In This Section

What needs to be reviewed by the IRB

Published on · Last Updated 1 year 8 months ago


Subscribe to be notified of changes or updates to this page.

17 + 3 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.

The CHOP IRB permits investigators to apply the definitions of research and human subjects in order to determine whether or not their proposed activities meet the definition of human subjects research.

Investigators are frequently unsure whether or not their proposed project meets the definition of human subjects research and therefore requires review by the IRB. The most frequent questions received by the IRB concern the following:

  • receipt or use of deidentified or coded biospecimens or data;
  • quality improvement/assurance activities;
  • educational presentations; and
  • reports of notable or unique cases (case reports and case series).

Understanding the regulatory definitions of research and human subjects research can help distinguish between activities regulated by the IRB and those that fall outside its domain. Whenever there is uncertainty, the IRB should be consulted.

Many activities fail to meet the definition of research and therefore, do not require IRB review and approval. Most case reports and much of the Quality Improvement activities that take place do not meet the definition of research. The IRB may review these to assure that they are not research and therefore, do not fall under the IRB's purview.

How does the Common Rule define research?

45 CFR 46.102(d)
HHS regulations define research as a systematic* investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purpose of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes.

*Systematic means that the activity follows a written plan and adheres to scientifically accepted principles for research design.

How does the FDA define research?

FDA Definition of Research

21 CFR 56.102(c) FDA regulations define the term clinical investigation or research to mean any experiment that involves a test article and one or more human subjects where the test article is regulated by the FDA. The FDA considers the term clinical investigation as being synonymous with the following: research, clinical research, study, and clinical study.

FDA regulations govern clinical investigations that support applications for research or marketing permits for products regulated by the FDA, including food and color additives, drugs for human use, medical devices for human use, biological products for human use, and electronic products. This includes any new or unapproved item regulated by the FDA and the application of approved items to new populations or indications.

Research from the FDA's perspective, hinges on whether or not an investigational test article, which could be a drug, a biologic or a device is used. This definition is totally different from the HHS definition.

What kinds of activities are included in these definitions of research?

Many different types of research activity are encompassed by these two definitions.

For example, research objectives may range from understanding normal and/or abnormal physiological or psychological functions or social phenomena, to evaluating diagnostic, therapeutic or preventive interventions and variations in services and practices.

The activities or procedures involved in research may be invasive or noninvasive, and include removal of body tissues or fluids; administration or application of chemical substances or forms of energy; surgical interventions; modification of diet, daily routine or service delivery; alteration of environment; observation; administration of questionnaires or tests; randomization of subjects; review of records, and so forth.

Research activities may also be conducted or supported within a program or activity that otherwise may not be considered research, such as some demonstration and service programs. As such, the research aspect of the program falls under the jurisdiction of the CHOP IRB.

For IRB review and project implementation, a research project must be described in a protocol or, for an exempt submission, in the eIRB application.

Examples of activities that do not meet the definition of research

  • Activities not designed to produce generalizable knowledge;
  • Innovative clinical care;
  • Off-label use of drugs or biologics as part of usual clinical care;
  • Work Preparatory to Research;
  • Case reports and small case series;
  • Scholarly and journalistic activities, including the collection and use of information, that focus directly on the specific individuals about whom the information is collected;
  • Educational presentations;
  • Quality Improvement activities that implement known interventions and that do not use research methodologies;
  • Public health surveillance activities (e.g. the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority);
  • Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes;
  • Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.

The definition of who is a human subject determines whether or not the research must be submitted to the IRB for review and approval or not.

Common Rule Definition of Human Subject:

HHS regulations define a human subject as any living individual about whom an investigator conducting research obtains information or biospecimens:

  1. through intervention or interaction with the individual, and uses, studies or analyzes the information or
  2. obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.

FDA Definition of Human Subjects:

The FDA regulations define a human subject as an individual who is or becomes a participant in research, either as a recipient of a test article or as a control. A subject may be either a healthy human or a patient.

The difference between these definitions relate to the FDA's role in regulating investigational test articles (drugs, biologics or devices). If a person receives an investigational test article, then they are human subjects, regardless of the study design. Therefore, treatment with an investigational agent in a protocol designed to treat a single individual is enough to sufficient that individual a human subject even though generalizable knowledge will not result.


