Vendor Vetting Guidance
July 14, 2022

To ensure compliance with AU's Electronic and Information Technology Accessibility Policy, if a research activity includes a purchase that involves technology hardware, software or services, the AU IT Vendor Vetting team must be contacted at to learn the vendor registration process (prior to completing the purchase. A copy of the documentation of the approval from AU Vetting must be included with the IRB submission. Policy Statement and Sample Dissemination Plan
January 24, 2022

Policy Statement Registration

Auburn University is committed to ensuring compliance with Federal and State law and funding agencies regulations to meet professional publication standards and requirements concerning the public availability of clinical trial data on AU Researchers have the responsibility to create and maintain records in while making determinations about registrations required to comply with International Committee of Medical Journal Editors (ICMJE) and the Center for Medicare and Medicaid Services (CMS).

To review the Sample NIH Plan for Dissemination, click here.


Procedures to Protect Minor Participants
January 20, 2022

The IRB is charged with protecting the rights and welfare of humans participating in human subjects research. To accomplish this purpose, when minors participate in human subjects research, at least 2 adults must be present during all research activities that include minor participants. Revisions have been made to application forms and applicable sample documents to obtain a description of procedures to ensure protecting minor participants is fully considered when preparing your submission.


Useful Data Storage Resources

Data obtained during IRB-approved human subjects research projects requires secure storage practices. Below find links to useful resources to ensure secure data storage.


Updated Exemption Guidance
July 26, 2021

Responding to requests by members of the Auburn University research community, guidance and processes related to research activities eligible for EXEMPTION (click here for link), including a WORD version of the EXEMPT application form (click here for the link to the WORD form), have been updated. In the coming months, additional changes designed to streamline and simplify submission and review processes are planned.

Beginning September 1, 2021, only version 07/26/2021 of the Exemption application form will be accepted.

The EXEMPTION application form is a WORD document; however, the form currently requires a signature to be added manually.

Your feedback is welcome. To provide feedback or ask questions, email or call 334-844-5966.


Order of Materials Submitted for IRB Review 

To facilitate the review process and ensure consistency, please note the following when submitting documents. If you experience difficulties when submitting your PDF application, contact your department IT representative.

 Original submission:

  • Application;
  • Consent documents (consent form, information letter, etc.);
  • Recruitment materials (flyers, emails, telephone script, etc.;
  • Study instruments (survey, questionnaire, etc.);
  • Other study documents (data collection form, additional information, etc.):
  • Agreements/other IRB approvals; and
  • CITI training documentation.


         Revision submission:

  • Memorandum addressing IRB reviewer’s requested clarifications and revisions;
  • Revised documents (as listed above) “highlighting” all requested revisions;
  • “Clean copy” (as listed above) of all revised items; and
  • Other study materials (as listed above).

         When completing the Protocol Review Form:

  • Item 8.A - Appendix A should include a summary of relevant research findings leading to the research proposal;
  • Item 12.B - Appendix B should include a copy of all recruitment materials (emails, flyers, ads, etc.,); and
  • Item 13.C - Appendix C should include copies of all surveys, questionnaires, and other data collection instruments.


A copy of all study materials must be included with all submissions.  Combine documents as a single PDF. Forms may be converted to WORD for completion.  Once all information is provided, convert back to PDF prior to submitting.  Prior to submission review all study materials to ensure desired text is visible.  The IRB has learned that printing a submission to PDF may strip some interactive functions.  Rather than printing to PDF, the IRB suggests submissions be saved as a PDF.  If problems remain, contact your departmental IT representative for assistance.


It is the goal of the IRB to provide helpful, relevant information to all AU research personnel.  To obtain guidance on a wide variety of relevant topics, please look to your left and find the new Guidance tab.  Useful information and “aging” notices from the What’s New page will be available under the Guidance tab.  If you find there are specific topics requiring additional guidance to completely understand, please email us at


July 13, 2022

When AU is a Study Site and Will Rely on an External IRB

Auburn University (AU) may be a participating site in multi-site research studies and rely on an external IRB (not the AU IRB).
      -The external IRB may be institutional (like UAB IRB, UGA IRB, etc.) or an
       independent IRB (like WIRB or Advarra).

