Ethics Compliance
United States federal regulations require all research involving human subjects conducted or supported by any federal department or agency to undergo ethics review by an Institutional Review Board A group that is charged with overseeing and approving research projects. The group ensures that research projects are ethical, meet regulations and standards, and protect any human subjects involved in the research. (IRB A group that is charged with overseeing and approving research projects. The group ensures that research projects are ethical, meet regulations and standards, and protect any human subjects involved in the research.). IRBs have the authority to approve, require modification to, or deny research activities and must be made up of at least five members with diverse race, gender, and cultural backgrounds, at least one member with expertise in scientific areas and one in nonscientific areas, and at least one member not affiliated with the institution.
Most US colleges and universities have established local IRBs and support offices to comply with this requirement, although occasionally smaller institutions or organizations that do not conduct much research will rely on outside IRBs. Educational institutions typically interpret the IRB mandate broadly and have policies requiring IRB review for all human subjects research conducted by their faculty, staff, and students regardless of funding source (this also makes ensuring compliance easier given the complexities of federal funding to research institutions).
Researchers working in corporate settings may find different (or absent) ethics review protocols. Ethical review standards also vary widely by country; researchers working internationally should review local requirements to ensure their compliance. Additionally, state, local, and tribal laws may require further human subjects protections beyond IRB review.
Many newer researchers approach the IRB application and review process with a degree of trepidation. However, a well-run IRB will typically view its role as helping improve research protocols, and the process of explaining and justifying decisions about research practices to an outside party can often refine and clarify a study’s design. Although the IRB process can sometimes be time-consuming, it is an important safeguard for maintaining research ethics. Try to have patience with the reviewers and start the process as early as possible.
Levels of IRB Review
Prior to IRB submission, a determination must be made whether the proposed research design constitutes “human subjects research” as defined in the federal code. Humans subjects research is any systematic investigation that is intended to contribute to generalizable knowledge and involves living people about whom the investigator obtains and uses information or biospecimens through intervention or interaction with the person or the investigator obtains, studies, or generates identifiable private information or biospecimens (45 CFR 46.102(e)(1)&(l) Protection of Human Subjects 2023).
While this definition includes much of the human subjects research conducted by LIS An interdisciplinary field that examines how physical and digital information is organized, accessed, collected, managed, disseminated and used, particularly in library settings. researchers, not all types of studies will require IRB review. Data collected only for internal assessment, evaluation, and quality improvement is not subject to review, nor are datasets that contain no identifiable information. Many types of analytical data collected via library systems fall into these categories, while others, such as online anonymous chat transcripts stored for later analysis, fall in a regulatory gray area (e.g. does an anonymous chat count as an interaction with the researcher?). Another common misconception is that data collected for the intent of publication is the standard for IRB review. While publication usually indicates the research will contribute to generalizable knowledge, publication itself is not part of the IRB definition. All human subjects research must be submitted for review, regardless of about the intention to publish its results The section of a research article where researchers share the results from the research. This section takes the results and directly connects them to the research questions or hypotheses posed at the start of the article. Also can be called “Findings.” .
When in doubt, researchers should consult with their local IRB. IRBs have procedures for determining non-human subjects and can provide documentation of this determination if required. A determination that IRB review is not required does not, however, absolve a researcher from considering if their intended research adheres to ethical principles. Many types of data not defined as “human subjects research” do have the potential to produce harm and injustice. For example, in the library learning analytics community there is a great deal of discussion The section of a research article where the researchers analyze and interpret the findings. This section provides the “so what” for the research conducted. and debate about the efficacy and associated risks of collecting and utilizing large-scale data sets — many of which do not require IRB approval — to attempt to learn about and intervene in students’ educational outcomes (Asher 2017; Jones and Salo 2017; Jones et al. 2020).
For research that includes human subjects, IRBs will conduct three levels of review depending on the level of evaluated risk involved in the study: exempt, expedited, and full review. Importantly, a researcher is explicitly not authorized to make a determination of the level of review, this must be done by a representative of the IRB.