Living Individual:
Means that human subjects research involving decedents is not covered under the Common Rule. Decedents are still covered by HIPAA's Privacy Rule. Research that includes both decedents and living subjects must be reviewed by the IRB. If the research only pertains to decedents then the investigator does not need IRB approval but must submit a HIPAA attestation to the IRB prior to conducting the research.

Includes both physical procedures by which information or biospecimens are gathered and manipulations of the subject or the subject's environment that are performed for research purposes.

Includes communication or interpersonal contact between investigator and subject.

Private Information:
Includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (for example, a medical record).

Identifiable Private Information:
Private information must be individually identifiable for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information. This definition is different from the definition under the HIPAA Privacy Rule.

Who is not a human subject?

It is often unclear to investigators whether or not an individual should be considered human subject. The following are common scenarios where individuals are involved in the research but their involvement does not fit the definition of human research subject.

The definition of human subject includes the requirement to be "living individuals".

Third Parties:
This includes individuals who perform study procedures, make measurements, or perform assessments of study subjects. Their role in the research is to serve as collaborators, not subjects. For example, a teacher or driving instructor who completes an assessment of the study subject is a third party. However, if the investigator also obtains information about the teacher/instructor (number of years of teaching experience, age, qualifications, etc.) then they become secondary research subjects.

Individuals Not Readily Identifiable:
De-identified data and individuals who are not readily identifiable are not human subjects. A dataset may contain HIPAA identifiers but might still not be readily identifiable. For example, data obtained from the PHIS dataset or Medicaid is not considered readily identifiable even though there are birth dates because the data comes from the entire nation.

Inanimate Objects:
The subject of the research could be about institutions, programs or hospitals and not about the individuals who are in those programs. For example, a survey could inquire about a training program, hospital or other institution and requiring factual information that doesn't contain information about individuals. In this case, even though a person fills out the questionnaire, the research is not about them as individuals - its about the program in which they work.

Secondary Subjects

When information is obtained about individuals other than the research participant, then these individuals become secondary subjects of the research. If the medical history includes information about family members or others and it is recorded in a way so that the investigator can readily identify the other individuals, then both the index subject and the other family members must be considered human research subjects. Common secondary subjects include:

  • Parents of child participants
  • Children of adult participants
  • Family members of adult or child participants

The investigator must justify the need to gather identifiable data from secondary subjects. For example, a relative could be identified as Maternal Uncle 1 rather than by name.

If the secondary subjects will be contacted and offered an opportunity to participate, the research should include plans for the following:

  • Who will introduce the secondary subject to the research? The investigator should not contact these individuals without an introduction from the participant or parent of the participant?
  • How will the confidentiality of the index subject's private information be protected?

The informed consent form must include statements on the signature page to make clear that consent is being granted for all research participants. If family members will not be present, a waiver of consent and HIPAA Authorization will be needed.

For many clinical studies, the role of some members of the investigative team might not meet the definition of human subjects research (HSR). For example, if a laboratory technician receives a blood specimen that is coded and they have no way to re-identify the individual from whom the specimen was obtained, the technician is not engaged in HSR.

OHRP Guidance on Engagement of Institutions

If there is uncertainty about whether or not CHOP or an investigator at CHOP is engaged in the research, the Office of Human Research Protections (OHRP) provides a Guidance on Engagement of Institutions in Human Subjects Research. The FAQs for this section provide examples of when IRB Review is needed and when it is not.

Based on OHRP's Guidance, under some circumstances CHOP and its agents are not engaged in HSR, even though investigators elsewhere are. For example, blood specimens are sent to CHOP without identifiers for analysis. If CHOP does not enroll subjects in the study, then CHOP is not engaged in HSR.

There is one exception: When the study is funded by the DHHS and the PI is from CHOP, the IRB is required to review the study under the Common Rule at 45 CFR 46.122. This is true even when the PI is not personally engaged in the conduct of HSR. The rationale is that PI is responsible for the oversight of the HSR that is being conducted at the sub-contracted site(s).

