This section provides details about the NC State University IRB\u2019s unit-level policies. They are treated as living documents and are updated as laws, regulations, university policy, and societal contexts shift. Please review the procedures and guidance page of our website to supplement the unit standards.<\/p>\n\n\n
\n \n\n
This section provides details about the NC State University regulations. If you have a question about the university\u2019s human subjects research regulation, please contact IRB-Director@ncsu.edu<\/a> for assistance. If you have a question about the university\u2019s privacy\/confidentiality regulation, please contact the Office of General Counsel<\/a> for assistance. <\/p>\n\n\n\n A number of federal laws and regulations govern research with human subjects, namely 45 CFR 46. Other applicable laws and regulations include, but are not limited to, FERPA, HIPAA, and the GDPR.<\/p>\n\n\n\n This regulation governs research with human subjects and applies to all federally funded research involving human subjects. Due to NC State University REG 10.10.03<\/a>, 45 CFR 46<\/a> is applied to all NC State University research studies involving human subjects, regardless of funding. <\/p>\n\n\n \n \n\n The Family Educational Rights and Privacy Act (FERPA<\/a>) is a federal law that affords adult students or parents of minors the right to have access to their own child\u2019s education records. This includes the right to seek to have the records amended and the right to have some control over the disclosure of personally identifiable information from the education records. The IRB does not manage anything related to FERPA for NC State University. However, when researchers are completing research with human subjects that also intersects with FERPA-related activities, FERPA must be addressed in the IRB protocol and the informed consent\/parental permission\/minor assent documents.<\/p>\n\n\n \n \n\n \n \n\n The “NC Parents’ Bill of Rights” affects how research can be done with minors in K-12 public educational settings. These requirements influence the research proposed to the NC State IRB. Please review the NC State IRB guidance for “Research with Human Subjects and the NC Parents Bill of Rights<\/a>“.<\/p>\n\n\n <\/p>\n <\/details>\n\n\n <\/div>\n <\/div>\n\n\n\n The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that requires the creation of national standards to protect sensitive patient health information (PHI) from being disclosed without the patient\u2019s consent or knowledge. The U.S. Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The Privacy Rule standards address the use and disclosure of individuals\u2019 health information (known as \u201cprotected health information\u201d) by entities subject to the Privacy Rule. These individuals and organizations are called \u201ccovered entities.\u201d NC State University is considered a hybrid covered entity. The IRB does not decide what is and is not subject to HIPAA. However, when researchers are completing research with human subjects that also intersects with HIPAA, HIPAA must be addressed in the IRB protocol and supplemental documents. In rare cases, the NC State IRB will act as a \u201cPrivacy Board\u201d to determine if waiving participant authorization to access PHI is appropriate.<\/p>\n\n\n \n \n\n \n \n\n \n \n <\/div> <\/div> <\/div> Additional requirements for DoD-supported research are noted in the guidance below. These requirements include specific content to be included in study documents and procedures, a possibly required scientific merit review before submission, and an additional review process with a Human Research Protection Officer (HRPO) once IRB approval is granted. <\/p>\n\n\n \n \n\n The General Data Protection Regulation (GDPR) is a European law that protects the privacy and security of personal data about individuals located in the European Economic Area (EEA). This applies to research being completed with people located in the EEA when the research is being completed or to research accessing identifiable data from the EEA. The IRB does not decide what is and is not subject to the GDPR. However, when researchers are completing research with human subjects that also intersects with the GDPR, then the GDPR must be addressed in the IRB protocol and supplemental documents. This most often manifests in the informed consent form.<\/p>\n\n\n\n \n \n <\/div> <\/div> <\/div> FDA regulations apply to research with human subjects when a drug, biologic, medical device, or certain foods, cosmetics, or tobacco products are used in research with humans. Much of NC State University’s human subjects research endeavors do not require FDA oversight. However, FDA regulations do apply to research at NC State University when a medical device is being tested for safety and efficacy. The NC State IRB will review research where a medical device is being used as a tool for research and is determined to be \u201cexempt from the IDE\u201d requirements. The NC State IRB will review research where a medical device is being tested for safety and efficacy if the device warrants a \u201cNot Significant Risk Device\u201d (NSR) determination and is subsequently eligible for an \u201cAbbreviated IDE.\u201d All studies involving \u201cSignificant Risk\u201d (SR) medical devices or requiring an Investigational New Drug Application (IND) for the use of drugs or biologics in research with human subjects will be reviewed by the WCG IRB unless a collaborating institution accepts oversight.<\/p>\n\n\n \n \n\n \n \n\n \n \n\n <\/p>\n\n\n <\/p>\n <\/details>\n\n\n <\/div>\n <\/div>\n\n\n\n GINA protects individuals against discrimination based on their genetic information in health coverage and in employment. This relates to research with human subjects, as it serves as a risk mitigation measure when genetic information is collected by researchers. This law sets boundaries around employers’ ability to discriminate based on genetic information. If an NC State researcher is analyzing data or specimens for genetic information, this law can be referred to as a risk-mitigation measure regarding employment risks.<\/p>\n\n\n\n\n
Federal Laws and Regulations<\/h2>\n\n\n\n
The Final Rule (45 CFR 46)<\/strong><\/h3>\n\n\n\n
\n \n <\/span>\n <\/span>\n
Key Sections of the Final Rule<\/h2>\n <\/summary>\n
\n
Family Educational Rights and Privacy Act (FERPA)<\/strong><\/h3>\n\n\n\n
\n \n <\/span>\n <\/span>\n
NC State IRB FERPA Policies, Procedures, and Guidance<\/h2>\n <\/summary>\n
\n
\n \n <\/span>\n <\/span>\n
North Carolina Law: NC Parents’ Bill of Rights<\/h2>\n <\/summary>\n
Health Insurance Portability and Accountability Act (HIPAA)<\/strong><\/h3>\n\n\n\n
\n \n <\/span>\n <\/span>\n
HIPAA Law and Related Regulations<\/h2>\n <\/summary>\n
\n
\n \n <\/span>\n <\/span>\n
NC State IRB HIPAA Policies, Procedures, and Guidance\u00a0<\/h2>\n <\/summary>\n
\n
Department of Defense (DoD): Protection of Human Subjects<\/strong><\/h3>\n\n\n
\n \n <\/span>\n <\/span>\n
Examples of DoD Entities <\/h2>\n <\/summary>\n
\n
\n\n
\n
\n<\/div>\n\n\n <\/p>\n <\/details>\n\n\n <\/div>\n <\/div>\n\n\n\n\n \n <\/span>\n <\/span>\n
DoD Guidance and Additional Requirements<\/h2>\n <\/summary>\n
\n
General Data Protection Regulation (GDPR)<\/strong><\/h3>\n\n\n\n
\n
\n \n <\/span>\n <\/span>\n
Countries Adhering to GDPR<\/h2>\n <\/summary>\n
\n
\n\n
\n
\n<\/div>\n\n\n <\/p>\n <\/details>\n\n\n <\/div>\n <\/div>\n\n\n\nFood and Drug Administration (FDA) Regulations<\/strong><\/h3>\n\n\n\n
\n \n <\/span>\n <\/span>\n
FDA Frameworks and Guidance<\/h2>\n <\/summary>\n
\n
\n \n <\/span>\n <\/span>\n
Clinical Trials and the FDA<\/h2>\n <\/summary>\n
\n
\n \n <\/span>\n <\/span>\n
Medical Devices and the FDA<\/h2>\n <\/summary>\n
\n
Genetic Information Nondiscrimination Act of 2008 (GINA)<\/strong><\/h3>\n\n\n\n
\n