Human Subjects Research

Human subjects research is research that involves living individuals, either through intervention or interaction with them or through identifiable private information or biospecimens about them. In the United States, the Common Rule (45 CFR 46.102) defines both parts: research is a systematic investigation designed to develop or contribute to generalizable knowledge, and a human subject is a living individual about whom an investigator conducting research obtains information or biospecimens through intervention or interaction and uses, studies or analyzes them, or obtains, uses, studies, analyzes or generates identifiable private information or identifiable biospecimens. Other jurisdictions set the scope of ethics review in their own laws and guidelines. Human subjects research is governed by ethical principles and regulatory frameworks designed to protect the rights, welfare, and safety of participants.

The history of research involving human participants includes serious ethical violations, from the Tuskegee syphilis study to nonconsensual radiation experiments, which led to the development of codes and regulations that shape modern research practice. Today, researchers working with human participants usually have to navigate ethical review processes, informed consent requirements, and data protection regulations. Failure to comply can result in harm to participants, retraction of publications, loss of funding, and institutional sanctions. Understanding the principles and procedures governing human subjects research is therefore a foundational competency for researchers across disciplines, from biomedical science to social science to educational research.

In the United States, nonexempt human subjects research covered by the Common Rule must be reviewed and approved by an Institutional Review Board (IRB) before it begins; many other countries use research ethics committees (RECs) set up under their own laws. The review process evaluates several elements: whether risks to participants are minimized and are reasonable in relation to anticipated benefits; whether the selection of subjects is equitable; whether informed consent will be obtained and documented; whether data monitoring plans are adequate; and whether additional safeguards are in place for vulnerable populations such as children, prisoners, pregnant women, or cognitively impaired individuals.

Under the Common Rule, the first question is whether an activity is human subjects research at all. Work that is not designed to contribute to generalizable knowledge is not research under the regulation, and a study that only uses information or biospecimens whose source the investigator cannot readily identify, without intervening or interacting with anyone, does not involve human subjects. Human subjects research is then sorted by category and risk. Exempt research fits one of the categories in 45 CFR 46.104(d), such as surveys or interviews recorded so that participants cannot readily be identified, or secondary research with identifiable data that are publicly available or that the investigator records without identifiers and will not reidentify; some exemptions require a limited IRB review. Expedited review applies to studies that pose no more than minimal risk and fit categories on a list published by the Secretary of Health and Human Services (45 CFR 46.110). Research that is neither exempt nor eligible for expedited review, including any study involving greater than minimal risk, is reviewed by the convened board. Ongoing oversight includes prompt reporting of unanticipated problems involving risks to participants or others, and IRB approval of protocol changes before they are made, except when a change is needed to eliminate apparent immediate hazards to participants.

The regulatory landscape varies by country. In the United States, the Common Rule (45 CFR 46), which covers research conducted or supported by the federal departments and agencies that follow it, and FDA regulations (21 CFR 50 and 56), which cover clinical investigations of FDA regulated products, provide the primary framework. The European Union's General Data Protection Regulation (GDPR) adds data protection requirements, and its test differs from the Common Rule's: it covers personal data, including pseudonymized data that a controller can link back to people, whereas the Common Rule asks whether the identity is or may readily be ascertained by the investigator. Ethical guidance such as the Declaration of Helsinki and the CIOMS International Ethical Guidelines (both international) and the Belmont Report (a US report) sets out principles that national rules build on.

Research that involves living human participants or their identifiable data generally needs ethical oversight under the rules that apply where it takes place, whatever the discipline or methodology. This includes clinical trials, observational studies, surveys, interviews, ethnographic research, genetic studies, and secondary analyses of identifiable datasets. Under the Common Rule, a study using only data the investigator cannot link to individuals may not be human subjects research at all, and some secondary research with identifiable data, such as publicly available data, can be exempt (45 CFR 46.104(d)(4)). The regulation does not say who makes these determinations, but OHRP recommends that investigators not decide on their own that their research is exempt, and many institutions require the IRB or a designated office to make the call.

A frequent error is assuming that a study does not constitute human subjects research because it uses existing data or involves only minimal interaction, without seeking a formal determination from the IRB. Another mistake is treating informed consent as a one time event rather than an ongoing process in which participants can ask questions and withdraw at any point. Researchers sometimes fail to anticipate risks specific to their study population, such as the psychological distress that may arise during interviews about traumatic experiences, or the privacy risks associated with collecting genetic data. Inadequate data security measures, particularly for electronic health records and genomic data, represent another area where mistakes occur.

A psychology researcher at a US university plans to conduct semi structured interviews with 40 survivors of intimate partner violence about their experiences seeking healthcare. Because the study involves a vulnerable population and sensitive topics, the IRB requires full board review, a comprehensive consent process that includes a discussion of confidentiality limits, a safety protocol for participants who become distressed, and a plan for secure storage of audio recordings and transcripts with identifying information removed within 30 days of transcription.