Federal regulations stipulate that certain research studies may apply to the Expedited level of review. Expedited review may not be used if the risks related to the invasion of privacy and breach of confidentiality are greater than minimal. Additionally, research that meets the requirements for Exempt review would not be considered under Expedited review categories. The Expedited review process permits proposed research if…

• The research constitutes a minor change in a previously approved research project during an approved period; or
• The research is not greater than minimal risk and falls into one of the categories listed under the new common rule (45 CFR 46.110 or 21 CFR 56.110).
• Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for nonresearch purposes (such as medical treatment or diagnosis). (U.S. Department of Health and Human Services, 1998)
  • NOTE: Some research in this category may be exempt from the U.S. Department of Health and Human Services’ regulations for the protection of human subjects (45 CFR 46.101(b)(4)). This refers only to research that is not exempt.

For help determining your review category, please download our guide: Does my human subjects research fall under the expedited review category?

Researchers new to the IRB may be unfamiliar with the different activities within each Expedited review category. This post will provide examples of research that typically falls under Expedited Review type, Category 5.

Expedited Category 5 covers research “involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for non-research purposes (such as medical treatment or diagnosis).”

Expedited Category 5 research examples include materials collected for "non-research purposes," but this review category can be used to cover research materials if the investigator's role is simply to analyze them. For example: If a researcher receives materials from colleagues with a separate IRB approval to collect them and the materials are handled using sound data security methods, protections for privacy and confidentiality, then the researcher may apply for expedited review for the analysis. Materials in this review category can also include:

• Blood samples collected for other health purposes;
• Academic exams;
• Program evaluations

Below are a few scenarios that we will review to see if they meet the requirements for Expedited Category 5.

Example A: A team of physical trainers plan to evaluate their program that provides free cardiovascular fitness training to physical education educators on an accredited cardiovascular health care technique. As part of the typical program, the trainers host sessions; individuals are asked to complete surveys and fitness tests, and track their changes over time using a Fitbit for two hours a day, over the course of two weeks. As part of their process, the trainers plan to evaluate these measures to gauge the effectiveness of the program and to develop competent cardiovascular fitness training for educators. The information collected is identifiable, but not sensitive. No minors will participate in these activities. All data will be stored on an encrypted password-protected device. The Physical Fitness Research Lab will collaborate with the physical trainers to evaluate the program’s data. They explained these details in their IRB protocol requesting access to the data, documents, and records collected by the physical trainers. A data security plan is in place for accessing, transferring, storing, and protecting the data.

• Is it Expedited Category 5? Yes! This study proposed by the researchers at the Physical Fitness Research Lab meets the requirements for Expedited Category 5 as it is no more than minimal risk and includes information that is collected for non-research purposes. This is a program evaluation, meaning the training program and assessments would occur even if the research did not take place. The IRB would review the program evaluation based on the types of data collected for non-research purposes and the types of identifiable data in the dataset, a core aspect of the Expedited Category 5 (e.g., names, addresses, Fitbit unique identifiers, etc.). The IRB would evaluate the training setting to determine whether the information gathered is not sensitive and data security standards were met. The research team may need to provide each individual in the training program with a data release form describing the data intended to be used for research. The data release form can include a statement that allows the individual to not release their data for research purposes.

Example B: A researcher wants to run a secondary analysis examining existing data on public census data collected by a state-sponsored substance recovery program. The researcher will review the data collected annually by the state on a community’s income, occupation, and education attainment alongside quality of life measures from a state-sponsored substance recovery program that some members of the community received. The researcher aims to evaluate the participants’ demographic data, time spent in the program, and quality of life survey measures. The data may include sensitive information (e.g., substance use disorder diagnosis) but will be de-identified by the state before it is shared with the researcher. The researcher will not interact with any participants nor collect any new data. All information will be stored on an encrypted password-protected device.

• Is it Expedited Category 5? Although the research study includes previous data collected for non-research purposes and possibly sensitive information, this study likely does not meet the requirements for Expedited Category 5. In this case, the data was de-identified before the researcher ever received the data, does not have indirect identifiers, and the researcher will not have contact with participants. Exempt Category 4 review might fit this scenario best because it stipulates; "(ii) The information is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects, the investigator does not contact the subjects and will not re-identify the subjects" (U.S. Department of Health and Human Services, 2018). The IRB would evaluate research outcomes (e.g., reporting of income, occupation, etc.) and the data-sharing agreement to assess any risk.

Example C: A researcher is interested in cross-examining two datasets to evaluate possible correlated factors between homeownership and education level. The researcher will be requesting datasets from a colleague who conducted similar studies in the past. The researcher will combine the datasets based on identifiable participant information (e.g., name, home address, etc.). The IRB will review the data-sharing agreement to ensure secure data transfer and security. In the data-sharing agreement, only two members of the research team will have access to the identifiable data. These two individuals will secure and de-identify the data before sharing it with the rest of the research team. No record of the identifiable data will be maintained. All information will be stored on an encrypted, password-protected device.

• Is it Expedited Category 5? Yes, this is an example of an Expedited Category 5 review. The IRB would expect and require a data-sharing agreement and data security plan to ensure the protection of the data and how researchers plan to mitigate risk (e.g., loss of privacy, data breach, etc.).

Research activities may fall into one or more review categories depending on a variety of factors, including the study population, researcher expertise, coinciding events, etc. Researchers can access the Expedited review categories on TC IRB’s website or from the Department of Health and Human Services (HHS). TC IRB administrators will always review research on a case-by-case basis.

— Chloe O’Neill, M.A.