Skip to main content Skip to secondary navigation


Main content start

Basics | Training | Protocol Management | Single IRB | Genomic Data Sharing | Good Clinical Practice | Cadavers or Deceased Individuals | Certificate of Confidentiality | GDPR | Other/Special Circumstances

Most Commonly Asked

  1. Human Subjects Training/CITI
  2. Does my project need IRB review?
  3. Consent
  4. Overview of the IRB Application (including definitions for Key Personnel)
  5. Protocol Management
  6. Single IRB
  7. eProtocol FAQ



Human Subjects Training

Protocol Management


Single IRB (sIRB)

Genomic Data Sharing

Good Clinical Practice

Research Involving Cadavers or Deceased Individuals

Certificate of Confidentiality

European Union General Data Protection Regulation (GDPR)

Other/Special Circumstances

Other Education Resources


What is the eProtocol system?

eProtocol is an online application used at Stanford to submit, review and approve research.

How do I use the eProtocol system?

See the webpage about how to get started and eProtocol FAQs.

What is a protocol?

A protocol is a detailed plan for conducting research.

What does STANFORD (all caps) signify?

This denotes the five STANFORD affiliated organizations:

  • Stanford University (SU)
  • Stanford Hospital and Clinics (SHC)
  • Lucile Packard Children’s Hospital at Stanford (LPCH)
  • Veterans Affairs Palo Alto Health Care System (VAPAHCS)
  • Palo Alto Veterans Institute for Research (PAVIR)

Human Subjects Training

What training do I need?

Completion of human subject research training by all staff working on a research project (all investigators and other study personnel, including all persons who are responsible for the design, conduct, data analysis or reporting) is one of the requirements for protocol approval by the IRB.    
See CITI (Tutorial) for more information.

What is CITI?

Stanford provides access to the required training through the interactive online Collaborative IRB Training Initiative (CITI) Course: The Protection of Human Research Subjects.

How do I transfer training from another institution?
  • Transfer CITI training completed at another institution:
    • Login to the CITI website directly with your CITI or prior institution's login credentials.
    • Click on the link 'Associate With Another Institution' and choose Stanford.
    • Your completed modules will be recorded in Stanford's database.
      • If issues in transferring: Report the issues to CITI support center
      • Once the transfer is completed successfully, your CITI trainings will reflect in your account when you login using SUNetID.
    • Stanford users without a SUNetID: Request a SUNetID from your Stanford department, before starting the transfer of CITI training.    
  • Transfer non-CITI training completed at another institution:
    • Contact IRB Education (650-724-7141) to see if your past training can be transferred. Generally, Stanford University will accept comparable Humans Subjects training from other institutions. You will need to provide the IRB your most recent training completion report.
    • When your training expires, register at CITI with Stanford University as your affiliate institution to take the Refresher course.    
  • See CITI (Tutorial) for more information.
Why is my CITI training showing as incomplete in eProtocol?

If you have completed your training but it is not showing as completed in eProtocol, please contact the eProtocol helpdesk for assistance here.

Protocol Management


Before Submitting a Protocol

Do I have to submit an application to the IRB?

Studies that meet the definition of Human Subject Research must be submitted to the IRB and must receive IRB approval before any study activities take place. This chart may assist you in determining whether your study meets the definition.    
For additional information on certain student projects, pilot studies, oral history projects, or quality assessment/quality improvement projects, see:

If you want the IRB to determine whether your activity constitutes human subject research, complete this form and submit it through eProtocol to request a Human Subjects Research (HSR) Determination.

Scientific and Scholarly Validity (SSV) Review Requirements

All research (except Chart Review and Exempt protocols) requires a review of Scientific and Scholarly Validity. For research that does not otherwise undergo this type of review (i.e. federal agency grant review, FDA oversight of an IND/IDE, Clinical Research Unit (CRU), or review by the Cancer Center Scientific Review Committee (SRC)), the researcher's Division Chief, Department Chair, or their designee must provide this review for the proposed research. Provide the link found in the 'Attachments' section of your application to the appropriate person to complete this review. If the Department Chair is a researcher on the protocol, submit the protocol and the IRB Manager will request this review as appropriate.