Exempt Review
Research classified as exempt and requiring limited IRB review includes low-risk protocols such as research in educational settings that are not likely to have adverse impacts, research involving only interactions such as educational tests, surveys, interviews, and observation of public behavior, and other benign behavioral interventions which researchers have no reason to believe participants will find offensive or embarrassing. Information collected in research classified as exempt must meet at least one of the following criteria: (1) data must be recorded in a way participants cannot be readily identified directly or through identifiers linked to the subject (e.g. via codes), or (2) if they can be identified, the IRB has conducted a review of provisions to protect privacy and confidentiality, or (3) disclosure of collected information would not reasonably place participants at risk of criminal or civil liability or be damaging to participants’ financial standing, employability, educational advancement, or reputation (45 CFR 46.104(d)).
Much, if not most, research in libraries and LIS settings falls into the exempt category. Note that exempt classification does not mean exempt from IRB oversight and regulation, but rather this term means exempt from additional levels of more detailed review. Research classified as exempt can be approved by a designated reviewer and does not require approval from the full IRB.
Expedited Review
Expedited research includes activities that present no more than minimal risk that fall in specific categories specified in the Federal code (45 CFR 46.110(b)). Minimal risk is defined as a probability and magnitude of harm or discomfort not greater than one ordinarily encounters in daily life or during routine physical or psychological tests. Categories of research that can be classified as expedited include voice, video, and image recordings, research on group characteristics and/or behavior, surveys, interviews, oral history, focus groups (and other qualitative methods), previously collected documents and data, and a number of minimally invasive medical procedures. In expedited research, potential identification of participants should not put them at risk of civil or criminal liability, be damaging to financial standing, employability or reputation, or be potentially stigmatizing, unless adequate protections are in place to minimize the risk of a breach of confidentiality.
Research classified as expedited can also be approved by a designated reviewer rather than the full IRB.
The difference between research that can be classified as exempt versus expedited can be confusing and is often a matter of the degree of risk a reviewer perceives. Different reviewers may disagree on the risk entailed by a particular study and the subsequent level of review that is warranted. Common examples of research that are typically classified as expedited are designs that require access to FERPA-protected records or research involving the students of a member of the research team (due to potential conflicts of interest).
Full Review
Research not classified exempt or expedited is subject to full review by the IRB. Full review addresses any research involving greater than minimal risk and is usually required for biomedical research, research involving vulnerable populations such as prisoners, children, people who are pregnant, fetuses, or people who lack decision-making capacity to consent, as well as any research examining potentially illegal activities.
Research classified as requiring full review must be approved by a convened IRB and will require detailed descriptions of all procedures and protocols. Very few research activities in libraries and LIS research require full review. If you are preparing to undertake research that you believe might require full review, we recommend reaching out to your IRB to discuss specific practices and protections related to the population you intend to study.
Preparing an IRB Submission
Ethics & Compliance Training
Your institution will probably require you to complete online ethics and compliance training before submitting any research protocols to the IRB. Many institutions in the United States subscribe to the Collaborative Institutional Training Initiative (CITI) as a training provider. LIS researchers will typically take the “Social and Behavioral” track of the human subjects research course. This course covers in greater detail many of the topics outlined in this lesson, including research ethics, responsible conduct, regulations and compliance, privacy and confidentiality, risk assessment, and informed consent. Depending on your research design, your institution may require additional CITI modules or local training such as FERPA compliance or data protection practices. You should contact your local IRB for guidance in the training required and CITI log-in information.
What’s FERPA?
Researchers working with students in the US will need to determine if the data they are collecting or accessing is covered under Family and Educational Rights and Privacy Act (FERPA) regulations. FERPA defines expectations for when, how, and by whom educational records can be accessed and disclosed. Analytical, demographic, and course data related to students and held by institutions are typically considered educational records and written permission is generally required to disclose these records to a third party. However, institutional representatives may access and analyze FERPA-protected data as long as they have a “legitimate educational interest.” Your institution will have local procedures and practices for accessing FERPA information in addition to IRB review polities.
Identify a PI
IRB submissions will require a principal investigator (PI) to be designated for the research study. The PI is responsible for assuring compliance with IRB procedures, reporting deviations from the research protocols and any adverse events, and closing the study once research is complete. While the PI is responsible for overseeing the ethical conduct of the research study, they are not necessarily required to be directly involved in data collection and analysis. Many institutions have policies regarding who is allowed to be PI for IRB purposes and often limit this role to full-time faculty and research staff (and sometimes are limited even further). Check with your local IRB for your institutional requirements.
IRB Application Components
IRB forms and procedures will vary between institutions. However, all IRB applications will share many elements and will require the researchers to demonstrate how their proposed study will apply the ethical principles outlined in the Belmont report in practice.
