Skip to Content
Cancer Diagnosis Program
Contact NExT
Show menu
Search this site
Last Updated: 09/27/17



A ‘human subject’ is a living individual about whom an investigator obtains either 1data through intervention or interaction with the individual, or 2identifiable private information. Legal requirements to protect human subjects apply to a much broader range of research than many investigators realize, and researchers using human tissue specimens are often unsure about how regulations apply to their research. Legal obligations to protect human subjects apply, for example, to research that uses:

  • Bodily materials, such as cells, blood or urine, tissues, organs, hair or nail clippings, even if you did not collect these materials
  • Residual diagnostic specimens, including specimens obtained for routine patient care that would have been discarded if not used for research
  • Private information, such as medical information, that can be readily identified with individuals, even if the information was not specifically collected for the study in question. Research on cell lines or DNA samples that can be associated with individuals falls into this category.


Comply with your institution’s rules and the requirements of your Institutional Review Board (IRB) as well as meeting Federal requirements3 in order to carry out your research. Some institutions have requirements that exceed those of the Federal regulations. If you have any question or uncertainty about whether you need IRB approval, you should ask your IRB office for clarification.4 If you apply for an NIH grant or respond to a Request for Contract (RFC), failure to follow your institution’s procedures or to document the use of human tissues or data in your grant application or contract proposal can create problems and may delay funding or preclude award.


The IRB at your institution must review and approve research if it involves human subjects. This example, by minimizing risks, selecting subjects equitably, obtaining informed consent — when required — and ensuring privacy and confidentiality.

IRB approval must precede initiation of any work involving human subjects. No NIH grant or contract can be awarded until IRB approval is obtained. If the research continues, the IRB must review and approve the project at least once a year. When changes occur in the procedures with human subjects, the IRB must review and approve these changes.

If human subjects are harmed, including physical injury, improper disclosure of private information, economic loss or other harmful occurrences, the IRB must be notified.


Full Board Review — Review of proposed research at a convened meeting at which a valid quorum of IRB members is present. For the research to be approved, it must receive the approval of a majority of those members present.

Expedited Review — Review of proposed research by the IRB chair or a designated voting member or group of voting members rather than by the entire IRB. Federal rules permit expedited review for certain kinds of research involving no more than minimal risk and for minor changes in approved research.

IRBs are responsible for determining whether or not informed consent is required from the subjects from whom the specimens were obtained. The IRB may waive the requirement for informed consent if the risk to the subjects is minimal and if certain other conditions are met.5

You should not assume that your research poses minimal risk just because it involves tissue specimens. Loss of confidentiality can cause harm to patients and their relatives; IRBs will consider whether privacy and confidentiality protections are adequate.


Research with specimens and data from living persons does not require IRB approval either when it is determined that the research does not involve human subjects as defined in the Code of Federal Regulations (CFR) at 45 CFR 46.102(f), or it is determined that the only involvement of human subjects is in one of the “exempt” categories listed at 45 CFR 46.101(b)(1) through 46.101(b)(6).

The Office for Human Research Protections (OHRP), the organization which oversees implementation of the Federal Human Subject Protection Regulations,(45 CFR part 46), has issued guidance about determining when research with coded biospecimens or private data involves a “human subject”, or is exempt from the regulations. According to this guidance, researchers who obtain coded specimens, which cannot be linked to specific live individuals are not conducting research involving a “human subject”. For example, if there is an agreement between a researcher and a specimen provider for the transfer of coded biospecimens which prohibits the release of the code key, the specimens are not considered individually identifiable and the specimen provider, without additional collaboration in the research, is not considered involved in the research. Similarly in the case of coded specimens obtained from a biobank or university, if there are institutional operating policies or other legal requirements prohibiting release of the code key to the researcher, the specimens are not considered individually identifiable and the researcher is not conducting research involving a “human subject”. Under these circumstances, informed consent might not be required to conduct research on the coded specimens. However, most research institutions, including NIH, require investigators to obtain human subject review of research involving coded specimens to ensure that all appropriate protections have been provided.

The OHRP guidance also discussed a regulatory exemption that is most pertinent to work with human tissue specimens: Exemption #4 which applies to existing specimens and data. As stated in 45 CFR 46.101(b):

“Unless otherwise required by Department or Agency heads, research activities in which the only involvement of human subjects will be in one or more of the following categories are exempt from this policy: …(4) Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.”

Some researchers mistakenly believe that any studies on existing pathology specimens are exempt. However, exemption #4 does not apply to specimens that can be linked to patient identity, even if the subject identifiers are locked up or kept by someone other than the researcher. It does not matter if the tissue would otherwise have been discarded. In addition, exemption 4 only applies to specimens that are “on the shelf” (or in the freezer) at the time the protocol is initiated.

