Most Commonly Asked
- Human Subjects Training/CITI
- Does my project need IRB review?
- Overview of the IRB Application (including definitions for Key Personnel)
- Protocol Management
- Single IRB
- Who/What is the IRB? (video)
- Getting Started: What is Needed and eProtocol Basics (video)
- What are the panel meeting dates & deadlines?
- What is the eProtocol system?
- How do I use the eProtocol system?
- What is a protocol?
- What does STANFORD (all caps) signify?
- Research at non-Stanford facilities: Can Stanford human subject, animal subject or human stem cell studies be conducted at non-Stanford facilities?
- See below for Other/Special Circumstances
- What training do I need?
- What is CITI?
- How do I transfer training from another institution?
- Why is my CITI training showing as incomplete in eProtocol?
- How to Submit a New IRB Application (video)
- Before Submitting a Protocol
- Submitting a Protocol (questions the PD should consider)
- After Submitting a Protocol
- After a Protocol is Approved
- How to Submit a Continuing Review or Modification in eProtocol (video)
- Closing a protocol
- IRB Protocol Review Process and General Tips (video)
- How do I obtain Institutional Certification so I can submit data to an NIH-supported genomic data repository (e.g., dbGaP)?
- What should I do if the initial consent forms are not consistent with submission of data to the NIH Repository, or if there was no informed consent obtained?
- Does the IRB require a protocol for research involving cadavers or deceased individuals?
- Does the IRB need to review research involving protected health information (PHI) about deceased individuals?
- What is a Certificate of Confidentiality (CoC)?
- CoC Assurance Letter Template
- If part of my cohort was recruited prior to issuance of the Certificate do I need to re-consent them?
- May identifiable, sensitive information protected by a Certificate of Confidentiality be placed in a subject’s medical record? If identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, is it still protected?
- Does the NIH Policy on Certificates of Confidentiality and subsection 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) permit HHS auditing and other regulatory compliance monitoring of NIH-funded projects?
- As with many pragmatic trials, my study is fully integrated with clinical care, such that for research purposes we will extract information from the medical records and for clinical care we intend to incorporate research data into the medical records. Must we have the participants’ consent to put research data in the medical records?
What is the eProtocol system?
eProtocol is an online application used at Stanford to submit, review and approve research.
- Stanford University (SU)
- Stanford Hospital and Clinics (SHC)
- Lucile Packard Children’s Hospital at Stanford (LPCH)
- Veterans Affairs Palo Alto Health Care System (VAPAHCS)
- Palo Alto Veterans Institute for Research (PAVIR)
Human Subjects Training
Completion of human subject research training by all staff working on a research project (all investigators and other study personnel, including all persons who are responsible for the design, conduct, data analysis or reporting) is one of the requirements for protocol approval by the IRB.
See CITI (Tutorial) for more information.
Stanford provides access to the required training through the interactive online Collaborative IRB Training Initiative (CITI) Course: The Protection of Human Research Subjects.
- Transfer CITI training completed at another institution:
- Login to the CITI website directly with your CITI or prior institution's login credentials.
- Click on the link 'Associate With Another Institution' and choose Stanford.
- Your completed modules will be recorded in Stanford's database.
- If issues in transferring: Report the issues to CITI support center
- Once the transfer is completed successfully, your CITI trainings will reflect in your account when you login using SUNetID.
- Stanford users without a SUNetID: Request a SUNetID from your Stanford department, before starting the transfer of CITI training.
- Transfer non-CITI training completed at another institution:
- Contact IRB Education (650-724-7141) to see if your past training can be transferred. Generally, Stanford University will accept comparable Humans Subjects training from other institutions. You will need to provide the IRB your most recent training completion report.
- When your training expires, register at CITI with Stanford University as your affiliate institution to take the Refresher course.
- See CITI (Tutorial) for more information.
If you have completed your training but it is not showing as completed in eProtocol, please contact the eProtocol helpdesk for assistance here.
- Do I have to submit a protocol to the IRB?
- 'Scientific and Scholarly Validity' (SSV) reveiw requirements
- IRB Review Fees
- What qualifies as a pilot study?
- Quality Assessment & Quality Improvement (QA/QI) - different to research?
- Can Stanford students conduct Human Subject research?
- How do I get information about Stanford students for my study?
- Who oversees student research?
- Should I submit a medical or non-medical protocol?