Summary of OHRP's Guidance

Institutions are engaged in HSR if their agents or employees

  1. receive an award through a grant, contract, or cooperative agreement directly from HHS
  2. intervene for research purposes with any human subjects of the research by performing invasive or noninvasive procedures (see limited exceptions in column to right);
  3. intervene by manipulating the environment;
  4. interact with subjects for research purposes;
  5. obtain consent of subjects;
  6. obtain for research purposes identifiable private information or identifiable biological specimens from any source

It is important to note that, in general, institutions whose employees or agents obtain identifiable private information or identifiable specimens for non-exempt human subjects research are considered engaged in the research, even if the institution’s employees or agents do not directly interact or intervene with human subjects.

Institutions are not engaged in HSR if their agents or employees:

  1. perform commercial or other services for investigators (somewhere else) provided that all of the following are also met:
    1. the services performed do not merit professional recognition or publication privileges;
    2. the services performed are typically performed by those institutions for non-research purposes; and
    3. the institution’s employees or agents do not administer any study intervention being tested or evaluated under the protocol.
  2. provide clinical trial-related medical services that are dictated by the protocol and would typically be performed as part of routine clinical monitoring and/or follow-up of subjects enrolled at a study site by clinical trial investigators;
  3. administer the study interventions being tested or evaluated under the protocol limited to a one-time or short-term basis;
  4. provides patients with literature about a research study at another institution, including a copy of the informed consent document, and obtains permission from the patient to provide the patient's name and telephone number to the investigators;
  5. access or utilize individually identifiable private information only while visiting an institution that is engaged in the research, provided their research activities are overseen by the IRB of the institution that is engaged in the research;
  6. release to investigators at another institution identifiable private information or identifiable biological specimens pertaining to the subjects of the research. NOTE: the subjects would need to provide informed consent at the institution to which the data will be released.

Frequent Issues Related to QI:

  • What is QI and what distinguishes it from research?
  • When is IRB approval needed (i.e., when is QI human subjects research)?
  • Can QI studies be published even without IRB approval?
  • What ethical oversight is appropriate for QI activities that aren't research?

Quality improvement activities are an important component of hospital operations. Because QI activities are data-driven and involve human participants, it is not surprising that there can be overlap with research methodologies common to human subjects research. Where there overlap exists between QI and research methodologies, the federal regulations that protect human research participants may apply. Whether the QI activity is human subjects research or not, it is vital that it be executed in a manner that is ethical and respects the rights and welfare of the human participants.

What is Quality Improvement (QI)?


Quality Improvement (QI):
A working group from the Hastings Center "...defined QI as systematic, data-guided activities designed to bring about immediate improvements in health delivery in particular settings." Improving the quality of care of patients is a fundamental obligation of health care providers. The QI process involves evaluating and learning from experience.

A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. More information regarding the definition of research and who is a human subject is available elsewhere on this website.

Systematic Investigation:
An activity that is planned in advance and that uses data collection and analysis to answer a question. Although research must include systematic investigation, many non-research activities also include systematic investigation. Systematic investigation does not, in and of itself, define research.

Operations Activities:
Certain administrative, financial, legal, quality assurance, quality improvement, and public health endeavors that are necessary to support an institutions missions of delivering health care to its patients, conducting research and development, performing medical education, and contributing to national emergency response. CHOP hospital operations activities include (but are not limited to):

  1. Conducting quality assessment and improvement activities; systems redesign activities; population-based activities relating to improving health, ensuring safety, or reducing health care costs; and case management and care coordination.
  2. Reviewing the competence or qualifications of health care professionals; evaluating provider and health plan performance; training health care and non-health care professionals; and accreditation, certification, licensing, or credentialing activities.
  3. Underwriting and other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits and ceding, securing, or placing a contract for reinsurance of risk relating to health care claims.
  4. Conducting or arranging for medical review, legal analyses, or auditing services, including fraud and abuse detection and compliance programs.
  5. Business planning and development, such as conducting cost-management and planning analyses related to managing and operating an entity.
  6. Business management and general administrative activities.

To learn more go to the Resources for How to Improve on the Institute for Healthcare Improvement website.