When an AU Principal Investigator (PI) requests external IRB review of their human subjects research, the AU PI is requesting ceded review; that is, the AU IRB cedes review to an external IRB for study oversight.
      -Ceded review requires that a reliance agreement be executed before research
       activities are performed by the AU site.

Ceded Review Application Instructions:

       1. Complete and Submit through the IRB Submission Page, as one PDF, the 
                 a.   A Copy of the completed, signed Ceded Review application;
                 b.   Documentation of CITI human subjects training for all key personnel;
                 c.   A copy of the external IRB-approved consent document or template
                       consent document including required elements from the AU IRB template
                       consent form;
                 d.   External IRB-approved protocol materials; and
                 e.   A copy of the External IRB's Reliance Agreement. **

       2. The submission will be reviewed by an AU IRB reviewer and, when all required
           information is received, the AU IRB reviewer will obtain the signature of the AU
           Institutional Official (IO) on the reliance agreement and return the signed
           reliance agreement to the AU PI. 
                  a.   Note when continuing review is required, the IRB expects the AU PI to
                        submit documentation of ongoing approval from the External IRB,
                        using the AU IRB Renewal form and a copy of the External IRB's
                        documentation of approval. 

NOTE: Only when a copy of the final version of the IAA which includes all requested information and signatures of both Institutions' Signatory Officials has been received and reviewed by the IRB Reviewer will IRB approval be issued. No research activities can occur until IRB approval is issued.

**Please note the Auburn University IRB does not enter into reliance agreements for EXEMPT level research.**

For assistance with the ceded review process, contact the AU IRB at 334-844-5966 prior to submission of the application.

(Single IRB guidance under construction)


Developmental Approval Request
February 8, 2021

When plans for the involvement of human subjects are not finalized and IRB review is required to establish a funding account, then “developmental approval” (118 designation under 45 CFR 46.118) may be granted.  Whether a project needing IRB certification for a sponsor receives developmental approval is at the discretion of the AU IRB.

Developmental Approvals (DA) specify the purpose of the research, how the research involves human subjects and the Auburn University research team’s role in the study.  The DA addresses the proposed human subjects research activities, data and/or specimen collections, and a proposed timeline when human subject components will be developed and implemented.

Developmental approvals expire after one year.  To obtain a formal extension an explanation and a new timeline involving human subject research activities must be submitted to the IRB Submission Page

When study instruments are developed, a complete IRB application must be submitted for IRB review.  If the development of instruments involves human subjects, IRB approval must be obtained before human subjects research activities begin.    

When a complete IRB application is submitted reference the developmental approval number in the body of the email. The new IRB application should reference the existing IRB protocol number (issued when developmental approval is granted) in the area of listing other IRBs associated with this project to “link” the developmental approval with the new IRB application. A copy of the developmental approval issued by the IRB must be included as the first document of the new IRB submission.

While developmental approval allows the establishment of a funding account, work with human subjects, human data or specimen collection may not begin until there is final IRB approval of an Exempt, Expedited, or Full Board review application.

Finding of non-compliance:

Human Subjects Research can be conducted only after IRB approval is issued. Conducting research without IRB approval is non-compliance. If the Human Research Protection Program is made aware of research activities being conducted without IRB approval, the Director of Research Compliance and the Director of Sponsored Programs will be notified immediately. All activities will be required to cease and funding may be halted while the non-compliance is reviewed.

Submission Instructions:  Email the completed “Developmental Approval Request” to the IRB Submission Page

To access the Developmental Approval Form, click here.


Zoom Guidance
April 20, 2020

Given current safety concerns resulting from the COVID 19 pandemic, more than ever the safety (risks) to research personnel and participants in human subjects research must be a priority.  As a research study continues, the IRB stresses the need for the Principal Investigator to ensure (at least) the following when utilizing Zoom technology and beyond:

  1.  Participants are reminded to protect their privacy by completing activities in a private space, to ensure conversations are not overheard;
  2. Participants are encouraged to disable “cookies” and close device browser;
  3. Participants are told how and where Zoom recordings are saved;
  4. Investigators must use Zoom provided by Auburn University (safety features built within), as other platforms may have limitations;
  5. Investigators must share Zoom recordings in a safe, private area/way that only research staff can access.

Researchers have latitude how to present Zoom information to participants. Reminders can be part of consent discussions, can be included as a reminder in the information letter/consent form, or as a reminder at the beginning of the Zoom interview, the goal of the guidance is to remind researchers and participants that Zoom use includes privacy concerns. 