- Review Type: What is it and why do I need to know?
- Can I use the new Chart Review Form?
- Is there a guide to help me through the eProtocol system?
- Overview of the IRB Application
- IRB Medical Application Process
- IRB Non-Medical Application Process
- eProtocol Help & Hints:
- My Academic Sponsor didn't get the financial disclosure email. What do I do?
- My name is not displaying correctly in eProtocol. What do I do?
- Is any additional information needed for research involving the VA?
Before Submitting a Protocol
Studies that meet the definition of Human Subject Research must be submitted to the IRB and must receive IRB approval before any study activities take place. This chart may assist you in determining whether your study meets the definition.
For additional information on certain student projects, pilot studies, oral history projects, or quality assessment/quality improvement projects, see:
- Use of Human Subjects in Student Projects, Pilot Studies, Oral Histories and QA/QI Projects
- FAQs about Quality Assessment & Quality Improvement (QA/QI)
Initial and continuing review Industry Sponsored Clinical Trials IRB Review Fees.
A pilot study is a preliminary investigation of the feasibility of the study which would not contribute to generalizable knowledge and therefore is not considered research. However, if the researcher plans to use the pilot data for research purposes, IRB review is required. More information on pilot studies is found here.
Stanford University supports a wide range of both undergraduate and graduate student research projects using human subjects – from course-related research exercises to Ph.D. dissertation studies. More information is found here.
If you plan to request email addresses, or biographic, demographic or academic data on Stanford students from the Registrar's Office as part of your research, email the Director of Institutional Research regarding the process to obtain these data before you submit your protocol to the IRB.
Student protocols must have the Academic Sponsor review and fill out the form for scientific and scholarly validity, and oversight.
Submitting a Protocol (questions the PD should consider)
Conducted by personnel within, or conducted through, the School of Medicine (SOM), the Veterans Affairs Palo Alto Health Care System (VAPAHCS), the Palo Alto Veterans Institute for Research (PAVIR), or otherwise involving any medical procedure or use of personally identifiable health information are submitted on the Medical protocol application
Social & Behavioral (Non-medical) Protocols
Human subjects research studies conducted by personnel within, or conducted through, Schools of Business, Education, Engineering, Humanities & Sciences, Law, and Psychology (except MRI studies) are submitted to the IRB on the Non-medical eProtocol application.
Before starting an eProtocol application, investigators must identify the appropriate Review Type. eProtocol then generates the appropriate form type for that review. There are six forms:
Select a Form Type below to create the eProtocol application for IRB review. Learn more about different form typee or contact IRBeducation@stanford.edu or (650) 724-7141 if you have questions.
“Minimal Risk” means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.
For greater than minimal risk studies
Minimal risk studies meeting specific criteria
Studies meeting specific criteria
Chart review studies that only involve the use of data, documents, records. Minimal risk studies only.
Single IRB (sIRB)
Studies where Stanford IRB is being asked to rely on an external IRB.
Human Subjects Research (HSR) Determination
Projects that don't clearly qualify as human subjects research. Include the HSR Determination form in your submission.
Single Patient IND
Single patient treatment where the PD must obtain an IND from the FDA. Include FDA Form 3926 in your submission with 10(b) “Request for Authorization to Use the Alternative IRB Review Procedures” selected and you will be required to fill out an abbreviated Single-Patient form. If this box is not selected, you will be required to fill out the full/regular application.
Humanitarian Use Device (HUD)
Treatment using a device with a Humanitarian Device Exemption (HDE) issued by FDA.
On the right side of your eProtocol homepage, there is a help section. Following are sections which may be useful to you:
A Summary for New Users
eProtocol Basics Video and Information on Group Training
Getting Started, Managing Protocols, Troubleshooting
For eProtocol Assistance
- Consent Form Do's & Don'ts (a practical guide)
Can consent requirements be waived?
The IRB may approve a
• Waiver/Alteration of consent or a
• Waiver of Documentation (signature requirement)
if the research meets regulatory criteria.
What if there are non-English speaking participants?
Investigators are encouraged to recruit and include all segments of the community in research, including individuals whose primary language is not English. A general requirement for informed consent is that the 'information that is given to the subject or the representative shall be in a language understandable to the subject or the representative' [45 CFR 46.116 21; CFR 50.20].
Where can I get a consent form translated?
