does Title IX apply to research?

  • Yes. All KSU employees and students are Title IX reporters and must follow KSU Policy.

Whom do I contact with questions? 

  • The Office of Research Compliance is here to help and you can contact us at You can also contact any IRB member.

What do I need to know about Certificates of Confidentiality?

Issues related to audio and/or video recording (including photography)

  • Recording should only be conducted when necessary to the research.
  • Recordings are considered identifiable until they are de-identified. Even if a recording does not capture an individual's face it may record other identifiers such as tattoos, birthmarks or vocal characteristics.
  • Researchers are responsible for knowing the recording laws for the jurisdiction where they are conducting the research. 
  • Personal cellphones should not be used to record.
  • Consent must be obtained from participants for future use of the recordings.
  • When recording in group settings you should have a plan for excluding those who wish to not be recorded. It is acceptable in most circumstances to exclude subjects who do not want to be recorded - prospective subjects should be advised of this. 
  • The consent process must explain the use of the recordings, what will be captured, storage, and retention/destruction.
  • If recording is optional, the consent form should include an additional line for express permission (see consent template).
Research Personnel

Who is considered an investigator?

  • The HHS regulations at 45 CFR part 46 use the term “investigator” to refer to an individual performing various tasks related to the conduct of human subjects research activities, such as obtaining informed consent from subjects, interacting with subjects, and communicating with the IRB. Investigators can include physicians, scientists, nurses, administrative staff, teachers, and students, among others. Some research studies are conducted by more than one investigator, and usually one investigator is designated the “principal investigator” with overall responsibilities for the study. In every human subjects research study, investigators have certain responsibilities regarding the ethical treatment of human subjects.
  • For the purposes of the HHS regulations, OHRP interprets an “investigator” to be any individual who is involved in conducting human subjects research studies. Such involvement would include:
    • obtaining information about living individuals by intervening or interacting with them for research purposes
    • obtaining identifiable private information about living individuals for research purposes;
    • obtaining the voluntary informed consent of individuals to be subjects in research; and
    • studying, interpreting, or analyzing identifiable private information or data for research purposes

What is required of the principal investigator?

  • The requirements are detailed in the application’s Assurance Page, but in general the principal investigator has overall responsibility for the study and the ongoing conduct of the approved research. This includes completing an IRB application and obtaining IRB review/approval, including continuing review and amendments if necessary, and ensuring the research is conducted as described in the protocol. Finally, the principal investigator must ensure all personnel working on the project are adequately and knowledgeable about research procedures and the ethical conduct of research.

Minors: Are there any special requirements for minors working in my lab?

  • Please review the KSU University Policy 5-19 Regarding Minors (  involving-minors) and complete any action that may be required of that policy. The minor must complete applicable training programs including CITI, lab specific training, and applicable training offered through Compliance and Risk Management. Additionally, the minor’s parent/guardian must complete a waiver that is available through Compliance and Risk Management.

Volunteers: Are there any special requirement for volunteers working in my lab?

  • Please review the KSU Administrative Policy 6-04.4 Regarding Volunteers (, complete appendix B and indicate they are volunteers (this will add the personnel to the project  or change the status of the personnel), and complete the Volunteer Agreement form. The Volunteer Agreement form must be signed by your Chair or Dean and maintained in the investigator/department file for at least two years beyond the completion of the volunteer’s duties. The minor must complete applicable training programs including  CITI, lab specific training, and applicable training offered through Compliance and Risk Management.

I am new faculty at KSU or I am new to human subjects research, what are tips on getting started?

  • We recommend starting by reviewing our IRB Help page (including the video overview) and completing CITI training. In most cases, if you completed CITI at another institute we will accept your certificate through its expiration date. You must change your affiliation to Kent State no later than your next required refresher.

I have an open project at my former institute. What do I need to do?

  • In most cases you will need to seek approval of a new application or inter institutional authorization agreement from the KSU IRB if you want your former institute to remain as the IRB of record. Additionally, you should contact your former institute for guidance on their policies.

I have data that needs to be transferred from my former institute. What do I do? 

  • In general, you will need to seek IRB approval prior to transfer and data should be managed as described in the in the protocol for which the data was collected under. Also, you should contact your former institute’s IRB (and funder if applicable) to ensure you are compliant with their rules.
  • Coming soon - data security and use standards!

Leaving Kent State University?

