University of Vermont

Human Subjects Research - Institutional Review Boards - IRBs


Steps to Develop and Submit a Protocol Application

Step 1. Determine What Type of IRB Review is Required

Deciding the level of review needed for the research will help you choose the right application form.   To determine the level of review, you must assess the level of potential risk to subjects involved.  The final determination of level of review will be made by the IRB upon receipt of the application form.  Additional information about the review levels and categories may be found in the Human Subjects Research Manual.

Not Research and Not Human Subjects Determinations

As mentioned in the "Start Here" section once the researcher has determined that the institution is engaged in the research, he/she then must determine if the project is research and additionally if there are human subjects.  The flows in that section outline how these determinations are made.  

Examples of what might not be research:  QA/QI, research practicum, case studies, oral histories.
Examples of not human subjects:  cadavers, data or specimens when no access to code or link that could allow identification of the individual, data generated from medical record and received by investigator without individually identifiable information.

If you have any doubt, the IRB can make this determination for you.  Determination forms can be found here.

Exempt Determination - Limited or No Risk

DHHS Guidelines (45 CFR Part 46.101(b) and (c)) define research as exempt from further IRB review when the research involves no risk to the subject. Research that is considered exempt from Committee review must still be filed with the IRB and certified as exempt.   

You may also reference the Research Manual "Section 7.C. Exempt Review Categories of Research" to help you decide which exemption category might apply to your research.  

Expedited Review - No More than Minimal Risk

To qualify for expedited review (see 45 CFR 46.110), an activity must:

1. involve no more than minimal risk, and

2. be found on the list of Expedited Review Categories of Research

Minimal Risk: "the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests" (from 45 CFR 46.102(i)).

Examples of research eligible for expedited review: non-invasive recording of data from subjects; minimal blood draw amounts; voice recordings; non-stressful research on individual or group behavior; and moderate exercise by healthy volunteers.

Use Expedited Review Categories of Research to decide which expedited category might apply to your research. 

Full Committee Review - Greater than minimal risk

A project that involves greater than minimal risk requires approval by an IRB panel composed of members qualified to review research in that field.

  • Research projects involving more than minimal risk
  • Research projects involving clinical trials and/or interventions
  • Research projects that have special concerns or involves vulnerable populations
  • Depending on the nature of the study, research involving children, pregnant women or fetuses, prisoners, or people with mental impairment
  • Research projects that involve the use of a medical device (in most cases)
  • Projects that involve possible coercion or undue influence that induces or entices consent (e.g., excessive compensation, inequitable relationship, etc.)
  • Sensitive information is being gathered (e.g., child abuse, violence, sexual conduct/misconduct, mental health/status information, AIDS, alcohol, compulsive disorders, etc.)
  • Projects involving deception (e.g., intentionally misleading subjects about their status, giving false information about the researchers or the research purpose)



Step 2:  Determine Which Committee Needs to Conduct the Review 

There are two Institutional Review Boards (IRBs). Both IRBs review and approve research in accordance with the Department of Health and Human Services (DHHS) regulation (45 CFR 46). In addition, for studies involving products regulated by the Food and Drug administration (FDA), one IRB complies with the requirements set forth in 21 CFR 11, 21 CFR 50, 21 CFR 56, 21 CFR 312, 21 CFR 812, and 21 CFR 814.

Committee on Human Subjects in Research in the Medical Sciences (CHRMS)

Biomedical research (or experimental medicine), in general simply known as medical research, is basic research, applied research, or translational research conducted to add to the body of knowledge in the field of medicine. A new paradigm to biomedical research is being termed translational research, which focuses on iterative feedback loops between the basic and clinical research domains to accelerate knowledge translation from the bedside to the bench, and back again.

CHRMS reviews the following research categories:

  • Clinical trials (both drug and device)
  • Medical registries
  • Patient medical treatment and outcome studies
  • Biological samples (including genetics and pathology)
  • Research involving medical procedures (including labs and radiology)
  • Medical chart reviews
  • Epidemiological research using any of the above  

Committee on the Human Subjects in the Behavioral and Social Sciences (CHRBSS)

Research on social and behavioral processes involves the study of humans at the level of the individual, small group, institution, organization, community, or population. At the individual level, this research may involve the study of behavioral factors such as cognition, memory, language, perception, personality, emotion, motivation, and others. At higher levels of aggregation, it includes the study of social variables such as the structure and dynamics of  small groups (e.g., couples, families, work groups, etc.); institutions and organizations (e.g., schools, religious organizations, etc.); communities (defined by geography or common interest); and larger demographic, political, economic, and cultural systems. Research on social and behavioral processes also includes the study of the interactions within and between these two levels of aggregation, such as the influence of socio-cultural factors on cognitive processes or emotional responses. Finally, this research also includes the study of environmental factors (both natural and human created) such as climate, noise, environmental hazards, and residential and other built environments and their effects on social and behavioral functioning.  (National Institutes of Health definition)

CHRBSS reviews the following research categories:

  • Experimental non-medical research (cognitive, behavioral, group, etc.)
  • Archival research (except medical chart reviews)
  • Survey/questionnaire research
  • Observational research
  • Research interviews
  • Educational research
  • Epidemiological research using only social-behavioral methodologies

Step 3:  What Application Forms are Required

Proceed to our forms library for application forms. 