IRBs will require copies of the protocols for your data collection (e.g. interview guides, survey questions, descriptions of open-ended research) and your study information sheet and consent forms (if required).
After submitting your research study for approval, a representative from the IRB may respond with additional clarifying questions or ask for revisions before approving your project. This representative can be an excellent resource in ensuring language on forms and other technical issues such as data security and storage adhere to current best practices, as well as ensuring that you have explained your research methods in a way that is clear and understandable to a non-specialist.
Consent
You will be asked to describe your procedures for assuring that you have informed consent from research participants. The consent process explains the purpose and methods of the research, how the data collected will be used, whether there are risks or benefits, and how confidentiality will be protected. Participants should be given sufficient time to review the information and to ask any questions. Consent is ongoing and revocable — participants may withdraw at any time and may ask to have their data removed from a study (to extent this is possible).
Consent can take a variety of forms depending on the type of research and level of review. In studies classified as exempt, verbal assent agreeing to participate — or in the case of online research, a click-through acknowledgement — is usually sufficient. In these cases, the IRB may require a study information sheet outlining the study, participants’ rights, and contact information for the researcher and the IRB to be given to the participant. Research classified as expedited or full review will usually require a consent form with a signature or signature equivalent (e.g. an authenticated online log-in). However, in certain rare circumstances where the existence of a signed consent form creates risk for a participant, this requirement can be waived by the IRB. Studies utilizing FERPA-protected student record data usually require a signature even if they are otherwise exempt.
Do you want to use audio, video, or other recordings outside of analysis for your research study?
Researchers should also take care to assure they have appropriate consent for any use of any audio, video, or other recordings outside of analysis for the research study (e.g. in presentations or publications), as well as reproduction permission for any artifacts collected or created during the study. In the United States the default copyright of recordings is often held by the participant, not the researcher. If you intend to archive or otherwise use recordings, it is usually best practice to use a secondary release form that describes these uses and transfers intellectual property (IP) rights as appropriate. The use of two forms allows individuals to participate in the research, but withhold consent for reuse of their IP. Copyright and intellectual property laws related to research are complex and outside the scope of this lesson. Consult with an IP expert at your institution if you have questions.
Local IRBs will typically provide templates for assent and consent forms that include all required elements. You will be asked to provide copies of these forms with your IRB submission.
Privacy and Confidentiality
IRBs will ask you to describe your procedures for ensuring the privacy and confidentiality of research participants. This includes physical privacy when meeting with researchers (if necessary) as well as how confidentiality will be maintained in the information collected. One of the most common ways to do this is to develop a system for assigning unique numeric codes to participants. These codes should then be used throughout the research on all materials related to the participant (e.g. transcripts, audio/video files, analysis documents, etc.). The key that links the number to participant contact information should be kept in a password-protected file that is separate from all other data and should be destroyed after data collection is complete.
Care should also be taken to avoid including quasi-identifiers within research data. Quasi-identifiers are combinations of demographic information or other contextual information often included in transcripts (especially if participants are discussing their lives in detail) that can potentially make individuals re-identifiable. Both quantitative and qualitative data can be much more difficult to fully de-identify than many researchers anticipate. Limiting the scope of data collection is therefore an important aspect to maintaining overall confidentiality in research design. Carefully evaluate if you need a piece of information before collecting it.
Risks vs Benefits
The IRB application will contain a question asking you to specify any foreseeable risks to participants and how you will take appropriate steps to mitigate these risks. While LIS research usually does not pose potential for physical harm, researchers must also evaluate their studies’ risk of potential psychological, emotional, or reputational harms. Participants may find participating in research activities or answering questions about themselves uncomfortable or embarrassing especially around topics they view as socially sensitive. These types of risks should be specified in the IRB application and clearly communicated in the consent process. These risks can be mitigated by allowing participants to decline to answer any questions they find uncomfortable and by avoiding collecting potentially sensitive information that is not directly related to research questions. For example, many studies routinely collect potentially sensitive demographic information such as gender expression, sexual identity, or socioeconomic status without a specific plan for analysis. Such practices create unnecessary risks for participants.