For research where Clinical Research Unit or Cancer Center Scientific Review Committee (SRC) review was completed, please attach documentation in the ‘Attachments’ section of your protocol application.  

Academic Sponsor Review Requirements

If the Protocol Director is a student, Resident, Fellow or Post-Doc and requires and Academic Sponsor to be listed on the protocol, the Academic Sponsor must complete a review of scientific and scholarly validity and protocol oversight. Provide the link found in the 'Attachments' section of your application to the Academic Sponsor to complete this review.

IRB Review Fees

Initial and continuing review Industry Sponsored Clinical Trials IRB Review Fees.

What qualifies as a pilot study?

A pilot study is a preliminary investigation of the feasibility of the study which would not contribute to generalizable knowledge and therefore is not considered research.  However, if the researcher plans to use the pilot data for research purposes, IRB review is required. More information on pilot studies is found here.

Can Stanford students conduct Human Subject research?

Stanford University supports a wide range of both undergraduate and graduate student research projects using human subjects – from course-related research exercises to Ph.D. dissertation studies. More information is found here.

How do I get information about Stanford students for my study? 

If you plan to request email addresses, or biographic, demographic or academic data on Stanford students from the Registrar's Office as part of your research, email the Director of Institutional Research regarding the process to obtain these data before you submit your protocol to the IRB.

Who oversees student research? 

Student protocols must have the Academic Sponsor review and fill out the form for scientific and scholarly validity, and oversight

Submitting a Protocol (questions the PD should consider)

Should I submit a medical or non-medical protocol? 
Type of ProtocolsDescription
Medical ProtocolsConducted by personnel within, or conducted through, the School of Medicine (SOM), the Veterans Affairs Palo Alto Health Care System (VAPAHCS), the Palo Alto Veterans Institute for Research (PAVIR), or otherwise involving any medical procedure or use of personally identifiable health information are submitted on the Medical protocol application
Social & Behavioral (Non-medical) ProtocolsHuman subjects research studies conducted by personnel within, or conducted through, Schools of Business, Education, Engineering, Humanities & Sciences, Law, and Psychology (except MRI studies) are submitted to the IRB on the Non-medical eProtocol application.  
Review Type: What is it and why do I need to know? 

Before starting an eProtocol application, investigators must identify the appropriate Review Type. eProtocol then generates the appropriate form type for that review. There are six forms:

Select a Form Type below to create the eProtocol application for IRB review. Learn more about different form typee or contact or (650) 724-7141 if you have questions.

“Minimal Risk” means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.

RegularFor greater than minimal risk studies
ExpeditedMinimal risk studies meeting specific criteria
ExemptStudies meeting specific criteria
Chart ReviewChart review studies that only involve the use of Stanford data, documents, records. Minimal risk studies only.
Single IRB (sIRB)Studies where Stanford IRB is being asked to rely on an external IRB.
Human Subjects Research (HSR) DeterminationProjects that don't clearly qualify as human subjects research. Include the HSR Determination form in your submission.
Single Patient INDSingle patient treatment where the PD must obtain an IND from the FDA. Include FDA Form 3926 in your submission with 10(b) “Request for Authorization to Use the Alternative IRB Review Procedures” selected and you will be required to fill out an abbreviated Single-Patient form.  If this box is not selected, you will be required to fill out the full/regular application.
Humanitarian Use Device (HUD)Treatment using a device with a Humanitarian Device Exemption (HDE) issued by FDA.
Is there a guide to help me through the eProtocol system?

On the right side of your eProtocol homepage, there is a help section. Following are sections which may be useful to you:

Getting StartedA Summary for New Users
eProtocol TrainingeProtocol Basics Video and Information on Group Training
eProtocol FAQsGetting Started, Managing Protocols, Troubleshooting
HELPSU and Contact UsFor eProtocol Assistance

When is a Data Risk Assessment (DRA) needed?

A DRA is needed when Moderate or High Risk data is being transferred to a non-Stanford entity during the course of a research study. 
For more information, see Stanford University IT’s Getting started with DRAs.  For questions or assistance, contact the DRA team at


Documenting Consent
Can consent requirements be waived? 

The IRB may approve a    
    • Waiver/Alteration of consent or a    
    • Waiver of Documentation (signature requirement)    
if the research meets regulatory criteria.