You should be aware that many institutions require an IRB to determine whether or not the research is exempt, or whether specimens have been de-identified. Recent studies have demonstrated the possibility of re-identification of de-identified specimens and data maintained in aggregate databases such as the NIH database of genotypes and phenotypes (dbGAP).6 While the science is evolving rapidly in this area,7 research specimens are generally considered de-identified under 45 CFR part 46 if there is no data attached (i.e., remnant clinical tissue). Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule removing eighteen specified types of identifiers from data (such as dates and medical record numbers) makes information de-identified under HIPAA standards. More information about HIPAA and biospecimen research can be found at

What is meant by “publicly available sources”?

This language in the regulation was intended to apply to public sources of data, such as death certificates. Its meaning with respect to human tissue specimens is widely debated. Although there are organizations that make human cells and tissues broadly accessible at reasonable cost to the research community, these materials are not usually available to the public at large. Even if you obtain specimens from such a source, you should not assume that it meets the definition of “publicly available.” It is up to your IRB to decide.

How can I determine if my research requires prior IRB review?

The humans subjects regulations decision charts from OHRP will help you to see whether your research falls under the human subjects regulations and if so, whether it is likely to require full IRB review or is a candidate for expedited review. You should be aware, however that institutions vary in their requirements for IRB review. Many institutions require some form of IRB review even for exempt studies. You must check with your institutional officials to determine whether full, expedited, or no IRB review is required for your proposed project.


The PHS 398 application kit for a Public Health Service grant requires information about the involvement of human subjects in the proposed research. The face page of the application asks you to certify whether or not human subjects are involved, and, if so, whether an exemption is claimed and the exemption number. In the case of a research contract proposal the Optional Form 310 will serve in lieu of the PHS 398 Form. If your institution has an applicable FederalWide Assurance on file with OHRP, and the research involves one or more “human subjects” and is not exempt, you or your business office must provide an Assurance of Compliance Number, the IRB approval date, and indicate whether the approval was by full IRB review or by expedited review. If your proposal is selected by the NIH for an award and your institution does not have a FederalWide Assurance, then it must contact OHRP.

Additional information must be provided in the Human Subjects section of the Research Plan. If you have claimed an exemption on the face page (or on Optional Form 310 for a contract proposal), you should provide sufficient information in the Human Subjects section and in the body of the proposal to show that the exemption is appropriate. It is important to state whether the specimens already exist or will be collected prospectively and whether the specimens can be linked to subject identifiers.

This information should be provided for all specimens, including those obtained from collaborators. (Include the letters of collaboration with your proposal, rather than placing them in the Appendix.) Also remember that any NIH grant application or contract proposal involving human subjects must address the inclusion of women, minorities and children. Failure to provide this information could delay or prevent the award of your grant or contract.

The NIH Scientific Initial Review Group will review the information you provide in the grant or contract proposal to determine whether plans and approvals for use of human subjects are appropriate. Any comments or concerns noted by the Scientific Review Group are transmitted to the NIH awarding unit, institute/center’s council and the OHRP. The NIH awarding unit staff, in consultation with OHRP, are responsible for ensuring that any human subjects concerns are resolved prior to funding. NIH staff members are responsible for ensuring on an annual basis that there are no major changes in the human subjects research and that annual IRB approvals are obtained.

From time to time changes are made in the human subjects regulations and in their interpretation by IRBs and by OHRP. It is important to thoroughly review and understand the most current regulations before submitting your grant application and particularly before starting research. Check with your local IRB for guidance.



  1. Title 45 Code of Federal Regulations, Part 46 (January 15, 2009).
  2. If your institution has no IRB you may establish an IRB at your own institution and obtain Federal approval for the newly-created IRB, or you may obtain approval for your use of human subjects from an IRB elsewhere that satisfies all Federal requirements. For more information about these options contact the Office of Protection from Research Risks.
  3. Title 45 Code of Federal Regulations, Part 46 (January 15, 2009).
  4. If your institution has no IRB you may establish an IRB at your own institution and obtain Federal approval for the newly-created IRB, or you may obtain approval for your use of human subjects from an IRB elsewhere that satisfies all Federal requirements. For more information about these options contact the Office of Protection from Research Risks.
  5. Title 45 Code of Federal Regulations, Part 46.116.
  7. Homer N, Szelinger S, Redman M, Duggan D, Tembe W, et al. 2008. Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays. PLoS Genet 4(8):e1000167.

    Schadt EE, Woo S, and Hao K. 2012. Bayesian method to predict individual SNP genotypes from gene expression data. Nat Genet 44:603-8.

    Gymrek M, McGuire AL, Golan D, Halperin E, Erlich Y. Identifying personal genomes by surname inference. Science 2013;339:321–324