It is important that consent forms be translated accurately. Procedures for ensuring accurate translation should be described in the protocol application. For more information, contact Translation Services (Stanford Hospital and Clinics) at (650) 724-8735.
When can I use the short form consent process?
When all of the participants in a study (i.e., the target population) are anticipated to be non-English speaking, a full translated consent is strongly encouraged. Use of the short form consent process and documents requires prior IRB approval.
Does the IRB provide translated short form consent documents?
There are short form templates in many languages.
Does my research require an assent form?
Generally, a child 7 - 17 years old should sign an assent form.
Have them go to their OPACS Dashboard, locate the protocol, and click the red "Enter Response" button. They can answer the questions there.
The user should go to StanfordYou.stanford.edu, then click "Maintain your directory and AlertSU emergency contact information" and update the Preferred name. The name will then import to eProtocol.
An additional set of questions is required for VA research. The Required Questions - VA Research must be completed and attached in eProtocol.
Your protocol will be assigned to an IRB panel and meeting date. Be sure to watch for IRB comments. IRB staff may contact you by email or phone to obtain further information or to inform you of IRB questions/comments that require you to submit a response.
Please check your email daily for IRB comments during the month your protocol is being reviewed. Approval of your project may be delayed if responses to comments are not received promptly.
- Action Items - Protocols needing action by the research team
- In Process - Protocols undergoing review by the IRB
- Active Protocols - Ongoing
- Non-Active Protocols - Closed or expired
- Regular - Generally, protocols are approved at the meeting date to which they are assigned.
- Expedited, Exempt, Chart Review - Generally, studies are reviewed in the order in which they are received. The actual approval date may be prior to the meeting date to which it is assigned.
Can I begin working on my protocol before I receive IRB approval?
NO. WAIT for IRB Approval. You may not begin your project until you have been notified of the IRB's approval. The IRB process takes about a month to review a new protocol, depending on the review type. Be sure to allow time for the IRB to review and approve your protocol before you begin your research.
Under no circumstances should you interpret a lack of communication from the IRB as an approval. You can view your protocol status in the eProtocol home page.
After a Protocol is Approved
Protocol Directors must maintain appropriate study oversight, as described in HRPP Policy Manual Ch. 15.3 Research Oversight.
Changes to approved protocols
All proposed changes to approved research must be prospectively reviewed and approved by the IRB, (except where necessary to eliminate apparent immediate hazards to subjects – see Events and Information that Require Prompt Reporting to the IRB.)
Events that must be reported to the IRB
Certain events and circumstances (for non-Exempt human subject research) must be promptly reported to the IRB. See Events and Information that Require Prompt Reporting to the IRB.
Continuing IRB Approval
When applicable, the Protocol Director is responsible for ensuring that protocols are submitted for continuing review and approval by the IRB prior to the study’s expiration date, and in sufficient time to ensure their non-interruption.
What happens when a protocol approaches its expiration date?
Studies with an expiration date must be reviewed by the IRB prior to the study’s expiration. The expiration date is the last day that the protocol is approved (that is, the investigator may conduct research on the expiration date itself, but may not on the next day unless the IRB has approved renewal of the protocol following continuing review).
Researchers are alerted about an expiring protocol two months in advance by an eProtocol-generated notice, with a second reminder approximately one month later.
If no continuing review application has been received prior to an expiration date, an expiration notice is sent out within three business days of the protocol expiration; to keep the protocol active, a continuing review application must be submitted immediately.
If a protocol expires
Expired protocols appear in red type on the investigator’s eProtocol Home Page under “Non-Active Protocols”. They are not automatically closed due to non-response by the Protocol Director; once expired, the PD may ask the IRB staff to perform an ‘administrative close’, or may contact the IRB to discuss options available.
When and how to close a protocol
Protocols should be closed in eProtocol when the study has been completed, or when the only remaining activity is analysis of de-identified data. The Protocol director is responsible for reporting the completion of the protocol to the IRB within 30 days.
A protocol is completed when all participants have been enrolled; all participants have completed all research-related interventions, including any protocol required follow-up; all analysis of identifiable data is completed; and all funding and contracting issues have been completed/cleared. See the HIPAA and PHI guidance for more information on de-identification.
Protocols are closed via eProtocol, either by submitting a Final Report to the IRB (required for certain protocols – see below), or by changing the protocol status in eProtocol (see eProtocol instructions.)