What if there are non-English speaking participants?

Investigators are encouraged to recruit and include all segments of the community in research, including individuals whose primary language is not English. A general requirement for informed consent is that the 'information that is given to the subject or the representative shall be in a language understandable to the subject or the representative' [45 CFR 46.116 21; CFR 50.20].

Where can I get a consent form translated?     
It is important that consent forms be translated accurately. Procedures for ensuring accurate translation should be described in the protocol application. For more information, contact Translation Services (Stanford Hospital and Clinics) at (650) 724-8735.

When can I use the short form consent process?     
When all of the participants in a study (i.e., the target population) are anticipated to be non-English speaking, a full translated consent is strongly encouraged. Use of the short form consent process and documents requires prior IRB approval.

Does the IRB provide translated short form consent documents?     
There are short form templates in many languages.

Does my research require an assent form?     
Generally, a child 7 - 17 years old should sign an assent form.

My Academic Sponsor didn't get the financial interest disclosure email. What do I do? 

Have them go to their OPACS Dashboard, locate the protocol, and click the red "Enter Response" button. They can answer the questions there.

My name is not displaying correctly in eProtocol. What do I do?

The user should go to StanfordWho, then click "Maintain your directory and AlertSU emergency contact information" and update the Preferred name. The name will then import to eProtocol.

After Submitting a Protocol

What happens after I submit my protocol?

Your protocol will be assigned to an IRB panel and meeting date. Be sure to watch for IRB comments. IRB staff may contact you by email or phone to obtain further information or to inform you of IRB questions/comments that require you to submit a response.

Please check your email daily for IRB comments during the month your protocol is being reviewed. Approval of your project may be delayed if responses to comments are not received promptly.

What is the status of my application?     
eProtocol is the system of record and the My Dashboard page should be used to access information on protocol status:
  • Action Items - Protocols needing action by the research team
  • In Process - Protocols undergoing review by the IRB
  • Active Protocols - Ongoing
  • Non-Active Protocols - Closed or expired
When can I expect to get IRB approval?
  • Regular - Generally, protocols are approved at the meeting date to which they are assigned.
  • Expedited, Exempt, Chart Review - Generally, studies are reviewed in the order in which they are received. The actual approval date may be prior to the meeting date to which it is assigned.
Can I begin working on my protocol before I receive IRB approval?

NO.  WAIT for IRB Approval. You may not begin your project until you have been notified of the IRB's approval. The IRB process takes about a month to review a new protocol, depending on the review type. Be sure to allow time for the IRB to review and approve your protocol before you begin your research.

Under no circumstances should you interpret a lack of communication from the IRB as an approval. You can view your protocol status in the eProtocol home page.

After a Protocol is Approved

Protocol Directors must maintain appropriate study oversight, as described in HRPP Policy Manual Ch. 15.3 Research Oversight.

Changes to approved protocols

All proposed changes to approved research must be prospectively reviewed and approved by the IRB, (except where necessary to eliminate apparent immediate hazards to subjects – see Events and Information that Require Prompt Reporting to the IRB.)

Events that must be reported to the IRB

Certain events and circumstances (for non-Exempt human subject research) must be promptly reported to the IRB. See Events and Information that Require Prompt Reporting to the IRB.

Continuing IRB Approval

When applicable, the Protocol Director is responsible for ensuring that protocols are submitted for continuing review and approval by the IRB prior to the study’s expiration date, and in sufficient time to ensure their non-interruption.

What happens when a protocol approaches its expiration date?

Studies with an expiration date must be reviewed by the IRB prior to the study’s expiration.  The expiration date is the last day that the protocol is approved (that is, the investigator may conduct research on the expiration date itself, but may not on the next day unless the IRB has approved renewal of the protocol following continuing review).

Researchers are alerted about an expiring protocol two months in advance by an eProtocol-generated notice, with a second reminder approximately one month later.  

If no continuing review application has been received prior to an expiration date, an expiration notice is sent out within three business days of the protocol expiration; to keep the protocol active, a continuing review application must be submitted immediately.

