Do You Need an IRB? Research Ethics for Nonprofit Program Studies

The Two Questions That Decide Everything: Is It Research, and Are There Human Subjects?

The Federal Policy for the Protection of Human Subjects, known as the Common Rule, is codified for the Department of Health and Human Services at 45 CFR 46 and adopted by a number of other federal departments and agencies. The current version, often called the 2018 Requirements, took full effect in January 2019. Whether an activity falls under it depends on two definitions, and both must be met.

First, the regulation defines research as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge." Notice that evaluation is explicitly named. Program evaluation is not automatically excluded, which surprises many nonprofit staff. What matters is the phrase "designed to develop or contribute to generalizable knowledge." An evaluation designed to tell your organization whether your own program is working, so you can improve it, is generally not aimed at generalizable knowledge. A study designed to test whether a type of intervention works, with the expectation that the findings will inform the field beyond your program, generally is. The intent and design of the activity at the outset matter more than its methods. A randomized design does not make something research, and a simple survey does not make something not research.

Second, a human subject is "a living individual about whom an investigator ... conducting research" either obtains information through intervention or interaction with the person and uses or analyzes it, or "obtains, uses, studies, analyzes, or generates identifiable private information." Identifiable private information is information "for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information." This second definition is why secondary analysis of your existing client records can still be human subjects research. You do not need to talk to anyone. If a researcher can readily tell who the records are about, the people in them can be human subjects.

The 2018 Requirements also carved out a handful of activities that are "deemed not to be research," including "scholarly and journalistic activities (e.g., oral history, journalism, biography ...)" that focus directly on specific individuals, along with certain public health surveillance and criminal justice activities. These carve-outs are narrower than they sound. An oral history project about specific community elders may be outside the rule, while a project that interviews many people to draw general conclusions about a population may not be.

When the Rules Legally Apply: Federal Funding, Assurances, and State Law

Even if an activity is human subjects research, the Common Rule does not automatically apply to every organization in the country. It applies to research conducted or supported by the federal departments and agencies that have adopted it, which include HHS, the Department of Education, the National Science Foundation, the Department of Agriculture, the Department of Housing and Urban Development, and others. The Department of Justice has its own version of the rule that still follows the pre-2018 requirements, so check which version your funder applies. If your organization receives federal funding for a project that involves non-exempt human subjects research, and your organization is "engaged" in that research, you generally need a Federalwide Assurance (FWA) on file with OHRP and IRB review that satisfies the regulations. That obligation can flow down through pass-through grants from states and through subawards from universities, so read award terms carefully rather than assuming federal rules only apply to direct federal grants.

"Engagement" is a term of art. OHRP's guidance on engagement of institutions explains that an organization is generally engaged when its employees or agents interact or intervene with participants for research purposes, obtain informed consent, or obtain identifiable private information for the research. An organization that only permits researchers to recruit at its site, or that releases information only in coded form without access to the key, may not be engaged. This matters for nonprofits because many partnerships can be structured so that the university is engaged and the nonprofit is not, which reduces paperwork. It does not reduce your ethical responsibility for how participants are treated.

Privately funded research conducted by a nonprofit with no federal support and no university partner may not be legally subject to the Common Rule at all. That is not the end of the analysis. Some states have their own human subjects laws. Maryland, for example, extends the federal human subjects regulations to research conducted in the state regardless of funding source. Other legal regimes, including HIPAA, FERPA, state privacy laws, and professional licensing standards, may apply independently. Foundations increasingly require IRB review as a grant condition, and most journals expect it. In practice, "no legal requirement" usually means "you choose a level of independent ethical review appropriate to the risk," not "no review."

If you are considering whether to join an outside study as a site or data partner, rather than leading research yourself, our article on participating in AI research pilots covers the questions to ask before you agree, including who owns the data and who holds the IRB approval.

Whose IRB? University Partnerships, Reliance Agreements, and Independent IRBs

Most nonprofits do not have their own IRB, so the practical question is which IRB will review the work. In a university partnership, the answer is usually the university's IRB. Faculty, staff, and students are almost always required by institutional policy to obtain IRB review for human subjects research, regardless of funding source. When your organization is also engaged in the research, for example because your staff will recruit participants, obtain consent, or collect data, the two organizations typically sign a reliance agreement, sometimes called an IRB authorization agreement. Under that agreement, your organization relies on the university's IRB rather than establishing its own review. For federally funded cooperative research involving more than one US institution, university partnerships are also shaped by the single IRB requirement at 45 CFR 46.114(b), which generally requires engaged institutions to rely on one IRB of record.

Reliance agreements are useful but deserve careful reading. They spell out who is responsible for training staff in human subjects protections, who reports problems and to whom, whose policies govern data storage, and what happens if a participant files a complaint. Many universities will require your frontline staff to complete human subjects training, such as the widely used CITI Program modules, before they can recruit or consent anyone. Plan for that time. Also be aware that the university's IRB protects participants within the scope of the protocol, not your organization's broader interests. Data ownership, publication rights, how your organization is named in publications, and whether results will be shared with participants are matters for a separate data use or partnership agreement.