Step 4:  Develop the Protocol if One Does Not Already Exist

A complete protocol is required for Committee review.  Researchers may submit an industry-sponsored (written by industry) protocol or write their own protocol.  For quantitative research the IRB has developed a template for use.  For qualitative research, the IRB has developed a specific protocol form for completion.  Both forms include all of the required protocol elements in a format that is easy to complete and easy for Committee members to review.  Proceed to our forms library for these forms. 

Step 5:  Developing Consent and HIPAA Guidance

As of 09/01/16 the HIPAA authorization language will be included within the medical consent form.  All  new medical consent submissions received on or after this date must include the HIPAA language.  Any protocols that are currently active must update the consent form either at time of next amendment or continuing review whichever comes first.  Please refer to the "Consent for Medical Study" template found below to develop or modify the study consent form.

The Committee evaluates both the consent process and the procedures for documenting informed consent to ensure that adequate informed consent is obtained from participants unless a waiver of consent has been approved by the Committee.

  • Developing the Consent Form
  • Applying for a Waiver of Documentation, Alteration or Waiver of Consent
  • HIPAA 
  • HIPAA Waiver for Recruitment Purposes
  • UVM Medical Center HIPAA Data Forms

Developing the Consent Form

The IRB provides guidance and various consent templates to assist with consent form development. Use of the IRB consent template is strongly recommended. These templates capture the basic and additional elements of consent.

Click here for Consent Guidance

Applying for a Waiver of Documentation, an Alteration or a Waiver of Consent

Waiver of Documentation:  In some research, verbal or implied consent of the subject is sufficient and a signed consent form is not necessary.  A typical example would be a mailed survey with a cover letter explaining the research.  The receipt of a completed survey implies that the subject wanted to participate.  The requirement for the investigator to obtain a signed consent from some or all subjects may be waived if:

    a. The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside the research context. 
    b. The only record linking the subject and the research would be the consent document and the principal risk would be potential harm resulting from a breach of confidentiality. 

Alteration of Consent/Alteration of HIPAA:  In some research, an alteration of the individual’s informed consent or elements of the process may be waived.  The requirement to obtain written or verbal informed consent may be waived or altered if:
  1. The research involves no more than minimal risk to the subjects.
  2. The waiver or alteration will not adversely affect the rights and welfare of the subjects.
  3. The research could not practicably be carried out without the waiver or alteration.  
  4. Whenever appropriate, the subjects will be provided with additional pertinent information after participation.
  5. If a waiver of documentation of informed consent can be applied and minimal protected health information is collected, an alteration of HIPAA can be applied. 
An example of an alteration of consent would be when research requires deception.  In these cases, some of the elements of informed consent are met but not all.  Information typically held would be the basis for the research and subjects are debriefed after the research is complete. Studies that involve more than mild deception (e.g., fake interaction partners, false feedback, fabricated interpersonal acceptance or rejection) should include a post-experimental interview, an interactive debriefing, and a written debriefing.

Waiver of Consent/Waiver of HIPAA:  In some research, written or verbal consent is not possible.   A typical example would be retrospective record or pathology reviews.  Consent is not possible because the subjects are not available to sign a consent form.  The requirement to obtain written or verbal informed consent may be waived or altered if:
  1. The research involves no more than minimal risk to the subjects.
  2. The waiver or alteration will not adversely affect the rights and welfare of the subjects.
  3. The research could not practicably be carried out without the waiver or alteration.  AND
  4. Whenever appropriate, the subjects will be provided with additional pertinent information after participation. 
Click here for Waiver Form


HIPAA refers to the Health Insurance and Portability Act of 1996.  It is a broad federal law, only part of which is intended to protect the privacy of healthcare information.  It is divided into three parts:  portability, accountability, and administrative simplification.  There are several sets of HIPAA regulations.  The most important regulation under HIPAA for research are the privacy regulations, often referred to as the Privacy Rule.  The intent of the Privacy Rule is to protect the private individual’s health care information.  It defines the means by which individuals/human research subjects can be informed of how their health information will be used or disclosed and it gives individuals a number of rights with regard to their health information.  This information is contained in the medical consent template.  The consent/authorization must be signed by the subject prior to beginning any research activities.  Additional HIPAA FAQs.

