Frequently Asked Questions

This guide walks you through the Cayuse IRB application question by question.

IRB Application Question Guide

What is human subjects research?

“Research” refers to a systematic investigation designed to develop or contribute to generalizable knowledge. This generally implies collection and analysis of data the researcher hopes to report in a scientific publication or at a professional meeting, although some departments review any research done by their students. “Human subjects research” involves the participation of human beings as subjects in such an investigation. See Does my activity need review? for guidance.

What special knowledge is expected for persons doing human subjects research?

All investigators and individuals involved in the review, oversight, and approval of human subjects research are required to complete training according to their role and status. Please see the Training page for more information.

How long does it take to receive approval?

It depends on the review category of your research as well as the level of detail provided in the application. Most applications will be returned for clarification due to inadequate information. Reading the questions in the application carefully and responding thoroughly will ensure the IRB has enough information to make a decision during the first submission. A common misconception is that you are working with anonymous data when in fact you are working with identifiable data that you intend to keep confidential. Please know the difference between "anonymous" and "confidential" so that you are appropriately handling the data. 

Exempt and Expedited (minimal risk) reviews do not have a deadline. These reviews can take anywhere from one week to four weeks. It depends on your research and the completeness of the application. Greater than minimal risk research will be reviewed by a full board at a convened meeting. More information can be found here.

What human subjects research can be reviewed at the department level?

Only undergraduates and Master's students in those departments or college with a research review committee can have research reviewed and approved at the department level if their research is considered "exempt." Exempt research is low risk research in which innocuous data is collected or somewhat risky data is collected anonymously. If an undergraduate or Master's student's department does not have such a committee that makes exempt determinations, the student must submit through the IRB. Please see the Submit page for more information.

Does research with pre-existing data require review?

If the data are available without restriction to the general public (i.e. no registration, fees, request procedures, etc.), such research does not require review. If access is limited, for example to persons with certain qualifications or to persons who pay a fee, and the data is considered to have identifiable information, the research will require review. See the Submit page for information on submitting an application.


What makes research "minimal risk" rather than "greater than minimal risk"?

Research is “minimal risk” when the probability (likelihood) and magnitude (severity) of harm or discomfort anticipated for participants is no greater than what might be encountered in daily life or during the performance of routine physical or psychological examinations or tests. Most research occurring at Sacramento State is considered minimal risk. However, if the study poses physical injury or the target population is considered "at risk," the research will be considered greater than minimal.

What is an example of risk of physical harm?

One example would be the possibility of pain and/or bruising when a blood sample is taken from a vein. There are many other possible examples and this example would be considered minimal unless blood samples are taken more often than usual.

What is an example of risk of psychological harm?

Questions about sensitive topics, such as sexual orientation, past experiences of abuse, and other topics not normally disclosed to an acquaintance could be stressful either when asked in an interview or when included as part of a questionnaire. Consider your subjects' population and the questions you are asking to appropriately evaluate this risk.

What is an example of risk of social or economic harm?

Social risk is a risk of losing a formerly held status within a community, and economic risk is losing financial support or finances in general.  Requesting employee evaluations of their supervisors when the identities of the participants could be linked to their responses would be one example. If responses that are unfavorable could be linked to an individual, this could lead to job loss and a changed perception of that individual.


What is an example of risk from inadequate protection of confidentiality?

Asking demographic questions that are not essential for the purpose of the research may unnecessarily allow some participants to be identified by their responses to those questions even if the research is otherwise anonymous. Handling of raw data is also an essential part of maintaining confidentiality. Limit access of the data to yourself and other research team members. Encode the data so that participants are given pseudonyms or numbers, if possible. Remove identifiers when they are no longer needed. Store data in locked or password protected locations that only you have access to.

What can be considered "benefits" when weighing the risk/benefit ratio for participants?

When research includes any element of risk, the committee is obligated to evaluate the extent of the risk and whether participants will receive any personal benefit sufficient to justify that level of risk. A “personal benefit” is something specific to the person (such as an opportunity to receive special training or an individual assessment of a particular health risk) that goes beyond any inducement (such as payment or entry in a raffle) offered as an incentive to participate. Sometimes the most honest answer is that participants will receive no direct benefit (other than the satisfaction of contributing to research that may eventually benefit others).

How does anonymity differ from confidentiality?

Anonymous data do not contain names or any other information that could directly or indirectly identify a specific person. Such anonymity can be assured when there is no linkage between any list of participants in the study and the data collected from them. It is rare that a researcher collects truly anonymous data. Confidentiality is simply a promise by the researcher to protect the data, which may or may not have identifiers in it, from being obtained or misused by others. Researchers are generally obligated to keep their data confidential, even if they are unable to collect it anonymously.