A principal risk to data collected in LIS studies is the potential disclosure of identifying information about research participants. One probable disclosure scenario for library data is a request or subpoena of information by law enforcement or regulatory agencies. There is no researcher-subject privilege, and researchers should not assume that universities will be willing or able to resist a subpoena or that they can guarantee the confidentiality of research participants in such a scenario (see “The Belfast Project” case study in the further learning section for an example of how this might occur). This is particularly important to consider in libraries, where attempts to criminalize access to information addressing topics such as abortion and reproductive rights are increasingly common. IRB consent forms usually require the inclusion of a warning about legally required disclosure.
Researchers will also be asked to describe the benefits participants will receive from participation in the study. In many LIS research designs, participants may incur only indirect benefits such as contributing to the better understanding of a topic, increasing general knowledge, or helping improve educational experiences and programs. Studies with no direct benefits to participants are permissible (and very common) as long as this is clearly explained.
Any incentives, payments, or other compensation for participation should be included as a benefit. Your IRB will likely have a separate question asking for an explanation of how the logistics of any compensation will be handled, and a justification of why the level of compensation is appropriate. Compensation that is too high relative to the demands of a study can be considered coercive since the financial benefit might compel people to participate who otherwise might not. In general, IRBs will also require that incentives be given to participants even if they drop out of the study before its completion.
Justice
The IRB application will ask you to demonstrate how your research design ensures equity in identifying, selecting, and enrolling research participants. In practice, this often involves creating samples and/or inclusion criteria that accurately reflect the diversity of the population being studied. However, equitable inclusion can sometimes mean specifically recruiting participants with particular characteristics in order to assure representation in the study, or conversely, by not recruiting participants in order to disperse risk away from more vulnerable populations.
Because of their smaller numbers relative to the majority population, minority groups of any type (e.g. race, ethnicity, gender expression, LGBT identity, religious affiliation) will by definition always be more potentially visible within datasets intended to reflect populations. By extension, this makes individual members of these groups easier to potentially de-identify. In research designs where disclosure of identity is a primary risk, minority groups therefore almost always bear more relative risk. Ensuring equity in our research designs requires researchers to consider these issues when recruiting potential research participants and to explain and justify research focusing on minority populations.
Multi-institution IRBs
Collaborative research across multiple institutions will create additional IRB requirements. In many cases, institutions will require research conducted by their faculty and staff to be reviewed by a local IRB. This is especially true if research participants are the institution’s students. IRB applications that are as identical as practically possible should be submitted to each institutional IRB (unfortunately application questions are often not standardized, and institutions may have specific local requirements for wording and content of consent forms, invitations, etc.). Institutions will sometimes, but rarely, allow a single IRB to act as the IRB of record. In this case, research team members will typically be required to provide proof of CITI training to the reviewing IRB. If the research team includes members of organizations without IRBs, applications should be filed with the institutions that do, even if the other organizations have other ethical review processes. This prevents practices such as “IRB shopping” in which the most lenient ethical review process is used (this is a particular issue with research involving corporate entities). If the research is subject to more than one set of international ethics review requirements, all required applications should be submitted.
Multi-institution research teams should pay close attention to data access, sharing, and storage agreements and protocols because many institutions have restrictions and permissions processes on how institutional data must be handled. Especially in the case of educational records data, data sharing may require formal legal agreements.
Multi-institution IRB approval is almost always slower than for a single site, so plan accordingly. Research often cannot commence until all IRBs have approved the research protocols.
Topic 2 References
Asher, Andrew. Risk, Benefits, and User Privacy: Evaluating the Ethics of Library Data.” In Protecting Patron Privacy: A LITA Guide. Bobbi Newman & Bonnie Tijerina, Eds. Pp. 43-56. Lanham, MD: Rowman & Littlefield, 2017.
Code of Federal Regulations. Protection of Human Subjects. 45 CFR 46. 2023. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46
Jones, Kyle M.L., Briney, Kristin A., Goben, Abigail, Salo, Dorothea, Asher, Andrew, and Michael R. Perry. “A Comprehensive Primer to Library Learning Analytics Practices, Initiatives, and Privacy Issues.” College & Research Libraries 81, 3 (2020): 570–91. https://crl.acrl.org/index.php/crl/article/view/24374/32199
Jones, Kyle M.L., and Dorothea Salo. “Learning Analytics and the Academic Library: Professional Ethics Commitments at a Crossroads.” College & Research Libraries 79, 3 (2017):304-323. https://doi.org/10.5860/crl.79.3.304
Ethics Compliance
United States federal regulations require all research involving human subjects conducted or supported by any federal department or agency to undergo ethics review by an Institutional Review BoardInstitutional Review Board A group that is charged with overseeing and approving research projects. The group ensures that research projects are ethical, meet regulations and standards, and protect any human subjects involved in the research. (IRBInstitutional Review Board A group that is charged with overseeing and approving research projects. The group ensures that research projects are ethical, meet regulations and standards, and protect any human subjects involved in the research.). IRBs have the authority to approve, require modification to, or deny research activities and must be made up of at least five members with diverse race, gender, and cultural backgrounds, at least one member with expertise in scientific areas and one in nonscientific areas, and at least one member not affiliated with the institution.