IRB Challenges QI vs Research ("Quality Improvements or Human Subjects Research?" slideshow)

How does QI differ from research?

Both research and quality improvement are systematic investigations that may involve human participants but they differ in important ways. The table below is based on information adapted from The Ethics of Using QI Methods to Improve Health Care Quality and Safety.

  Human Subjects Research Quality Improvement
Purpose designed to develop or contribute to generalizable knowledge designed to implement knowledge, assess a process or program as judged by established/accepted standards
Starting Point knowledge-seeking is independent of routine care and intended to answer a question or test a hypothesis knowledge-seeking is integral to ongoing management system for delivering health care
Design follows a rigid protocol that remains unchanged throughout the research adaptive, iterative design
Benefits might or might not benefit current subjects; intended to benefit future patients directly benefits a process, system or program; might or might not benefit patients
Risks may put subjects at risk does not increase risk to patients, with exception of possible patients' privacy or confidentialty of data
Participant Obligation no obligation of individuals to participate responsibility to participate as component of care
Endpoint answer a research question improve a program, process or system
Analysis statistically prove or disprove hypothesis compare program, process or system to established standards
Adoption of Results little urgency to disseminate results quickly results rapidly adopted into local care delivery
Publication/Presentation investigator obliged to share results QI practitioners encouraged to share systematic reporting of insights

When is IRB approval needed for QI activities?

IRB approval may be required when the activity involves some of the following characteristics:

  • seeks to develop new knowledge or validate new treatments rather than to assess the implementation of existing knowledge;
  • when the methodology employs a standard research design, such as randomization;
  • when the protocol is fixed with a rigid goal, methodology, population, time period, etc.;
  • when the funding for the activity comes from the outside organizations such as the NIH or those with a commercial interest in the results;
  • when there will be a delay in the implementation of results;
  • when the risks from the intervention to participants are greater than minimal

Worksheets for Assessing Whether a QI Activity is Also Research

Below are two worksheets for helping investigators ascertain whether or not the IRB should be consulted prior to initiating the QI project.

The first worksheet was developed by Rachel Nosowsky, Esq. and is based on The Hastings Center Report The Ethics of Using QI Methods to Improve Health Care Quality and Safety.

CHOP QI Screening Checklist

The second worksheet, the CHOP QI Screening Checklist, was developed by the CHOP Quality Improvement Committee (QIC) Ethics Subcommittee and should be used by CHOP QI investigators.

Why doesn't the IRB review all QI activities?

The IRB system was designed to provide oversight for human subjects. The system is costly and can take weeks to months to obtain approval. By its very nature, QI is an iterative, adaptive process that often requires rapid action. To force all QI activities into the IRB system would impose such a heavy overhead that many worthwhile projects wouldn't be feasible.

Can QI studies be published without prior IRB approval?

Publication is only one of many criteria for determining whether a QI activity is also research, by itself, intent to publish is not sufficient to require IRB review and approval.

Even though most QI activities aren't research, there is much to be learned from sharing descriptions of these non-research activities. For example, Case Reports are generally not considered to be research but provide a valuable addition to the medical literature. By analogy, lessons learned from a QI activity should be shared with others.

Standards for reporting QI initiatives have been developed and published by the SQUIRE Development Group. Individuals intending to publish the results of a QI project should consult this Guideline.

What ethical oversight is appropriate for QI activities that aren't research?

The IRB provides ethical oversight for human subjects research but there isn't at present, a system for ethical oversight of QI activities. At a minimum, hospital departments and divisions should review all proposed QI activities to ensure that the risks to participants are not greater than minimal and that there are appropriate protections for individual's privacy and confidentiality of their identifiable data.

Resources for Questions Related to QI and Research:

Access to web links is limited to those on the CHOP intranet.