  • If your study is funded, contact Sponsored Programs. 
  • PI leaving KSU: if an open project is to continue and the PI is leaving one of two actions typically happen. First, if KSU will continue to be the main contributor (including primary recipient of funds) a change in PI must be submitted. The person leaving KSU will need to be added as external personnel (using appendix B) and if they continue to be engaged in the research, an IAA must be completed. Second, if KSU will cease being the main contributor, the study must be closed and the PI needs to consult their new institute’s IRB. 
  • Co-Investigators leaving: if an exiting Co-I continues to be engaged they will need to obtain their own  IRB approval or seek an IAA (IAA’s are mandatory for federally funded projects). Co-Is can be removed via the annual review form. If your study is not subject to annual review you do not need to notify the IRB. If they are no longer engaged, access should be revoked as described in the IRB application. If only using de-identified data, complete a de-identified data use agreement.
  • If a student is to leave the institute and continue to be engaged in the research they will need to be added as external personnel (using appendix B). If they are unaffiliated after leaving KSU, they may be considered volunteers.
  • Questions regarding data ownership, management, and use must be directed to your Department Chair or College Dean.

Do transcriptionists and translators need to be added to my protocol?

  • Typically not. Transcriptionists and translators are not considered engaged so long as all of the following apply: their services do not merit professional recognition or publication rights, their services are typical of those performed for non-research purposes, and they are not administering a study intervention or being evaluated under a protocol. University Counsel requires the use of a confidentiality or non-disclosure agreement. 



Cooperative/Multi-institute Research (IAA)

It is not uncommon for an external institute to have different standards or different policies and procedures for executing agreements or IAAs than we do. The Kent State IRB, ORC and University Counsel occasionally collaborate to negotiate agreements with your collaborator's IRB. This means that we may not always be able to follow uniform processes and delays may be experienced. In some cases, when allowable by the regulations, we may advise you or your collaborator to obtain their own approval. However, most NIH-funded studies must go through a single IRB (sIRB).

Exempt research

  • The NIH sIRB policy does not apply to exempt research, so most IRBs, including Kent State's, prefer to not enter into IAAs for exempt research. If you are working on a project that was exempted (level I approval) by another IRB, we will either require you to submit a KSU level I application or review the application that was approved by the external institute. The external collaborator may be asked to enter into a data use agreement (per University Counsel), consult with their IRB or another action may be required.     

Are there any special rules about sharing genomic data?

How should data collected under the approval of the KSU IRB be stored?

How can I expedite the review of an IAA? 

  • As early as possible let all institutes involved in the IAA know of your plans to request single IRB review.

What is an interinstitutional authorization agreement?

  • An IAA is a formal written agreement between two or more institutions that have IRBs, which permits IRB review to be limited to one institute – the reviewing institution is referred to as the IRB of record. In general Kent State University does not enter into IAAs for exempt/level I projects. If your project is exempt, please contact the Office of Research Compliance for guidance.

What is local context review?

What does it mean to be engaged in research activities?

How do I know which institute should be the IRB of record?

  • External Review:
    • Kent State faculty/staff will be performing the majority of the study procedures at an external institution/site and the institution/site holds a current FWA and IRB registration.
    • The involvement of the KSU investigator(s) is limited. (For example, data analysis of information collected at another institution.)
    • Another institution’s reviewing IRB is more properly constituted to review a certain scope of work, or may have knowledge of the local research context. (For example, an international research project where the interaction with subjects is performed at an external site and the site has an FWA.)
    • This is a multi-site study with multiple IRB reviews/approvals.
    • This is a multi-site study and all sites are deferring to only one approving IRB.
  • KSU Review:
    • The majority of the study procedures will be performed at Kent State, or by Kent State faculty/staff.
    • This is a multi-site study and all sites are deferring to one approving IRB.
    • This is a multi-site study with multiple IRB reviews/approvals.

How long do IAAs last?

  • IAAs last for the life of the project unless there is a change to the agreement (including an institute ceasing engagement in research).

I have an IAA, what do I need to do now?

  • KSU Review: You should correspond with the Office of Research Compliance and the IRB as you normally would, such as submitting renewals, amendments, closures and etc…
  • KSU Review - The KSU PI is responsible for the external collaborators. It is important to communicate clearly and openly with external collaborators. 
  • External Review: You correspond with the other institution in accordance with their procedures. You must contact the KSU Office of Research Compliance and IRB if there is a change in study risk level, if a subject complaint or unanticipated problem occurs, the project is suspended or terminated by the IRB of record, change in funding, change in KSU role, or the study is closed. You should also file copies of approved amendments and continuing reviews with the Office of Research Compliance.