Most US colleges and universities have established local IRBs and support offices to comply with this requirement, although occasionally smaller institutions or organizations that do not conduct much research will rely on outside IRBs. Educational institutions typically interpret the IRB mandate broadly and have policies requiring IRB review for all human subjects research conducted by their faculty, staff, and students regardless of funding source (this also makes ensuring compliance easier given the complexities of federal funding to research institutions).
Researchers working in corporate settings may find different (or absent) ethics review protocols. Ethical review standards also vary widely by country; researchers working internationally should review local requirements to ensure their compliance. Additionally, state, local, and tribal laws may require further human subjects protections beyond IRB review.
Many newer researchers approach the IRB application and review process with a degree of trepidation. However, a well-run IRB will typically view its role as helping improve research protocols, and the process of explaining and justifying decisions about research practices to an outside party can often refine and clarify a study’s design. Although the IRB process can sometimes be time-consuming, it is an important safeguard for maintaining research ethics. Try to have patience with the reviewers and start the process as early as possible.
Levels of IRB Review
Prior to IRB submission, a determination must be made whether the proposed research design constitutes “human subjects research” as defined in the federal code. Humans subjects research is any systematic investigation that is intended to contribute to generalizable knowledge and involves living people about whom the investigator obtains and uses information or biospecimens through intervention or interaction with the person or the investigator obtains, studies, or generates identifiable private information or biospecimens (45 CFR 46.102(e)(1)&(l) Protection of Human Subjects 2023).
While this definition includes much of the human subjects research conducted by LISLibrary and Information Science An interdisciplinary field that examines how physical and digital information is organized, accessed, collected, managed, disseminated and used, particularly in library settings. researchers, not all types of studies will require IRB review. Data collected only for internal assessment, evaluation, and quality improvement is not subject to review, nor are datasets that contain no identifiable information. Many types of analytical data collected via library systems fall into these categories, while others, such as online anonymous chat transcripts stored for later analysis, fall in a regulatory gray area (e.g. does an anonymous chat count as an interaction with the researcher?). Another common misconception is that data collected for the intent of publication is the standard for IRB review. While publication usually indicates the research will contribute to generalizable knowledge, publication itself is not part of the IRB definition. All human subjects research must be submitted for review, regardless of about the intention to publish its resultsResults The section of a research article where researchers share the results from the research. This section takes the results and directly connects them to the research questions or hypotheses posed at the start of the article. Also can be called “Findings.” .
When in doubt, researchers should consult with their local IRB. IRBs have procedures for determining non-human subjects and can provide documentation of this determination if required. A determination that IRB review is not required does not, however, absolve a researcher from considering if their intended research adheres to ethical principles. Many types of data not defined as “human subjects research” do have the potential to produce harm and injustice. For example, in the library learning analytics community there is a great deal of discussionDiscussion The section of a research article where the researchers analyze and interpret the findings. This section provides the “so what” for the research conducted. and debate about the efficacy and associated risks of collecting and utilizing large-scale data sets — many of which do not require IRB approval — to attempt to learn about and intervene in students’ educational outcomes (Asher 2017; Jones and Salo 2017; Jones et al. 2020).
For research that includes human subjects, IRBs will conduct three levels of review depending on the level of evaluated risk involved in the study: exempt, expedited, and full review. Importantly, a researcher is explicitly not authorized to make a determination of the level of review, this must be done by a representative of the IRB.