Compensating participants?

If research participants will receive compensation, BEFORE you submit your application for IRB review, become familiar with AU Procurement and Business Services (PBS) policies associated with compensation to research participants, available online  at
The IRB and PBS are guided by different regulations and function independently; however, to ensure compensated research participants understand exactly what is required of them if they choose to enroll in a study, researchers MUST describe all compensation procedures.  PBS prescribed compensation procedures are described to the IRB in the application form and to participants in the information letter or consent form.  Failure to follow PBS policies may burden research participants and/or require modification to an approved IRB protocol.  For further guidance on PBS policies regarding research participant compensation, contact PBS at 844-7771.   

Who is Required to Complete Human Subjects Training?
Key personnel are required to complete and maintain up to date human subjects training.  To assist you in determining whether research staff are key personnel required to complete human subjects training (via CITI), click the link Key Personnel Flowchart.

AU IRB Expedited Category Guidance

For guidance on the nine categories of research that may be eligible for review via the expedited process, click the link AU IRB Expedited Category Guidance.  Note expedited review cannot be used for research involving prisoners.

Is My Activity Research?

May 8, 2019

The Office for Human Research Protections (OHRP) has prepared human subjects regulations decision charts to help researchers, IRBs, and others determine whether an activity is research involving human subjects that must be reviewed by an IRB per requirements of the US Department of Health and Human Services (HHS) regulations at 45 CFR part 46.  The charts address decisions on:

  • whether an activity is research that must be reviewed by an IRB;
  • whether the review may be performed by expedited procedures, and
  • whether informed consent or its documentation may be waived.

The charts are for use in conjunction with, not excluding, applicable regulatory provisions and requirements including FDA, NIH, sponsors, or state or local governments.  The charts are available online  

AU Policies and Procedures are available online at

First Time Submitting an Application for IRB Review?

We encourage you to include the Auburn University Office of Research Integrity & Compliance (ORIC) early in your preparations. Our staff is available to consult with researchers to shed a light on required procedures and practices at Auburn University.  Your goal is protocol approval; our goal is to facilitate the review process as we protect human subject participants.  By working together early in the process, both goals can be met.

Any activity that meets either (a) the Department of Health and Human Services (DHHS) definition of both “research” and “human subjects” or (b) the Food and Drug Administration (FDA) definitions of both “clinical investigation” and “human subjects” requires review and approval by the AU IRB.

Our website  provides a broad look at AU requirements and documents. 

Who should you contact?

Conflict of interest and other research integrity questions?  Milly Tye, (334) 844-8601

Scope of work questions?  Niki Johnson, (334) 844-5914

IRB questions?   Please contact the IRB Office via email (, or by phone (334) 844-5966.

Updating Forms – An Ongoing Process

As the AU Human Research Protection Program (HRPP) continues to respond to researchers’ suggestions and changes to the common rule, members of the AU research community can anticipate changes to many familiar forms.  To stay abreast of the improvements, we encourage you to periodically check the What’s New? page on our website. 

On our forms page, a new version (04.22.19) of the AU IRB Request for Exemption form has replaced the previous version of the form.  As of April 22, 2019, this version of the form is the only version that will be accepted. Click here to access the revised Exemption form.

On our forms page, a new version (04.15.19) of the AU IRB Request for Modification form has replaced the previous version of the form.  As of April 15, 2019, this version of the form is the only version that will be accepted. Click here to access the revised Modification form.


Once all information is provided on the form, submit through the IRB Submission Page.


Research – Research is defined as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities. For purposes of this part, the following activities are deemed not to be research:

(1) Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.

(2) Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).

(3) Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.

(4) Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.

Human Subject – Human subject means a living individual about whom an investigator (whether professional or student) conducting research:

  1. Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
  2. Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.

Clinical Trial – Clinical trial means a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of the interventions on biomedical or behavioral health-related outcomes.

Identifiable Private Information – Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (e.g., a medical record).

Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information.

Identifiable Biospecimen – An identifiable biospecimen is a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen.

Target Population - Target population is desired population - participants who meet inclusion criteria. For example, the target population for a study may be men 70 years of age who live on College Street in Auburn Alabama. A 70 year old man joins the study and it is realized the man is considered a prisoner as defined by OHRP. However, enrolling this individual does not make the study a prisoner study because prisoners are not the targeted population.