When there is no university partner, or the university IRB will not review work led by your staff, independent IRBs are an option. These are organizations, some for-profit and some nonprofit, that provide IRB review for a fee. Several handle social and behavioral studies as well as clinical trials. Fees vary considerably by provider and by type of review. Exemption determinations and minimal risk expedited reviews generally cost far less than full board reviews, and some providers offer reduced rates for nonprofits or for social science work. Request quotes from several providers, ask specifically about community-based and social services research experience, and ask whether their reviewers include community members. Any IRB reviewing research supported by HHS must be registered with OHRP, and you can check registration status through OHRP's public database.

Large research-focused nonprofits sometimes establish their own IRBs, which requires registration, written procedures, qualified members including at least one nonaffiliated member and one whose primary concerns are nonscientific, and ongoing administrative support. For most community organizations, the workload and expertise required make this impractical. A middle path some organizations use is an internal research review committee that screens proposed studies, decides which ones need outside IRB review, and handles data-sharing requests from outside researchers. That committee does not replace an IRB, but it creates a consistent front door so that requests do not get approved informally by whichever program manager a graduate student happens to email.

Where HIPAA and FERPA Overlap With Research Rules

The Common Rule is not the only federal framework that touches nonprofit research. If your organization is a HIPAA covered entity, such as a community health center, behavioral health provider, or other organization that bills health plans electronically, protected health information is governed by the HIPAA Privacy Rule regardless of whether the Common Rule applies. Using or disclosing protected health information for research generally requires either the individual's written authorization or a waiver of authorization approved by an IRB or privacy board, unless the data are de-identified or shared as a limited data set under a data use agreement. HHS's de-identification guidance explains the two accepted methods: Safe Harbor, which requires removing 18 specified identifiers and having no actual knowledge that the remaining data could identify someone, and Expert Determination, in which a qualified expert concludes that the risk of re-identification is very small. Many social service nonprofits are not covered entities, but they may hold health information under contracts that impose similar obligations. Our guide to HIPAA and AI in healthcare nonprofits covers this in more detail.

FERPA governs personally identifiable information from student education records held by schools and districts that receive Department of Education funds. Nonprofits that run school-based programs, after-school tutoring, or college access services often want to use student records to evaluate outcomes. FERPA permits disclosure without consent under specific exceptions, including a studies exception for research conducted for or on behalf of the school or district, and an audit or evaluation exception for certain education program evaluations. Both require a written agreement that specifies the purpose, scope, and duration of the work, the information to be disclosed, and how it will be protected and destroyed. The Department of Education's Student Privacy Policy Office has a specific FAQ for community-based organizations conducting studies with school data. See our article on student privacy and FERPA for the broader picture.

These regimes stack rather than replace each other. A study by a community health nonprofit and a university, using identifiable patient records from students referred by a school district, could involve the Common Rule through the university, HIPAA through the health center, and FERPA through the district, each with its own paperwork. That is not a reason to avoid the study. It is a reason to map the data flows before the first meeting with the IRB, so everyone knows which rules attach to which data.

Using AI to Prepare Protocols, Consent Forms, and Determination Requests

AI is also genuinely helpful on the paperwork side, which is where many small teams get stuck. IRB applications ask for a structured description of the study's purpose, population, recruitment, procedures, risks, benefits, data management, and consent process. Program staff usually know all of this, but translating it into the format an IRB expects takes time. A language model can turn a project description and a few planning notes into a first draft of each protocol section, flag questions the IRB is likely to ask, and suggest where the design is unclear.

Consent forms are a particularly good fit. You can ask an AI assistant to rewrite a draft consent form at a lower reading level, to create the concise key information section required by the 2018 Requirements, to produce a version in another language for a fluent reviewer to check, or to generate a short verbal consent script for phone interviews. You can also ask it to compare a draft against the required elements in 45 CFR 46.116 and list anything missing. The output is a draft for human review, not a finished document. AI tools can confidently cite regulatory requirements that do not exist or mix up the pre-2018 and current rules, so verify every regulatory reference against the source.

One of the most useful and underused documents is a determination request memo. Many IRBs, including most independent IRBs and university offices, will review a short description of a project and issue a written determination that it is not human subjects research, that it is exempt, or that it needs further review. A clear memo describes the project's purpose, who designed it, who will see the results, what data will be collected, whether it is identifiable, and whether services are changed for the study. AI can help you assemble that memo from your planning documents. The determination itself, however, must come from the IRB or an authorized institutional official, and the letter they issue is the document you keep on file and cite to funders and journals.

Do not paste identifiable participant data into an AI tool to draft these documents. You almost never need it. Protocol drafting needs descriptions of the study, not the data.