Does KSU have any standing agreements?

  • We have standing agreements with Akron Children’s Hospital, Akron General Hospital, Summa Health System, Ursuline College, University of Akron, NEOMED, YSU, Cleveland State University and Cleveland Clinic.

What is the regulation on cooperative research? 

  1. 45CFR46.114 states
    1. Cooperative research projects are those projects covered by this (45CFR46) policy that involve more than one institution. In the conduct of cooperative research projects, each institution is responsible for safeguarding the rights and welfare of human subjects and for complying with this policy
      1. Any institution located in the U.S. that is engaged in cooperative research must rely upon approval by a single IRB for that portion of the research that is conducted in the U.S. The Review IRB will be identified by the federal department or agency supporting or conducting the research or proposed by the lead institution subjects to the acceptance of the federal department or agency supporting the research. 
      2. The following research is not subject to this provision:
        • Cooperative research for which more than single IRB review is required by law (including tribal law passed by the official governing body of an American Indian or Alaska Native Tribe); OR

        • Research for which any federal department or agency supporting or conducting the research determines and documents that the use of a single IRB is not appropriate for the particular context.

  2. For research not subject to paragraph b of this section, an institution participating in a cooperative project may enter into a joint review arrangement, rely on the review of another IRB, or make similar arrangements for avoiding duplication of effort. 
NIH FAQs and Kent State IRB Policies

The Office of Human Research Protection’s (OHRP) website offers a comprehensive list of Frequently Asked Questions-The topics include informed consent, the common rule, research with children, and investigator responsibilities.

Policy on Compensating Research Subjects

Policy on Principal Investigator

Policy on Research Involving PHI

Policy on Students as Research Subjects

Policy on Continuing Review

Policy on Adverse Events

Policy on Non-compliant Events

IRB review of publicly available datasets: the IRB requires the review of publicly available data sets to ensure there is no intent to re-identify de-identified information to help meet the terms of an agreement, including agreements related to restricted datasets, to support a grant proposal, and to ensure the request meets the criteria for exempt/level I review.

  • Datasets that must go through expedited review: research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for nonresearch purposes (OHRP website). 




Data Use Agreements

Important: University Counsel (U.C.) is the university’s authority for contractual matters, including data use agreements. U.C. has delegated limited authority to The Office of Research Compliance to help investigators execute most de-identified data use agreements.

What are data use agreements?

  • Data use agreements (DUA) are contractual documents that define limitations on a recipient’s use of non-public data or data that is otherwise restricted by the data provider or under applicable law.

When is a data use agreement required?

  • Typically, you must use a DUA when sharing identifiable data or non-public de-identified (including anonymous) data with a party external to KSU. The terms of a DUA are under the purview of University Counsel. The IRB works with University Counsel to help facilitate DUAs for inter-institutional human subjects research.

When is a data use agreement not required?

  • If another fully executed agreement (i.e., sponsored research agreement, grant agreement, or IRB inter-institutional authorization agreement) includes terms for data sharing and supersedes the need for a data use agreement. 

What if the data I am sending to an external party includes Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) or education records protected under the Family Education Rights and Privacy Act (FERPA)?

  • You must get approval from the University’s Privacy Officer (PHI) (or Registrar (FERPA) and follow their requirements.

Who can sign a DUA on behalf of the University?

  • DUAs may only be signed by a University official with the appropriate delegated signature authority, including your Dean or certain representatives from the Division of Research and Sponsored Programs.

What if I am asked to sign a DUA by an external party?

  • Contact University Counsel.
  • Once fully executed, abide by the terms and conditions of the agreement.

Do I need to contact the IRB prior to sharing data?

  • If the data was collected under the approval of the KSU IRB, you must contact the Office of Research Compliance. The ORC will review your IRB application to ensure sharing of data is not disallowed.

What types of data use agreements exist?

  • The two most common types are stand-alone de-identified data agreements or confidentiality  agreements with data-use provisions. If sharing identifiable data (using a confidential agreement) you must justify to the IRB the need to share identifiers.
Do I need IRB Review?


  • IRB Basics - defines human subjects research and provides basic infomration on exempt research as well as consent, common IRB comments, and tips on completing an application.  
  • Overview of Process - provides a basci overview of the KSU process
  • Revised Common Rule Webinar - provides infomration related the "2018" common rule.