What is an Reliance Agreement?

reliance agreement is a formal, written document that provides a mechanism for an institution engaged in research to delegate institutional review board (IRB) review to an independent IRB or an IRB of another institution. 

EXEMPT level research – The AU IRB does not enter into agreements for projects that meet EXEMPT criteria. 

Research reviewed via the EXPEDITED process and reviewed by the CONVENED BOARD (greater than minimal risk studies) may include multi-site agreement(s). 

When the AU site relies on an External (not AU) IRB – Auburn can be a participating site in multi-site research and rely on an external IRB.  The external IRB can be another institution (e.g., UAB) or an independent IRB (e.g., WIRB).  Even though AU is not the relied upon IRB, a research application must be submitted through the IRB Submission Page, including a copy of the authorization agreement which requires the signature of the AU Institutional Official, if available.  Contact the AU IRB (844-5966) early to discuss the process.  

When an External (not AU) IRB site relies on the AU IRB – When AU is prime and single IRB review by the AU IRB is intended, initial review requires review by the AU IRB and the relying IRBs.  The AU Principal Investigator(PI) must submit the application to the AU IRB on behalf of all participating sites and will be the communication contact between the AU IRB and other participating teams.  Site specific differences require communication with the AU PI, who forwards to the AU IRB, as applicable.    The AU IRB will be responsible for continuing review and oversight, with the AU PI continuing as the contact between the AU IRB and participating sites.  Contact the AU IRB (844-5966) early to discuss the process.  

SMART IRB – Auburn is a member of SMART IRB, “Streamlined, Multisite, Accelerated Resources for Trials.”  Some sponsors require researchers to utilize SMART IRB.  Being part of SMART IRB, institutions can rely on another IRB or have their local IRB responsible for IRB oversight duties during the life of the study.  For guidance on SMART IRB, contact the AU IRB (844-6966).  Additional information is available at

Additional guidance and points to consider are available online at OHRP’s website

Requirement for a Concise Summary

For studies reviewed via the Expedited process and studies reviewed by the Convened IRB, a “concise summary” is required as the first element of the consent document (information letter or consent form). 

This change is mandated by the revised Common Rule.  Per the Common Rule, the concise summary must include 7 elements that should allow a potential participant (a “reasonable person”) to review the summary and decide whether the study sounds like something they wish to participate.

Investigators can consider a concise summary to be similar to an abstract representing the "high points" of the research study.

The 7 required elements include:

  • General Information
  • Purpose
  • Duration and Visits
  • Overview of Procedures
  • Risks
  • Benefits
  • Alternatives


One example of language for the concise summary is available on the Sample Documents page at  A concise summary example can be found here - the language is for guidance and should be modified to meet your specific study. Please use the table format for the concise summary.

Is Your Study a Clinical Trial?

National Institutes of Health (NIH) expanded the definition of studies that are clinical trials.  The goal of the NIH effort is to encourage advances in the design, conduct, and oversight of clinical trials while elevating the biomedical research enterprise to a new level of transparency and accountability. 

On a practical level, the changes affect researchers, participants, and IRB administrators.  For researchers/study sponsors the changes require registration on and the receipt of a National Clinical Trial (NCT) number, which is reported to the IRB.  The website also allows a sort of “recruitment” tool for potential participants to inquire about clinical trials. 

For participants, provides a valuable resource to learn of clinical trials that may be available to them. 

For IRB administrators, documentation of the clinical trials at their institution, documentation of the NCT #, and verification of language in consent documents is now mandated.   

The NIH definition of a clinical trial is, “A research study, regardless of funding, in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of those interventions on behavioral or health-related biomedical outcomes.”  Clinical trials are not limited to biomedical research, as the NIH definition demonstrates.

If your study meets the definition of a clinical trial, language is required in all consent documents.  Include a paragraph that reads, “A description of this clinical trial will be available on, as required by U.S. Law. This Web site will not include information that can identify you. At most, the Web site will include a summary of the results. You can search this Web site at any time.”

Guidance documents are available here:

Decision Tree for NIH Clinical Trial Definition (

NIH Checklist to Determine Whether a Research Study Meets the NIH Definition of a Clinical Trial (

The AU IRB is available to discuss questions related to whether a study is a clinical trial and requirements, if so. 