Final Reports are required for:
• Research that was subject to regular review and that enrolled participants,
Final Reports are not required for:
• Research subject to expedited* or exempt review, or
• Research projects subject to regular review that never started or never enrolled participants at STANFORD.
The Final Report should be submitted to the IRB within 30 days of the study completion.
*All Expedited FDA-regulated protocols must be closed by the Protocol Director.
All data, including all signed consent form documents, must be retained for a minimum of three years past the completion of the research. Additional requirements may be imposed by the funding agency, your department, or other entities (e.g. 6 years for studies conducted under HIPAA). (See also Research Policy Handbook RPH 1.9 - Retention of and Access to Research Data)
- Stanford HRPP guidance on Genomic Data Sharing
- NIH Genomic Data Sharing (GDS) website
- RMG website
- genetics v. genomics - see Lay Language Glossary definitions
To request Extramural Institutional Certification, submit the following to IRB Education:
- A blank copy of each consent form used to collect samples from which data were/will be generated.
- If the dataset includes data from samples obtained at another institution, including commercial vendors such as ATCC, the Stanford IRB will review each of those consents as well.
- Submit “each consent,” version across studies, and across time. Essentially EACH IRB-approved consent document used to collect samples represented in the dataset.
- A completed Genomic Data Sharing Checklist for each consent.
- A completed PD-signed Extramural Institutional Certification form that correlates with the dates samples were collected from participants. Once the IRB confirms the data can be submitted to an NIH-supported genomic data repository, the IRB will obtain the Authorized Institutional Official‘s signature and return the signed form to whomever requested the extramural certification.
- For data from specimens collected before 1/25/2015, the IRB will assess whether the data submission is consistent with the informed consent given by the participant. NIH will accept data derived from de-identified cell lines or clinical specimens lacking consent for research that were created or collected before 1/25/15.
- For studies initiated after 1/25/15, NIH expects researchers to obtain participants’ consent for their data to be shared broadly for future research.
- For studies that prohibit sharing by using statements such as “Your data will never be shared outside of Stanford,” re-consenting may be possible. Any plan to re-consent should be submitted to the IRB as a modification to the protocol along with the modified consent form prior to implementation.
- See Related Non-Stanford Sites for additional NIH resources.
Research involving cadavers or deceased individuals
Does the IRB require a protocol for research involving cadavers or deceased individuals?
Generally speaking, research involving cadavers or deceased individuals does not meet the definition of human subjects research. However, there may be circumstances where IRB oversight is needed, such as when obtaining CA State-produced death records or indices, or tissues/samples prospectively collected from individuals who were/are living at the time of sample collection. If in doubt, contact IRB Education.
Does the IRB need to review research involving protected health information (PHI) about deceased individuals?
HIPAA protections extend beyond an individual’s death. Please work with the Privacy Office to determine how best to obtain authorization to use and disclose PHI from deceased individuals.
What is a Certificate of Confidentiality (CoC)?
CoCs protect the privacy of research participants by prohibiting disclosure of identifiable, sensitive research information to anyone not connected to the research except when the participant consents or in a few other specific situations. Effective October 1, 2017, all ongoing or new research funded by NIH as of December 13, 2016 that is collecting or using identifiable, sensitive information is automatically issued a CoC through a term and condition of award. Other federal agencies will continue to issue CoCs to researchers they fund via an application process. Research that is not federally funded can apply for a CoC to NIH or the FDA as appropriate. For more information on the NIH Policy: https://humansubjects.nih.gov/coc/index
Neither the NIH Policy on Certificates of Confidentiality nor subsection 301(d) expect participants consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted and informed of the Certificate. However, IRBs may determine whether it is appropriate to inform participants. Go to the NIH CoC Kiosk for more FAQs
May identifiable, sensitive information protected by a Certificate of Confidentiality be placed in a subject’s medical record? If identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, is it still protected?
In general, placing research information protected by a Certificate of Confidentiality into a subject’s medical record would require the subject’s consent unless such disclosure is required by law. NIH encourages institutions and investigators who wish to include identifiable, sensitive information protected by a Certificate in a medical record, to work with their institutional counsel to determine how to do so in accordance with subsection 301(d) of the Public Health Service Act and other relevant laws.