When a researcher is collecting identifiable information, either directly or indirectly, they need to respect the participant's privacy by maintaining confidentiality and they cannot state that the data are anonymous.

Direct identifiers include information that relates specifically to an individual such as name, address, Social Security Number or other identifying number or code linked to the data, telephone number, e-mail address, voice recording or video recording.

Indirect identifiers include information that can be combined with other information to identify specific individuals, including, for example, a combination of gender, birth date, geographic indicator and other descriptors. Other examples of indirect identifiers include place of birth, race, religion, weight, activities, employment information, medical information, education information, and financial information. A small dataset can be considered identifiable if enough demographics are collected that could accidentially identify an individual.

I am collecting identifiable data. What do I do?

Ensure that you are only collecting the information that you need to answer your research question/hypothesis.

If you need to collect data over time, have participants code the data for you by providing a unique code rather than a name (i.e. first and last inital + last four digits of cell phone).

Tell your participants in the informed consent form that you will be collecting information that could connect them to the research data. Inform them of your data security plan (storage on a password protected hard-drive, for example), when you plan on removing identifiers if possible (deleting an audio recording after transcription, for example), and how long you plan on keeping the data after it's been de-identified. If you can't de-identify the data, participants should know how long you plan on keeping the data and if you plan on sharing the data with others (i.e. other researchers for analysis).

Please also see Data Security.


What kinds of information need to be included in a consent form?

Any information that could reasonably affect a person’s willingness to participate in the research must be disclosed. See Informed Consent templates on the Resources page.

For research with school-age children, do both the parent and the child have to give consent?

Parental consent is required, and the children must also give their assent to participate. For very young children, this could be just a brief verbal description of the activity and asking the child’s willingness to participate. A short written consent form in simple language would be appropriate for somewhat older children, and still older children could be given a more extensive written consent form that is closer to the one given to the parents. See templates on the Resources page.

How can consent be obtained from children or from persons with an impaired ability to understand a consent form?

The key requirement is to use language that will be understandable to the person and to take sufficient time to be sure that the person understands the nature of the research and any risks before requesting agreement from the person to participate in the research. In some cases with persons with an impaired ability to understand, their parent or guardian will need to provide consent as well as the participant.

When is it possible to withhold information about the purpose of the research or to give misleading information about the purpose of the research?

Only when this would not affect the willingness to participate in the research, and the misinformation or withheld information is provided afterward in debreifing. It is not appropriate to withhold information that would affect willingness to participate merely because such information might affect how participants respond during the research.

Where can a researcher obtain an application form to request human subjects review?

Our application process has moved to an electronic, online platform called Cayuse IRB. Information on accessing this platform and guides to navigate Cayuse IRB are available on the Submit webpage.

Where should I keep my raw data?

Datasets, paper surveys, transcribed interviews, audio recordings, etc. must be stored in a secure location where only the research team has access when needed.

If you are working with paper documents, these should be stored in locked drawers or offices and the key should only be accessible to the research team. Signed informed consent forms must be stored separately from the collected data. This means another locked drawer or office. Once the study is complete, the documents should be kept for three years and then shredded. If there are any identifiers on the documents that do not need to be on the documents once the study is complete, these should be removed before long-term storage.

If your data is being stored electronically, it ought to be stored on one password protected hard drive or one password protected laptop. Access to the hard drive or laptop must be limited to the research team. If you propose to use a family computer, a separate password protected user must be created where only the researcher has access to the files.

Do I have to destroy my data?

No! Although the IRB will ask that any identifiable information that does not need be kept be destroyed once your study is over or three years after the completion of your study. Once the data are de-identified, you may choose to keep it indefinitely. However, this must be stated in the informed consent form so participants are aware.

If you promised your participants that raw data would be destroyed after a period of three years (or more), please keep your word and delete, shred, and destroy that data. The IRB will ask that raw data be kept for at least three years in the event that data will be requested for verification or replication of your study.

How do I protect Audio Recordings of Interviews?

Since audio recordings are considered direct identifiers (a person's voice is unique), extra precautions should be taken to secure the recordings. Most recording devices are not password protected, unless you are using a smart phone. Once the interview is over, the recordings should be saved to a password protected hard-drive (can be a portable hard-drive) and deleted from the mobile/recording device. Now the recording is safely stored on a password protected hard-drive and can remain there until the recordings are no longer needed. Usually, recordings are transribed for anlaysis. Once the transcription is complete, there may not be any reason to keep the identifiable audio recording and it can be deleted from the hard-drive. Once the audio recording is deleted, you will have a de-identified transcript (assuming any other identifiers provided by the participant was removed from the transcription). This de-identified transcript can be kept on a password protected hard-drive for at least three years.

If you are a participant in research and have questions about your rights in research, please visit our Participant Rights page.