If a protocol expires

Expired protocols appear in red type on the investigator’s eProtocol Home Page under “Non-Active Protocols”. They are not automatically closed due to non-response by the Protocol Director; once expired, the PD may ask the IRB staff to perform an ‘administrative close’, or may contact the IRB to discuss options available.

Extended Approval Process (EAP)

Some minimal risk studies do not require annual review.

  • IRB Approval letters and consent forms (when applicable) will document that the study qualifies for extended approval and will not expire.
  • With extended approval, modifications must still be submitted for IRB approval prior to implementing changes, and events that meet prompt reporting criteria must be reported to the IRB.
  • Extended approval does not apply for some minimal risk research (e.g. FDA-regulated research, prisoner studies, stem cell research, etc.

Protocols that receive an extended approval should still be closed with the IRB when the research is completed. Every three years, researchers are asked to confirm the study is active.

Closing a protocol

When and how to close a protocol

Protocols should be closed in eProtocol when the study has been completed, or when the only remaining activity is analysis of de-identified data.  The Protocol director is responsible for reporting the completion of the protocol to the IRB within 30 days.

A protocol is completed when all participants have been enrolled; all participants have completed all research-related interventions, including any protocol required follow-up; all analysis of identifiable data is completed; and all funding and contracting issues have been completed/cleared. See the HIPAA and PHI guidance for more information on de-identification.

Protocols are closed via eProtocol, either by submitting a Final Report to the IRB (required for certain protocols – see below), or by changing the protocol status in eProtocol (see eProtocol instructions.)    

When is a Final Report required?

A Final Report must be submitted to the IRB for:

Final Reports are required for:    
• Research that was subject to regular review    

Final Reports are not required for:    
• Research subject to expedited* or exempt review

The Final Report should be submitted to the IRB within 30 days of the study completion.

*All Expedited FDA-regulated protocols must be closed by the Protocol Director.

Record retention

All data, including all signed consent form documents, must be retained for a minimum of three years past the completion of the research. Additional requirements may be imposed by the funding agency, your department, or other entities (e.g. 7 years for studies conducted under HIPAA). (See also Research Policy Handbook RPH 1.9 - Retention of and Access to Research Data)

Genomic Data Sharing


How do I obtain Institutional Certification so I can submit data to an NIH-supported genomic data repository (e.g., dbGaP)?

 To request Extramural Institutional Certification, submit the following to IRB Education:

  • A blank copy of each consent form used to collect samples from which data were/will be generated.
    • If the dataset includes data from samples obtained at another institution, including commercial vendors such as ATCC, the Stanford IRB will review each of those consents as well.
    • Submit “each consent,” version across studies, and across time. Essentially EACH IRB-approved consent document used to collect samples represented in the dataset.
  • A completed Genomic Data Sharing Checklist for each consent.
  • A completed PD-signed Extramural Institutional Certification form that correlates with the dates samples were collected from participants. Once the IRB confirms the data can be submitted to an NIH-supported genomic data repository, the IRB will obtain the Authorized Institutional Official‘s signature and return the signed form to whomever requested the extramural certification.
Note: sample consent language for Genomic Data Sharing is included in the informed consent templates available on the Medical Research: Forms & Consent Templates webpage.
What should I do if the initial consent forms are not consistent with submission of data to the NIH Repository, or if there was no informed consent obtained?
  • For data from specimens collected before 1/25/2015, the IRB will assess whether the data submission is consistent with the informed consent given by the participant.  NIH will accept data derived from de-identified cell lines or clinical specimens lacking consent for research that were created or collected before 1/25/15.    
  • For studies initiated after 1/25/15, NIH expects researchers to obtain participants’ consent for their data to be shared broadly for future research.    
  • For studies that prohibit sharing by using statements such as “Your data will never be shared outside of Stanford,” re-consenting may be possible.  Any plan to re-consent should be submitted to the IRB as a modification to the protocol along with the modified consent form prior to implementation.    
  • See Related Non-Stanford Sites for additional NIH resources.

Good Clinical Practice

What is Good Clinical Practice?

The International Council for Harmonisation provides a Guideline for Good Clinical Practice ICH E6(R2). The guideline sets standards for clinical investigations based upon the Declaration of Helsinki ethical principles for medical research involving human subjects. It outlines how to design, conduct, monitor, analyze, audit, and report trials in ways that protect the rights and wellbeing of research participants and provide valid data.