The HIPAA Privacy Rule comes into play when you are conducting research within a covered entity or when you are receiving identifiable healthcare information directly from a covered entity.  A covered entity is any institution that is providing healthcare to individuals, such as UVM Medical Center.  If your protocol is being conducted at UVM Medical Center or you are receiving healthcare information from UVM Medical Center, HIPAA materials will be required.   In some cases, when consent is waived  or documentation of consent is waived, HIPAA  may also be waived or altered (waiving written authorization), see above, Applying for a Waiver of Documentation, an Alteration or a Waiver of Consent

Partial HIPAA Waiver for Recruitment of Subjects 

Recruitment of potential research subjects at UVM Medical Center/UVM is a regulated research activity and must be conducted in accordance with the policies and procedures promulgated by the UVM Institutional Review Board.
UVM Medical Center may use or disclose PHI for the recruitment of UVM Medical Center patients into a research study without authorization or an IRB waiver of authorization only if such recruitment is performed by a “UVM Medical Center Health Care Provider” who has a “direct treatment relationship” with the patient.  In all other cases, UVM Medical Center may only use or disclose PHI for recruitment purposes if the use or disclosure has been authorized by the patient or the researcher has obtained an IRB waiver of authorization.   To obtain a partial waiver for recruitment purposes, complete form Request for Waiver of Authorization for Recruitment Purposes and submit to the IRB at the time of initial submission. 

UVM Medical Center HIPAA Forms

If the research includes use of a limited data set from UVM Medical Center you must enter into the UVM Medical Center Data Use agreement with  UVM Medical Center.  If you wish to review records (not taking any protected health information) to design a research study or to assess the feasibility of conducting a study, you must complete the UVM Medical Center Reviews Preparatory to Research and forward to UVM Medical Center Risk Management for approval.  Both of these forms are available on our Consent and HIPAA Development Guidance page.

Step 6:  Determine if any other Committee Review is Required

Vermont Cancer Center Protocol Review Committee (PRC)

Any initial review or change to protocols regarding the study of cancer, require prior review by the PRC.  Review by the PRC is independent of the review by the Institutional Review Board (IRB). PRC and IRB, however do share their Committee review correspondence and outcomes with each other.  While submissions may be made to both Committees at the same time, the PRC must approve the protocol or approve with clarifications that do not require a subsequent full committee review prior to the IRB review so that these clarifications and responses can be taken into consideration during the IRB review.  This is required for all initial submissions and amendments.

Scientific Advisory Committee (SAC)

Any protocols wishing to utilize resources of the Clinical Research Center require review by the SAC. Review by the SAC is independent of the review by the Institutional Review Board (IRB).  However, the findings from the IRB review are communicated to the SAC. Submissions may be made to both Committees at the same time, however SAC will not approve until the IRB has approved the project.

Office of Biotechnology Activities/Recombinant DNA Advisory Committee (NIH)

Human gene therapy experiments are required to undergo extensive review and final approval through the Office of Biotechnology Activities/Recombinant DNA Advisory Committee (OBA/RAC) which is a branch of the National Institutes of Health.  The IRB requires documentation of the OBA/RAC approval prior to IRB protocol review.

Institutional Biosafety Committee (IBC)

Any protocols that involve the use of gene therapy require review by the IBC. Approval to begin activities will not be released until IBC approval is obtained.

Radiation Safety Office (RSO)

The RSO at UVM oversees the use of ionizing radiation sources on campus and ensures compliance with state and federal regulations, to protect UVM employees, students, the public, and the environment. The RSO also provides safety related services for UVM. There are more than 350 faculty, staff, and students using radioactive materials and ionizing radiation producing devices for research and educational purposes in more than 100 labs in 14 buildings.  Any protocols involving the application of radioactive materials, radioisotopes, and/or radiation treatment to humans for nonclinical purposes must undergo review by the UVM Radiation Safety Office if the research procedures are taking place at UVM. If the research procedures are taking place in UVM Medical Center, you should contact the UVM Medical Center Radiation Safety Committee.

Step 7:  Ensure Required Training is Complete for all Key Personnel

Required Training for all Principal Investigators and Key Personnel

  • Completion of the IRB’s on-line training program (“Tutorial: Protection of Human Subjects in Research”) is required for all individuals involved in the conduct of research involving human subjects, regardless of funding source.  

  • The IRB will not release the approvals for new protocols until all individuals involved with human subjects on the project (i.e., direct contact with subjects or access to data) have completed their training.  Link below.

  • There is a process for key personnel who are not UVM employees.  This process is explained on the first page of our training.  See link below.
  • Link to Human Subject Training Module

  • Use this link to Tutorial Completion Database to determine whether your key personnel have met this requirement.

Recommended Training for any PIs or Key Personnel who are Responsible to Consent Subjects

  • An investigator may not involve a human subject in research without first obtaining the informed consent (and HIPAA authorization when Protected Health Information (PHI) is used/disclosed) of the subject or the subject's legally authorized representative. 
  • If you are delegating this very important responsibility to one or more of the key personnel you have listed on your protocol, it is strongly recommended that those key personnel complete the Consent Module.

Step 8:  Submit to the IRB

As of July 1st, all submissions are required to be submitted through InfoEd. You must have proper security access to create electronic submissions. For more information on electronic submissions, visit our InfoEd Resource Materials page.

Meeting Dates

Last modified October 11 2017 09:55 AM

Ethics and Compliance Reporting and Help Line
Contact UVM © 2017 The University of Vermont - Burlington, VT 05405 - (802) 656-3131