Changes in the Common Rule - effective January 21, 2019

The Federal Policy for the Protection of Human Subjects, known as the Common Rule, has undergone substantive revisions for the first time since publication in 1991.  Seventeen federal agencies have adopted the revised Common Rule; however, the FDA and Department of Justice (DOJ) have not signed on to the Common Rule at this time.  Research subject to FDA regulations or sponsored by FDA or DOJ will continue under current regulatory requirements.  Additionally, OHRP has not yet provided guidance associated with the revised Common Rule.  As we move forward, business decisions will continue to be made and may prompt revisions to our implementation strategy.  Be mindful of ongoing AU IRB communications, including the AU IRB website and training opportunities.  Excellent resources are available at

Activities which are NOT RESEARCH include:
Scholarly and Journalistic Activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information that focus directly on specific individuals about whom the information is collected; and
Public Health Surveillance, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority.

Major Changes to research reviewed via the expedited process (EXPEDITED REVIEW) include consideration of the requirement for continuing review and that some research will now qualify for Exempt review.
Major Changes to EXEMPTION REVIEW include new categories, some categories going away, expansion and revision of categories, and the requirement for limited review by the IRB Chairs or designated reviewer(s) for certain categories.  The AU IRB has determined that as currently interpreted, Broad Consent (required for new exemption categories 7 and 8) is not feasible at Auburn and these 2 categories will not be implemented at this time.  Guidance specific to practices of the AU IRB for EXEMPTION REVIEW can be found at  For further information call AU IRB at (334) 844-5966.

NIH Policy for Issuing Certificates of Confidentiality – effective October 1, 2017

A new NIH Policy (NOT-OD-17-109) related to issuance of Certificates of Confidentiality (CoC) was released September 7, 2017. Under the new policy, as of October 1, 2017, NIH funded researchers will no longer have to request a CoC from NIH, nor will they receive an actual certificate. The CoC will be issued automatically to NIH funded grants, cooperative agreements, contracts and intramural research projects funded wholly or in part by the NIH that collect or use identifiable, sensitive information. Compliance with the requirements will become a term and condition of the award. All NIH funded research that was commenced or ongoing on or after December 13, 2016 that is within the scope of this policy will be deemed covered by a CoC. For non-NIH funded research, NIH will continue to consider CoC applications submitted to NIH institutes and centers through the NIH online CoC application system.  NIH maintains a CoC Kiosk for information, sample consent language, and applications.  Additional information is available in the NIH CoC Table and the AU CoC Process.

NIH Policy on the Use of a Single IRB for Multi-Site Research – effective January 25, 2018

A new NIH Policy (NOT-OD-16-094) on the use of a single Institutional Review Board (sIRB) for multi-site research will become effective January 25, 2018.  Under the new policy, NIH establishes an expectation that a sIRB of record will be used for the ethical review of non-exempt human subject research funded by the NIH where the same protocol will be carried out at more than one site in the United States.  Applicants must include a sIRB Plan in the proposal/application or a justification for how the project meets one of the defined exceptions.  Execution and maintenance of Authorization (Reliance) Agreements between the sIRB and participating sites which documents roles, responsibilities, and communication of sites are required.  Participating sites will provide information on local context (including state and local law) to the sIRB and may be required to meet other regulatory requirements.  Additional information is available on the NIH Office of Science Policy website.  A summary of the NIH sIRB Policy and AU implementation is available in the NIH sIRB Chart and the AU sIRB Process.

Revised Common Rule – 45 CFR 46 – effective January 19, 2018 (most provisions)

The U.S. Department of Health and Human Services and 15 other federal agencies issued a final rule to update regulations that safeguard individuals who participate in research. Most provisions in the new rule will go into effect January 19, 2018. Compliance with the cooperative research requirements is not required until January 20, 2020.  The new rule is intended to modernize, strengthen, and make more effective the Federal Policy for the Protection of Human Subjects.  The revised common rule contains numerous changes from the prior regulation which have been in place since 1991.  Items and topics with significant changes include: the definition of human subject research along with other definitions, consent forms and required elements including a new broad consent, public posting of certain consent forms, use of stored identifiable data or identifiable biospecimens, limitations on waiver of consent, new and revised exempt categories, a new type of IRB review (limited IRB review), elimination of the requirement for continuing review of certain studies, and review of cooperative research.  Additional information is available on the Office of Human Research Protection (OHRP) website.  A summary of changes to the Common Rule is available in the Revised Common Rule Chart (coming soon). 