Exempt Review
Research classified as exempt and requiring limited IRB review includes low-risk protocols such as research in educational settings that are not likely to have adverse impacts, research involving only interactions such as educational tests, surveys, interviews, and observation of public behavior, and other benign behavioral interventions which researchers have no reason to believe participants will find offensive or embarrassing. Information collected in research classified as exempt must meet at least one of the following criteria: (1) data must be recorded in a way participants cannot be readily identified directly or through identifiers linked to the subject (e.g. via codes), or (2) if they can be identified, the IRB has conducted a review of provisions to protect privacy and confidentiality, or (3) disclosure of collected information would not reasonably place participants at risk of criminal or civil liability or be damaging to participants’ financial standing, employability, educational advancement, or reputation (45 CFR 46.104(d)).
Much, if not most, research in libraries and LIS settings falls into the exempt category. Note that exempt classification does not mean exempt from IRB oversight and regulation, but rather this term means exempt from additional levels of more detailed review. Research classified as exempt can be approved by a designated reviewer and does not require approval from the full IRB.
Expedited Review
Expedited research includes activities that present no more than minimal risk that fall in specific categories specified in the Federal code (45 CFR 46.110(b)). Minimal risk is defined as a probability and magnitude of harm or discomfort not greater than one ordinarily encounters in daily life or during routine physical or psychological tests. Categories of research that can be classified as expedited include voice, video, and image recordings, research on group characteristics and/or behavior, surveys, interviews, oral history, focus groups (and other qualitative methods), previously collected documents and data, and a number of minimally invasive medical procedures. In expedited research, potential identification of participants should not put them at risk of civil or criminal liability, be damaging to financial standing, employability or reputation, or be potentially stigmatizing, unless adequate protections are in place to minimize the risk of a breach of confidentiality.
Research classified as expedited can also be approved by a designated reviewer rather than the full IRB.
The difference between research that can be classified as exempt versus expedited can be confusing and is often a matter of the degree of risk a reviewer perceives. Different reviewers may disagree on the risk entailed by a particular study and the subsequent level of review that is warranted. Common examples of research that are typically classified as expedited are designs that require access to FERPA-protected records or research involving the students of a member of the research team (due to potential conflicts of interest).
Full Review
Research not classified exempt or expedited is subject to full review by the IRB. Full review addresses any research involving greater than minimal risk and is usually required for biomedical research, research involving vulnerable populations such as prisoners, children, people who are pregnant, fetuses, or people who lack decision-making capacity to consent, as well as any research examining potentially illegal activities.
Research classified as requiring full review must be approved by a convened IRB and will require detailed descriptions of all procedures and protocols. Very few research activities in libraries and LIS research require full review. If you are preparing to undertake research that you believe might require full review, we recommend reaching out to your IRB to discuss specific practices and protections related to the population you intend to study.
Preparing an IRB Submission
Ethics & Compliance Training
Your institution will probably require you to complete online ethics and compliance training before submitting any research protocols to the IRB. Many institutions in the United States subscribe to the Collaborative Institutional Training Initiative (CITI) as a training provider. LIS researchers will typically take the “Social and Behavioral” track of the human subjects research course. This course covers in greater detail many of the topics outlined in this lesson, including research ethics, responsible conduct, regulations and compliance, privacy and confidentiality, risk assessment, and informed consent. Depending on your research design, your institution may require additional CITI modules or local training such as FERPA compliance or data protection practices. You should contact your local IRB for guidance in the training required and CITI log-in information.
What’s FERPA?
Researchers working with students in the US will need to determine if the data they are collecting or accessing is covered under Family and Educational Rights and Privacy Act (FERPA) regulations. FERPA defines expectations for when, how, and by whom educational records can be accessed and disclosed. Analytical, demographic, and course data related to students and held by institutions are typically considered educational records and written permission is generally required to disclose these records to a third party. However, institutional representatives may access and analyze FERPA-protected data as long as they have a “legitimate educational interest.” Your institution will have local procedures and practices for accessing FERPA information in addition to IRB review polities.
Identify a PI
IRB submissions will require a principal investigator (PI) to be designated for the research study. The PI is responsible for assuring compliance with IRB procedures, reporting deviations from the research protocols and any adverse events, and closing the study once research is complete. While the PI is responsible for overseeing the ethical conduct of the research study, they are not necessarily required to be directly involved in data collection and analysis. Many institutions have policies regarding who is allowed to be PI for IRB purposes and often limit this role to full-time faculty and research staff (and sometimes are limited even further). Check with your local IRB for your institutional requirements.