Section 301(d) of the Public Health Services Act protects identifiable, sensitive information and all copies thereof. Accordingly, if identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, the protections of the Certificate and prohibitions on further disclosure of the information may apply. Investigators should also work with their institutional counsel to ensure that proper consent is obtained for all potential disclosures from medical records.
Note that a Certificate is not intended to limit the access of research participants to research information about themselves.
Does the NIH Policy on Certificates of Confidentiality and subsection 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) permit HHS auditing and other regulatory compliance monitoring of NIH-funded projects?
Yes, NIH considers auditing and regulatory compliance monitoring to be activities connected with the research and thus does not consider disclosure of information to, for example, members of relevant Institutional Review Boards or individuals within the HHS Office of Inspector General to violate the statute or the Policy if used for HHS auditing or regulatory compliance.
As with many pragmatic trials, my study is fully integrated with clinical care, such that for research purposes we will extract information from the medical records and for clinical care we intend to incorporate research data into the medical records. Must we have the participants’ consent to put research data in the medical records?
The policies for handling research data and medical records can differ with each institution. For this reason, NIH suggests that investigators who intend to include research data in subjects’ medical records work with their own institutional counsel and IRB to ensure that all documents are handled appropriately and in line with the institution’s own policies.
Effective May 25, 2018, Stanford University is required to comply with the European Union General Data Protection Regulation (GDPR) which regulates the collection, processing, storage, transfer, and protection of personal information, including data collected for research. The GDPR is a comprehensive privacy law that governs any entity that collects or processes the personal data of any citizen of the member states of the European Economic Area (https://www.tripsavvy.com/countries-that-are-eea-countries-1626682).
For research that includes human subjects, language for the consent will be provided to you during IRB review. The language will inform participants about their study data regulated under the GDPR.
- What is Expanded Access?
- What is Compassionate Use?
- Does Expanded Access require IRB approval?
- Does Expanded Access require FDA approval?
- What are Expanded Access reporting requirements to the FDA?
Expanded Access is when investigational drugs, biologics, or devices are made available, under certain circumstances, to treat patient(s) with a serious disease or condition who cannot participate in a clinical trial. Expanded Access can be permitted by the FDA for individuals, intermediate size groups or widespread treatment, each under specific criteria. [21 CFR 312.300 (Subpart I)]
“Compassionate Use” has commonly been used to refer to expanded access. The term ‘Compassionate Use’ is used in the FDA guidance for Single Patient/Small Group Access to a device.
All Expanded Access, except Emergency Use (see GUI-6), requires prior IRB review and approval.
Prior approval from the FDA is required (either a new IND or a protocol amendment to an existing IND).
The sponsor should submit an IDE supplement to the FDA requesting approval for a protocol deviation.
Submit IND safety reports promptly, and annual reports if the protocol continues for one year or longer.
Sponsor must submit semi-annual progress reports to the FDA until the filing of a marketing application. After filing, progress reports must be submitted annually [21 CFR 812.150(b)(5)].
- What is Emergency Use?
- Is permission needed for Emergency Use?
- What are Emergency Use reporting requirements?
Use of an investigational article on a human subject in a life-threatening situation in which no standard acceptable treatment is available, and in which there is not sufficient time to obtain IRB approval [21 CFR 56.102(d)].
Contact sponsor to obtain permission to use and obtain test article.
Contact FDA for DRUGS – Emergency use may be requested by telephone, facsimile, or other means of electronic communications.
DEVICES – No prior approval from FDA is required for shipment or emergency use of investigational devices.
IRB: Emergency Use is exempt from prior IRB review and approval, provided it is reported to the IRB within 5 working days after the use. Contact IRB if you have any questions.
Must be reported to the IRB within 5 working days after the use:
Emergency Use of a Test Article – Notification to the IRB
Drugs: Physician or sponsor must submit a new IND, or amendment to an existing IND, within 15 working days of FDA’s authorization of the use. Clearly mark “Emergency IND” on top of Form 1571.
Devices with IDE: Sponsor is responsible to report the use after receiving sufficient information from the physician.
Devices with no IDE: Physician must report the use within 5 working days.
See also HRPP Policy Manual Chapter 5.9
Humanitarian Use (HUD)
A medical device intended to benefit patients by treating or diagnosing a disease or condition that affects or is manifested in not more than 8,000 individuals in the United States per year.
See also HRPP Policy Manual Chapter 5.10