What is covered in the Good Clinical Practice Guideline?

The Guideline for Good Clinical Practice ICH E6(R2) contains clinical trial principles, responsibilities for IRBs, clinical investigators, and sponsors, requirements for protocols, amendments, and investigator's brochures, and lists essential documents.

What are some examples of Good Clinical Practice?

The ICH GCP guideline states that studies should be scientifically sound, investigators should weigh risks against anticipated benefits, research personnel should have proper expertise and training, informed consent should be obtained, trials should be monitored, and data should be verifiable, among several other standards.

What are some differences between Good Clinical Practice and FDA regulations?

ICH GCP has essential document requirements, additional signature requirements, requirement of providing risks and benefits to alternative treatments, requires consent to have a participant responsibility section and explain the likelihood of being enrolled in either treatment or placebo arms of study, additional sponsor requirements, direct access to medical records for monitors, auditors, IRB, and regulatory authorities, among others.

Where can I learn about Good Clinical Practice?

If you plan to be involved in recruiting, consenting, conducting procedures, analyzing or reporting private identifiable data on a clinical trial at Stanford, you are required to take human subjects training that includes GCP content. Note also that NIH requires GCP training for NIH-supported clinical investigations. Other Stanford personnel not engaged in human subjects research may also opt to take the course for educational purposes.

Research involving cadavers or deceased individuals

Does the IRB require a protocol for research involving cadavers or deceased individuals?

Generally speaking, research involving cadavers or deceased individuals does not meet the definition of human subjects research. However, there may be circumstances where IRB oversight is needed, such as when obtaining CA State-produced death records or indices, or tissues/samples prospectively collected from individuals who were/are living at the time of sample collection. If in doubt, contact IRB Education.

Does the IRB need to review research involving protected health information (PHI) about deceased individuals?

HIPAA protections extend beyond an individual’s death. Please work with the Privacy Office to determine how best to obtain authorization to use and disclose PHI from deceased individuals.

Certificate of Confidentiality (CoC)

What is a Certificate of Confidentiality (CoC)?

CoCs protect the privacy of research participants by prohibiting disclosure of identifiable, sensitive research information to anyone not connected to the research except when the participant consents or in a few other specific situations. Effective October 1, 2017, all ongoing or new research funded by NIH as of December 13, 2016 that is collecting or using identifiable, sensitive information is automatically issued a CoC through a term and condition of award. Other federal agencies will continue to issue CoCs to researchers they fund via an application process. Research that is not federally funded can apply for a CoC to NIH or the FDA as appropriate. For more information on the NIH Policy.

If part of my cohort was recruited prior to issuance of the Certificate do I need to re-consent them?

Neither the NIH Policy on Certificates of Confidentiality nor subsection 301(d) expect participants consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted and informed of the Certificate. However, IRBs may determine whether it is appropriate to inform participants.  Go to the NIH CoC Kiosk for more FAQs

May identifiable, sensitive information protected by a Certificate of Confidentiality be placed in a subject’s medical record? If identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, is it still protected?

In general, placing research information protected by a Certificate of Confidentiality into a subject’s medical record would require the subject’s consent unless such disclosure is required by law.  NIH encourages institutions and investigators who wish to include identifiable, sensitive information protected by a Certificate in a medical record, to work with their institutional counsel to determine how to do so in accordance with subsection 301(d) of the Public Health Service Act and other relevant laws.

Section 301(d) of the Public Health Services Act protects identifiable, sensitive information and all copies thereof. Accordingly, if identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, the protections of the Certificate and prohibitions on further disclosure of the information may apply. Investigators should also work with their institutional counsel to ensure that proper consent is obtained for all potential disclosures from medical records.

Note that a Certificate is not intended to limit the access of research participants to research information about themselves.

Does the NIH Policy on Certificates of Confidentiality and subsection 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) permit HHS auditing and other regulatory compliance monitoring of NIH-funded projects?

Yes, NIH considers auditing and regulatory compliance monitoring to be activities connected with the research and thus does not consider disclosure of information to, for example, members of relevant Institutional Review Boards or individuals within the HHS Office of Inspector General to violate the statute or the Policy if used for HHS auditing or regulatory compliance.