IRB Application Components
IRB forms and procedures will vary between institutions. However, all IRB applications will share many elements and will require the researchers to demonstrate how their proposed study will apply the ethical principles outlined in the Belmont report in practice.
IRBs will require copies of the protocols for your data collection (e.g. interview guides, survey questions, descriptions of open-ended research) and your study information sheet and consent forms (if required).
After submitting your research study for approval, a representative from the IRB may respond with additional clarifying questions or ask for revisions before approving your project. This representative can be an excellent resource in ensuring language on forms and other technical issues such as data security and storage adhere to current best practices, as well as ensuring that you have explained your research methods in a way that is clear and understandable to a non-specialist.
Consent
You will be asked to describe your procedures for assuring that you have informed consent from research participants. The consent process explains the purpose and methods of the research, how the data collected will be used, whether there are risks or benefits, and how confidentiality will be protected. Participants should be given sufficient time to review the information and to ask any questions. Consent is ongoing and revocable — participants may withdraw at any time and may ask to have their data removed from a study (to extent this is possible).
Consent can take a variety of forms depending on the type of research and level of review. In studies classified as exempt, verbal assent agreeing to participate — or in the case of online research, a click-through acknowledgement — is usually sufficient. In these cases, the IRB may require a study information sheet outlining the study, participants’ rights, and contact information for the researcher and the IRB to be given to the participant. Research classified as expedited or full review will usually require a consent form with a signature or signature equivalent (e.g. an authenticated online log-in). However, in certain rare circumstances where the existence of a signed consent form creates risk for a participant, this requirement can be waived by the IRB. Studies utilizing FERPA-protected student record data usually require a signature even if they are otherwise exempt.
Do you want to use audio, video, or other recordings outside of analysis for your research study?
Researchers should also take care to assure they have appropriate consent for any use of any audio, video, or other recordings outside of analysis for the research study (e.g. in presentations or publications), as well as reproduction permission for any artifacts collected or created during the study. In the United States the default copyright of recordings is often held by the participant, not the researcher. If you intend to archive or otherwise use recordings, it is usually best practice to use a secondary release form that describes these uses and transfers intellectual property (IP) rights as appropriate. The use of two forms allows individuals to participate in the research, but withhold consent for reuse of their IP. Copyright and intellectual property laws related to research are complex and outside the scope of this lesson. Consult with an IP expert at your institution if you have questions.
Local IRBs will typically provide templates for assent and consent forms that include all required elements. You will be asked to provide copies of these forms with your IRB submission.
Privacy and Confidentiality
IRBs will ask you to describe your procedures for ensuring the privacy and confidentiality of research participants. This includes physical privacy when meeting with researchers (if necessary) as well as how confidentiality will be maintained in the information collected. One of the most common ways to do this is to develop a system for assigning unique numeric codes to participants. These codes should then be used throughout the research on all materials related to the participant (e.g. transcripts, audio/video files, analysis documents, etc.). The key that links the number to participant contact information should be kept in a password-protected file that is separate from all other data and should be destroyed after data collection is complete.
Care should also be taken to avoid including quasi-identifiers within research data. Quasi-identifiers are combinations of demographic information or other contextual information often included in transcripts (especially if participants are discussing their lives in detail) that can potentially make individuals re-identifiable. Both quantitative and qualitative data can be much more difficult to fully de-identify than many researchers anticipate. Limiting the scope of data collection is therefore an important aspect to maintaining overall confidentiality in research design. Carefully evaluate if you need a piece of information before collecting it.
Risks vs Benefits
The IRB application will contain a question asking you to specify any foreseeable risks to participants and how you will take appropriate steps to mitigate these risks. While LIS research usually does not pose potential for physical harm, researchers must also evaluate their studies’ risk of potential psychological, emotional, or reputational harms. Participants may find participating in research activities or answering questions about themselves uncomfortable or embarrassing especially around topics they view as socially sensitive. These types of risks should be specified in the IRB application and clearly communicated in the consent process. These risks can be mitigated by allowing participants to decline to answer any questions they find uncomfortable and by avoiding collecting potentially sensitive information that is not directly related to research questions. For example, many studies routinely collect potentially sensitive demographic information such as gender expression, sexual identity, or socioeconomic status without a specific plan for analysis. Such practices create unnecessary risks for participants.