Office for Patient Safety and Quality

Anna Spraycar
Sr. Director, Clinical Operations & Enterprise Improvement
[email protected]

IRB Office

Amy Schwarzhoff, MBA, CIP
[email protected]

Barbara Engel, MD, PhD, CIP
[email protected]

Susan Levy, MD, MPH, CIP
[email protected]

Kevin Meyers, MBBCh
[email protected]

CHOP Privacy Office

Beth Thornton
Manager, Privacy Operations
[email protected]

The Office of Research Compliance

Matthew Hodgson
VP, Research Compliance and Regulatory Affairs
[email protected]

Key References

  1. The Ethics of Using Quality Improvements in Health Care contains a detailed discussion of the differences between QI and research
  2. The Common Rule and Continuous Improvement in Health Care a discussion paper sponsored by the Institute of Medicine discusses the interactions and overlap between QI and research.
  3. Vogelsang J. Quantitative research versus quality assurance, quality improvement, total quality management, and continuous quality improvement.
  4. Casarett et al. Determining when quality improvement initiatives should be considered research: proposed criteria and potential implications.
  5. Finkelstein et al. Oversight on the borderline: quality improvement and pragmatic research
  6. Baily et al. Special Report: The Ethics of Using QI Methods to Improve Health Care Quality and Safety
  7. Lynn et al. The ethics of using quality improvement methods in health care
  8. Grady C. Quality improvement and ethical oversight.
  9. Davidoff et al. Publication guidelines for improvement studies in health care: evolution of the SQUIRE Project.
  10. Baily MA. Harming through protection?
  11. Miller and Emanuel. Quality-improvement research and informed consent

HIPAA permits investigators to use Personal Health Information (PHI) for two activities without IRB review or approval. The investigator must submit an attestation to the IRB prior to embarking on the work. After submitting the attestation, the investigator may proceed with their work. The HIPAA regulation does not specify what the IRB is to do with the attestations. At CHOP, the IRB screens the submissions to ensure that they meet the requirements of HIPAA and acknowledges receipt.

The eIRB application includes an option to fill out and complete the required HIPAA attestations and submit them to the IRB (start a new study in eIRB, select "HIPAA Attestation (Use of PHI Preparatory to Research)" under the first question and answer a few questions). The IRB staff will review the attestations for completeness and to ensure that they comply with the requirements of HIPAA (below). The investigator will receive an acknowledgement letter within the eIRB system.

45 CFR 164.512(i)(1)(ii): Work Preparatory to Research

(ii) Reviews preparatory to research. The covered entity obtains from the researcher representations that:

  • (A) Use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research;
  • (B) No protected health information is to be removed from the covered entity by the researcher in the course of the review; and
  • (C) The protected health information for which use or access is sought is necessary for the research purposes.

Work preparatory to research includes activities needed to establish whether or not it is feasible to proceed with the research. The standard for how much data may be collected is that the investigator is limited to the minimum necessary PHI and other data to prepare for the research.

  • review of medical records to determine if there are sufficient number of potential subjects that might meet the entry criteria;
  • review of medical records to determine if there are sufficient number of potential subjects who are typically seen within the study time frame (e.g. children with hernia repair per year);
  • review of pathology records to determine if there are enough specimens meeting the required diagnostic criteria.

45 CFR 164.512(i)(1)(iii): Decedent Research

(iii) Research on decedents' information. The covered entity obtains from the researcher::

  • (A) Representation that the use or disclosure sought is solely for research on the protected health information of decedents;
  • (B) Documentation, at the request of the covered entity, of the death of such individuals; and
  • (C) Representation that the protected health information for which use or disclosure is sought is necessary for the research purposes.

Research with decedents data or specimens is not subject to review by the IRB. The definition a human subject 45 CFR 46.102(e)(1) in the Common Rule is limited to living individuals. Nevertheless, HIPAA requires investigators to submit an attestation to the IRB prior to conducting research that involves the use of the decedents' PHI. The IRB receives and acknowledges receipt of these attestations.

Frequently Asked Questions

  1. Who can make the determination that an activity is (or is not) human subjects research?

    At CHOP, the investigator is permitted to make the determination that what they are doing does not meet the definition of human subjects research. Only activities that meet the definition of human subjects research require submission to the IRB for a review and approval or for a determination of exemption. However, there are many situations where it may be unclear whether or not the proposed activities meet the definition of research and if it does, whether or not it involves human subjects. Requests for the IRB to make a determination as whether or not an activity meets the definition of human subjects research should be submitted via the eIRB system. Examples:

    A QI may produce as a byproduct information that is worth sharing. Depending on the design of the project, it might or might not be human subjects research.