As with many pragmatic trials, my study is fully integrated with clinical care, such that for research purposes we will extract information from the medical records and for clinical care we intend to incorporate research data into the medical records. Must we have the participants’ consent to put research data in the medical records?

The policies for handling research data and medical records can differ with each institution. For this reason, NIH suggests that investigators who intend to include research data in subjects’ medical records work with their own institutional counsel and IRB to ensure that all documents are handled appropriately and in line with the institution’s own policies.

European Union General Data Protection Regulation (GDPR)

What is GDPR?

Effective May 25, 2018, Stanford University is required to comply with the European Union General Data Protection Regulation (GDPR) which regulates the collection, processing, storage, transfer, and protection of personal information, including data collected for research. The GDPR is a comprehensive privacy law that governs any entity that collects or processes the personal data of any citizen of the member states of the European Economic Area (

What do researchers need to do?

For research that includes human subjects, language for the consent will be provided to you during IRB review. The language will inform participants about their study data regulated under the GDPR.

Find out more:

If you have specific questions about GDPR, please contact the University Privacy Office.  You can also find additional information on GDPR at and DoResearch.

Expanded Access, Emergency Use, Humanitarian Use (HUD)

Expanded Access

What is Expanded Access?

Expanded Access is when investigational drugs, biologics, or devices are made available, under certain circumstances, to treat patient(s) with a serious disease or condition who cannot participate in a clinical trial. Expanded Access can be permitted by the FDA for individuals, intermediate size groups or widespread treatment, each under specific criteria. [21 CFR 312.300 (Subpart I)]

See: Expanded Access Brochure; HRPP Policy Manual Chapter 5.8

get info

What is Compassionate Use?

“Compassionate Use” has commonly been used to refer to expanded access. The term ‘Compassionate Use’ is used in the FDA guidance for Single Patient/Small Group Access to a device.

Get more info

Does Expanded Access require IRB approval?

All Expanded Access, except Emergency Use (see GUI-6), requires prior IRB review and approval.

Get more info

Does Expanded Access require FDA approval?

Prior approval from the FDA is required (either a new IND or a protocol amendment to an existing IND). 

The sponsor should submit an IDE supplement to the FDA requesting approval for a protocol deviation.

Get more info

What are Expanded Access reporting requirements to the FDA?

Submit IND safety reports promptly, and annual reports if the protocol continues for one year or longer.

Sponsor must submit semi-annual progress reports to the FDA until the filing of a marketing application.  After filing, progress reports must be submitted annually [21 CFR 812.150(b)(5)].

Get more info

Emergency Use

What is Emergency Use?

Use of an investigational article on a human subject in a life-threatening situation in which no standard acceptable treatment is available, and in which there is not sufficient time to obtain IRB approval [21 CFR 56.102(d)].

Get more info

Is permission needed for Emergency Use?

Contact sponsor to obtain permission to use and obtain test article.

Contact FDA for DRUGS – Emergency use may be requested by telephone, facsimile, or other means of electronic communications.

DEVICES – No prior approval from FDA is required for shipment or emergency use of investigational devices.

IRB: Emergency Use is exempt from prior IRB review and approval, provided it is reported to the IRB within 5 working days after the use. Contact IRB if you have any questions.

Get more info

What are Emergency Use reporting requirements?

Must be reported to the IRB within 5 working days after the use:    
Emergency Use of a Test Article – Notification to the IRB    

Drugs: Physician or sponsor must submit a new IND, or amendment to an existing IND, within 15 working days of FDA’s authorization of the use.  Clearly mark “Emergency IND” on top of  Form 1571. 

Devices with IDE: Sponsor is responsible to report the use after receiving sufficient information from the physician.    
Devices with no IDE: Physician must report the use within 5 working days.

See also HRPP Policy Manual Chapter 5.9

Get more info

Humanitarian Use (HUD)

What is a Humanitarian Use Device (HUD)?

A medical device intended to benefit patients by treating or diagnosing a disease or condition that affects or is manifested in not more than 8,000 individuals in the United States per year.

See also HRPP Policy Manual Chapter 5.10

Get more info