A principal risk to data collected in LIS studies is the potential disclosure of identifying information about research participants. One probable disclosure scenario for library data is a request or subpoena of information by law enforcement or regulatory agencies. There is no researcher-subject privilege, and researchers should not assume that universities will be willing or able to resist a subpoena or that they can guarantee the confidentiality of research participants in such a scenario (see “The Belfast Project” case study in the further learning section for an example of how this might occur). This is particularly important to consider in libraries, where attempts to criminalize access to information addressing topics such as abortion and reproductive rights are increasingly common. IRB consent forms usually require the inclusion of a warning about legally required disclosure.
Researchers will also be asked to describe the benefits participants will receive from participation in the study. In many LIS research designs, participants may incur only indirect benefits such as contributing to the better understanding of a topic, increasing general knowledge, or helping improve educational experiences and programs. Studies with no direct benefits to participants are permissible (and very common) as long as this is clearly explained.
Any incentives, payments, or other compensation for participation should be included as a benefit. Your IRB will likely have a separate question asking for an explanation of how the logistics of any compensation will be handled, and a justification of why the level of compensation is appropriate. Compensation that is too high relative to the demands of a study can be considered coercive since the financial benefit might compel people to participate who otherwise might not. In general, IRBs will also require that incentives be given to participants even if they drop out of the study before its completion.
Justice
The IRB application will ask you to demonstrate how your research design ensures equity in identifying, selecting, and enrolling research participants. In practice, this often involves creating samples and/or inclusion criteria that accurately reflect the diversity of the population being studied. However, equitable inclusion can sometimes mean specifically recruiting participants with particular characteristics in order to assure representation in the study, or conversely, by not recruiting participants in order to disperse risk away from more vulnerable populations.
Because of their smaller numbers relative to the majority population, minority groups of any type (e.g. race, ethnicity, gender expression, LGBT identity, religious affiliation) will by definition always be more potentially visible within datasets intended to reflect populations. By extension, this makes individual members of these groups easier to potentially de-identify. In research designs where disclosure of identity is a primary risk, minority groups therefore almost always bear more relative risk. Ensuring equity in our research designs requires researchers to consider these issues when recruiting potential research participants and to explain and justify research focusing on minority populations.
Multi-institution IRBs
Collaborative research across multiple institutions will create additional IRB requirements. In many cases, institutions will require research conducted by their faculty and staff to be reviewed by a local IRB. This is especially true if research participants are the institution’s students. IRB applications that are as identical as practically possible should be submitted to each institutional IRB (unfortunately application questions are often not standardized, and institutions may have specific local requirements for wording and content of consent forms, invitations, etc.). Institutions will sometimes, but rarely, allow a single IRB to act as the IRB of record. In this case, research team members will typically be required to provide proof of CITI training to the reviewing IRB. If the research team includes members of organizations without IRBs, applications should be filed with the institutions that do, even if the other organizations have other ethical review processes. This prevents practices such as “IRB shopping” in which the most lenient ethical review process is used (this is a particular issue with research involving corporate entities). If the research is subject to more than one set of international ethics review requirements, all required applications should be submitted.
Multi-institution research teams should pay close attention to data access, sharing, and storage agreements and protocols because many institutions have restrictions and permissions processes on how institutional data must be handled. Especially in the case of educational records data, data sharing may require formal legal agreements.
Multi-institution IRB approval is almost always slower than for a single site, so plan accordingly. Research often cannot commence until all IRBs have approved the research protocols.
Topic 2 References
Asher, Andrew. Risk, Benefits, and User Privacy: Evaluating the Ethics of Library Data.” In Protecting Patron Privacy: A LITA Guide. Bobbi Newman & Bonnie Tijerina, Eds. Pp. 43-56. Lanham, MD: Rowman & Littlefield, 2017.
Code of Federal Regulations. Protection of Human Subjects. 45 CFR 46. 2023. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46
Jones, Kyle M.L., Briney, Kristin A., Goben, Abigail, Salo, Dorothea, Asher, Andrew, and Michael R. Perry. “A Comprehensive Primer to Library Learning Analytics Practices, Initiatives, and Privacy Issues.” College & Research Libraries 81, 3 (2020): 570–91. https://crl.acrl.org/index.php/crl/article/view/24374/32199
Jones, Kyle M.L., and Dorothea Salo. “Learning Analytics and the Academic Library: Professional Ethics Commitments at a Crossroads.” College & Research Libraries 79, 3 (2017):304-323. https://doi.org/10.5860/crl.79.3.304