Limited IRB Review

Limited IRB review is a narrow, privacy-focused form of IRB review the 2018 Revised Common Rule requires as a condition of exemption for certain research involving identifiable private information or identifiable biospecimens. It is a distinct mechanism from both full-board review and expedited review — see Exempt vs Expedited IRB Review: What Separates the Two for that adjacent comparison.

Which exempt categories require it

Under 45 CFR 46.104’s eight exempt-research categories, four require limited IRB review before the exemption applies:

• 46.104(d)(2)(iii) — certain educational tests, surveys, interviews, or public-behavior observation involving identifiable, sensitive information
• 46.104(d)(3)(i)(C) — certain benign behavioral interventions collecting identifiable sensitive information
• 46.104(d)(7) — storage or maintenance of identifiable private information or biospecimens for potential future secondary research
• 46.104(d)(8) — secondary research use of identifiable private information or biospecimens under broad consent

The other four exempt categories (normal educational practice, non-identifiable survey/interview/observation research, most secondary-data-use categories that don’t involve broad consent, and the public-benefit and food-taste categories) do not require limited IRB review.

What the reviewer actually evaluates

A limited reviewer — commonly the IRB Chair or a designated experienced board member, the same reviewer authority described in IRB Chair — applies only the privacy and confidentiality safeguard criteria at 45 CFR 46.111(a)(7)-(a)(8): whether there are adequate provisions to protect subjects’ privacy and to maintain the confidentiality of data. This is narrower than the full risk-benefit review a convened board performs under 46.111(a)(1)-(2) for non-exempt research, and narrower than the risk-benefit review an expedited reviewer performs for minimal-risk non-exempt research.

Continuing review does not apply

Under 45 CFR 46.109(f)(1)(ii), research reviewed under limited IRB review is exempt from the ongoing continuing-review requirement that otherwise applies to convened-board research — the exemption determination, once made, does not need periodic IRB re-approval the way non-exempt research does.

How it differs from a Central/Single IRB determination

Limited IRB review is a determination about privacy safeguards for a specific exempt category; it is unrelated to the separate question of which IRB (a local board vs. a designated Central/Single IRB (sIRB)) has review authority over a multi-site study. A study can undergo limited IRB review at either a local IRB or a central IRB, depending on the institution’s reliance arrangements.

Who makes and documents the determination

Institutions vary in exactly who is authorized to conduct limited IRB review, but the role is consistently narrow: it is delegated to a specific, named individual or small group — typically the IRB Chair or a designated experienced member — rather than left open to any IRB staff member. The determination itself is documented in writing, tied to the specific exempt category invoked (104(d)(2)(iii), (d)(3)(i)(C), (d)(7), or (d)(8)) and to the specific privacy/confidentiality safeguards the reviewer found adequate under 45 CFR 46.111(a)(7)-(8) — not just a checkbox that review happened. Because continuing review does not apply once the exemption is made, this written record is often the only artifact that will exist for the life of the study showing what safeguards were actually evaluated.

What an auditor or OHRP reviewer checks

When an accreditor, an OHRP for-cause review, or an internal compliance audit examines a limited-review file, it is checking three things in order: that the exempt category claimed actually required limited review in the first place (not all eight do), that the reviewer who signed off held the delegated authority to conduct it, and that the written determination specifically addresses privacy and confidentiality adequacy rather than reciting the regulatory language without analysis. A file that shows the correct category and the correct reviewer but no substantive privacy/confidentiality reasoning is a common finding in institutional self-assessments — the determination has to show its work, not just its outcome.

Checking this against the current guidance

Whether a prior limited-review determination carries forward to a later secondary use of the same stored data or specimens depends on the specific exempt category and how the institution’s exemption-determination records describe the original scope. The answer depends on which exempt category and original determination’s scope you are working to, and the page above states the general rule.

Ask CASRAI: If our IRB Chair conducts a limited IRB review under 46.104(d)(7) for a secondary-use biospecimen repository, and years later the same stored specimens are used for a new study under 46.104(d)(8), does that new use require its own fresh limited IRB review, or does the original determination continue to cover it?

It answers with its sources linked, so you can open each one and check it yourself, and it says so when our sources don’t cover a question. Two questions a day are free while you are signed out, no account and no card. Everything CASRAI publishes stays free to read.

Frequently asked questions

Who conducts a limited IRB review?

Typically the IRB Chair or a designated experienced reviewer — not necessarily the full convened board.

Does limited IRB review mean the study isn’t exempt?

No — limited IRB review is a condition of exemption for four specific categories, not an alternative to exemption. Once the privacy/confidentiality criteria are satisfied, the study proceeds as exempt.

Is limited IRB review the same as expedited review?

No. Expedited review evaluates the full risk-benefit profile of minimal-risk, non-exempt research under 45 CFR 46.110. Limited IRB review evaluates only privacy/confidentiality safeguards for specific exempt categories under 46.111(a)(7)-(8). Both can be performed by a single designated reviewer, but they are legally distinct mechanisms serving different exemption/review pathways.