Exempt human subjects research

Exempt human subjects research is human subjects research that an institution’s Institutional Review Board (IRB) or another authorized reviewer — never the investigator personally — has formally determined falls within one of the eight categories listed at 45 CFR 46.104(d) of the U.S. Common Rule, and has accordingly been relieved from the standard full-board or expedited review pathway and from ongoing continuing review.

The critical point: “exempt” describes a determination, not an absence of review

This is the single most common misconception about exempt research, and the reason the term matters as its own dictionary entry: exempt describes the outcome of a review decision, not a category of study that skips review altogether. A study is not exempt merely because an investigator judges it low-risk, anonymous, or otherwise harmless. It becomes exempt only once someone with institutional authority — typically the IRB office, often without a convened committee meeting — has checked the protocol against the specific regulatory category and formally recorded that determination. An investigator cannot self-certify exemption; doing so is not a shortcut, it is simply undetermined, non-compliant research.

The eight exempt categories at 45 CFR 46.104(d)

The Revised Common Rule (2018) expanded the exempt categories from six to eight. In summary, per the current regulatory text:

1. (d)(1) — Normal educational practices in established educational settings, not likely to adversely affect students’ opportunity to learn or the assessment of educators.
2. (d)(2) — Educational tests, surveys, interviews, or observation of public behavior, where responses either cannot be linked back to identifiable subjects, or disclosure would not reasonably place subjects at risk (or, if identifiable, an IRB conducts limited review).
3. (d)(3) — Benign behavioral interventions paired with information collection from adult subjects who prospectively agree, under similar identifiability/risk conditions to (d)(2), and only where subjects are not deceived about the study’s nature without their prospective agreement to that possibility.
4. (d)(4) — Secondary research using identifiable private information or biospecimens where consent is not required — for example, the data is already publicly available, cannot readily be linked to identifiable subjects, or the research uses HIPAA-regulated identifiable health information for permitted health-care-operations, research, or public-health purposes.
5. (d)(5) — Federal public-benefit or service-program research and demonstration projects conducted or approved by a federal department or agency, publicly listed in advance.
6. (d)(6) — Taste, food-quality, and consumer-acceptance studies involving wholesome foods, or foods with ingredients/contaminants at or below FDA/EPA/USDA-established safe levels.
7. (d)(7) — Storage or maintenance of identifiable private information or biospecimens for potential future secondary research, where an IRB conducts a limited review of privacy/confidentiality safeguards.
8. (d)(8) — Secondary research use of identifiable private information or biospecimens under broad consent, where broad consent was properly obtained, documented per 46.117, an IRB conducts limited review confirming the research is within the scope of that broad consent, and the investigator does not plan to return individual results to subjects.

Categories (d)(2), (d)(3), (d)(7), and (d)(8) specifically require a “limited IRB review” of privacy, confidentiality, or broad-consent safeguards before the exemption applies — so even exempt research can pass through a form of IRB scrutiny once; it is only relieved of the continuing, ongoing review that non-exempt research remains subject to. The full 45 CFR 46 Common Rule subparts guide covers how the exempt-review pathway fits alongside expedited and full-board review.

Examples

An investigator fields a fully anonymous online survey of adult attitudes toward a public-policy question, collecting no names, IP addresses, or other identifiers. The IRB office reviews the protocol against (d)(2), issues a written exempt determination, and the investigator begins recruitment only after that determination is on file — not on the basis of the investigator’s own read of the regulation. A researcher planning a secondary analysis of an already-de-identified, publicly available federal survey dataset receives an exempt determination under (d)(4) because the data source itself — not the investigator’s judgment about risk — satisfies the category, and that determination is documented before analysis starts.

What is not exempt research

A graduate student who independently decides that a set of low-stakes home-visit interviews “obviously” qualifies as minimal-risk and begins recruiting without ever submitting the protocol for review has not produced exempt research — it is undetermined research with no exemption on record. OHRP guidance and most institutional policies do not let investigators self-certify exemption, precisely because of the conflict of interest involved. Similarly, a study proposing to rely on the broad-consent exemption at (d)(7)/(d)(8) does not qualify until the required limited IRB review of consent documentation and confidentiality safeguards has actually occurred; until then, it remains subject to standard IRB review.

Frequently Asked Questions

Can a researcher decide their own study is exempt?

No. Exemption is a formal determination made by an IRB or another authorized institutional reviewer, never a self-certification by the investigator. A study an investigator merely believes is low-risk is not exempt until that determination is made and documented.

How many exempt categories are there?

Eight, under 45 CFR 46.104(d), following the 2018 Revised Common Rule’s expansion from the original six. The two newest categories, (d)(7) and (d)(8), specifically govern storage and secondary research use of identifiable data or biospecimens under broad consent.

Does exempt research ever go through any IRB review at all?

Often, yes. Four of the eight categories — (d)(2), (d)(3), (d)(7), and (d)(8) — require a “limited IRB review” of privacy, confidentiality, or consent safeguards before the exemption can be applied. What exempt research is relieved of is the ongoing continuing-review requirement, not necessarily all IRB contact.

References

• 45 CFR 46.104, “Exempt research” (eCFR, current text).
• HHS Office for Human Research Protections, Revised Common Rule guidance.