The Difference Between the Terms Coded, De-identified and Anonymous

These three terms are sometimes used incorrectly, often causing confusion to researchers and reviewers of research.  The information below may be helpful:

Coded:  Direct personal identifiers have been removed (from information or specimens) and replaced with words, letters, figures, symbols, or a combination of these (not derived from or related to the personal information) for purposes of protecting the identity of the source(s); but the original identifiers are retained in such a way that they can be traced back to the sources(s) by someone with a code. 
Note: A code is sometimes also referred to as a “key,” “link,” or “map.”

De-identified:  All direct personal identifiers are permanently removed (from information or specimens), no code or key exists to link the information or materials to their original source(s), and the remaining information cannot reasonably be used by anyone to identify the source(s).
Note: For purposes of Human Research Protection Policy, protected health information is de-identified when it does not contain any of the 18 identifiers specified by the HIPAA Privacy Rule at 45 CFR Part 164. (See below for the list of the 18 HIPAA specified identifiers).

Anonymous:  Unidentified (that is, personally identifiable information was not collected, or if collected, identifiers were not retained and cannot be retrieved); information or materials (information or specimens) that cannot be linked directly or indirectly by anyone to their source(s).

What Are the 18 Identifiers that Make Health Information Protected Health Information (PHI)?  

The HIPAA Privacy Rule protects most “individually identifiable health information” held or transmitted by an entity that is covered by HIPAA (covered entity) or that entity’s business associate, in any form or medium, whether electronic, on paper, or oral.  The Privacy Rule calls this information Protected Health Information (PHI).  
The 18 identifiers include -

• Names
• Dates, except year
• Telephone numbers
• Geographic data
• FAX  numbers
• Social Security numbers
• Email addresses
• Medical record numbers
• Account numbers
• Health plan beneficiary numbers
• Certificate / license numbers
• Vehicle identifiers and serial numbers including license plates
• Web URLs
• Device identifiers and serial numbers
• Internet protocol addresses
• Full face photos and comparable images
• Biometric identifiers (i.e. retinal scan, fingerprints)
• Any unique identifying number or code

Note: PHI refers to protected data; however, PHI differs from (but is similar to) the term Personally Identifiable Information (PII), which refers to data that can identify a person.
Full name, date of birth, address and biometric data are always considered PII.  Other information, like a first name, first initial and last name or height or weight, may only be considered PII in certain circumstances or when combined with other identifying information. 

Additional information is available at 

Protecting Privacy?  Or Maintaining Confidentiality? 

Privacy Concerns People. The following are considerations and strategies for respecting the privacy of potential participants:

                • Consider the methods used or setting where potential participants are identified. What is the targeted study population's expectation of
                privacy, both in person and online? 

                • Only approach individuals known to you or make contact on behalf of someone the individual knows. 

                • Comply with privacy guidelines of applicable professional associations and scholarly disciplines (e.g., oral history, anthropology,

                • Access the minimum amount of information necessary.

Confidentiality Concerns Data. Confidentiality refers to the researcher’s agreement with the participant about how the participant’s identifiable private information will be handled, managed, and disseminated. In the IRB application, investigators describe their plan to preserve the confidentiality of identifiable data, including:

                • Controls on storage, handling, and sharing of data;

                • Physical security measures (e.g., locked facility, limited access); 

                • Data security (e.g., password-protection, data encryption) see IRB Data Security Guidance; 

                • Safeguards to protect identifiable research information (e.g., coding, certificate of confidentiality); 

                • Procedures employed when sharing material or data, (e.g., honest broker (if applicable), written agreement with recipient not to
                re-identify) and

                • Measures that you will take to secure and safeguard confidentiality if protocol involves storing or sharing information or
                tissue/specimens/data for use in current or future research.

If you have questions, contact the AU Human Research Protection Program at 334-844-5966 or

Thanks to AAHRPP for this guidance.

Human Subjects Research


540 Devall Drive, Suite 200

Auburn, AL 36832

Phone: 334.844.5966