    Receipt of a large Medicaid data set containing hundreds of thousands of records might contain birth dates and dates of service. If the investigator is uncertain, the IRB would need to determine if the individuals would be readily identifiable or not.

  2. Is innovative care designed to enhance the well-being of an individual using an FDA approved drug or device research?

    No. The FDA and the IRB do not regulate the practice of medicine. Since the drugs, biologic or device is approved and the intent is to provide care for an individual patient and not to produce generalizable knowledge, this is not human subjects research.

  3. Is a database (registry) designed for use in future research considered research?

    Yes. If the database/registry is being designed and used for the purposes of future research then even though no research activities are planned per se, this is considered research and also falls under the requirements of HIPAA. If the database will be used primarily for clinical care or hospital operations purposes, then prior IRB review is not required. However, any research that intends to use the information from the database would require IRB review.

  4. Does a case report require prior IRB review?

    No. The CHOP IRB does not consider retrospective case reports to meet the definition of research. However, prospective research involving just a single subject do not qualify as case reports just because the research is limited to one individual.

  5. What about a case series?

    It depends; a determination from the IRB may be necessary. A case series can be several notable cases reported at the same time. The IRB does not consider this to be research. In IRB SOP 407: Determining When a Proposal Meets the Definition of Human Subjects Research, the IRB excludes case series of 5 or fewer patients from review. Case series with 6 or more cases must be submitted to the IRB as research or for a determination that they do not meet the definition of research. The rationale for this requirement is that case series involving greater than 5 records frequently involve dozens of records and could be more appropriately classified as descriptive or observational research. See the IRB's webpage on Study Design.

  6. We are conducting a Quality Improvement/Quality Assurance project and have no plans to publish; do we need IRB review?

    Maybe. Publication is a consideration but it does not distinguish research from non-research QI/QA projects. The intent of QI/QA is to improve the care of patients at CHOP, often using proven care strategies and methods and most are not research. The project may still produce generalizable knowledge that clinicians would wish to share with others. If the QI/QA project intends to test an as yet unproven care strategy using a standard research methodology, then it is likely that the project is research. For more information, see the OHRP Quality Improvement Activities Frequently Asked Questions website, Is this Quality Improvement?, or the CHOP Screening Checklist for Quality Improvement (QI) Projects.

  7. What about receipt of deidentified datasets or biospecimens?

    No. Use of de-identified datasets or biospecimens is not human subjects research. In order for the data/biospecimens to be de-identified, there can be no identifiers and there can be no link to identifiers. A coded specimen that can be linked back to individuals is not considered de-identified. If the providers have access to the key but will not provide the recipient with any PHI, then from the recipients’ perspective the data or specimens are de-identified. The provider of the data/specimens must either provide a letter stating that they will not provide any identifiers, or have policies which clearly state that they will not provide identifiers. For details of the requirements for data sharing, see Guidance on Engagement of Institutions in Human Subjects Research

  8. Can I share de-identified data or biospecimens with another investigator?

    Yes. Use of deidentified data or specimens does not constitute human subjects research. However, the investigators must adhere to both the limitations (if any) specified in the consent form used to obtain the specimens and the subject's expressed preferences with regard to future use. If re-use of study data or biospecimens for future research is a possibility, then the consent form must include information about future use. For most studies, subjects should be able to opt-in or opt-out without affecting their ability to enroll in the main study. The IRB's Consent Form Templates include example language for optional future use. The subjects' preferences should be noted as part of the study record to ensure that future use of data and specimens matches each subject's decision.

  9. If CHOP is not enrolling subjects in the research but is functioning as the data coordinating center (DCC) does this require review by the IRB?

    It depends. If the research is funded by the DHHS or if the DCC will receive identifiable subject information, then the CHOP is engaged in the research and the IRB must review the activities of the DCC. If the DCC will only receive de-identified data and the funding is not from DHHS, then there is no obligation to obtain IRB approval. Having monitors (CRAs) from the DCC perform source-data verification during a site visit does not engage the DCC in Human Subjects Research unless it receives PHI from the site.