Governmental Oversight and Regulations

In order for the university to fulfill its responsibility and to comply with the laws and regulations, all human participants research conducted under university auspices must receive appropriate IRB review and approval. In its Federalwide Assurance (FWA), on file with the Office for Human Research Protections (OHRP), U.S. Department of Health and Human Services (DHHS), the University assures compliance with all requirements of Title 45, Part 46 of the Code of Federal Regulations (45 CFR 46) for federally funded human participants research. This law serves as the federal policy for the protection of human research participants. Although DHHS was directed to exercise authority over 45 CFR 46, this policy has also has been adopted by more than 16 other federal departments and agencies, including the National Science Foundation and the Department of Education.  This federal policy, sometimes called the Common Rule, is codified as the Common Federal Policy for the Protection of Human Subjects and was published in the Federal Register in 1991, with significant revisions in 2018. It requires that each institution at which federally funded research is conducted adhere to the principles of The Belmont Report and set forth in writing its ethical principles, policies, and procedures. It also requires that all institutions conducting such research file an Assurance of Compliance (such as the FWA) and register each IRB operated by the institution. 

Periodic audits conducted by the federal departments that are responsible for human subject protections and the performance of IRBs have resulted in temporary injunctions of research with humans at institutions that are not in compliance with the regulations. The IRB is also required to report to the OHRP serious problems and adverse events that occur in particular research projects at the institution, including serious noncompliance with IRB requirements. 

Other Related Federal Regulations

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records. The law applies to all institutions and schools that receive funds under an applicable program of the U.S. Department of Education. Generally, FERPA requires that schools have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to certain parties under certain conditions, as outlined in the regulations (such as to other schools or for certain research purposes). Schools also may disclose to anyone, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.

The Protection of Pupil Rights Amendment (PPRA) (20 U.S.C. § 1232h; 34 CFR Part 98) applies to programs that receive funding from the U.S. Department of Education (ED). Among other things, it seeks to ensure that schools and contractors obtain written parental permission before minor students are invited to participate in any ED-funded survey, analysis, or evaluation that reveals information concerning:

• Political affiliations;
• Mental and psychological problems potentially embarrassing to the student and his/her family;
• Sex behavior and attitudes;
• Illegal, anti-social, self-incriminating and demeaning behavior;
• Critical appraisals of other individuals with whom respondents have close family relationships;
• Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers; or
• Income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

Health Information Privacy and Portability Act (HIPPA). The Office for Civil Rights enforces the HIPAA Privacy Rule, which protects the privacy of individually identifiable health information; the HIPAA Security Rule, which sets national standards for the security of electronic protected health information; and the confidentiality provisions of the Patient Safety Rule, which protect identifiable information being used to analyze patient safety events and improve patient safety. The HIPAA Privacy Rule establishes the conditions under which protected health information may be used or disclosed by covered entities for research purposes. Research is defined in the Privacy Rule as, “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” See 45 CFR 164.501. A covered entity may use or disclose for research purposes health information that has been de-identified (in accordance with 45 CFR 164.502(d) and 164.514(a)-(c)). 

In the course of conducting research, researchers may obtain, create, use, and/or disclose individually identifiable health information. Under the Privacy Rule, covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule, which include obtaining IRB approval. 

Food and Drug Administration regulations Title 21 CFR Part 50 and Title 21 CFR Part 56 will apply to projects involving food, medicine, biologics, medical devices, electronic products that give off radiation, cosmetics, veterinary products, and tobacco products (see the entire list).

Relevant State Regulations

Iowa Code Chapter 232.2(5) Definition of Child (PDF). "Child" means a person under eighteen years of age.

Iowa Code Chapter 599.1 Definition of Minority Age (PDF). The period of minority extends to the age of eighteen years, but all minors attain their majority by marriage. A person who is less than eighteen years old, but who is tried, convicted, and sentenced as an adult and committed to the custody of the director of the department of corrections shall be deemed to have attained the age of majority for purposes of making decisions and giving consent to medical care, related services, and treatment during the period of the person’s incarceration.

Iowa Code Chapter 235B.3: Dependent Adult Abuse (PDF). This section lists the types of individuals who are mandated to report dependent adult abuse, primarily service professionals and police officers. It also provides the option for others to make reports. "Dependent adult" is defined in §235B.2(4) (PDF) as follows: "Dependent adult" means a person 18 years of age or older who is unable to protect the person's own interests or unable to adequately perform or obtain services necessary to meet essential human needs, as a result of a physical or mental condition which requires assistance from another, or as defined by departmental rule.

Iowa Code Chapter 232.69(1) Child Abuse Reporting (PDF). This section lists the individuals who are mandated to report child abuse within 24 hours, primarily service professionals, school employees, and police officers.  This section also refers to permissive reporters ("any other person (i.e., other than on the list) who believes that a child has been abused may make a report"). When it is possible that identification of a reportable abuse may occur in the research setting, investigators must include this information in the informed consent document. 

Iowa Code Chapter 147.111 Reporting Injuries (PDF). The general licensing provisions for a number of health care professions (see Iowa Code Chapter 147) require reporting a wound or "other serious injury" that is being treated by the person licensed under that chapter and that appears to have been received in connection with the commission of a criminal offense.

Iowa Code Chapter 139A.3 Reporting Diseases (PDF). This section requires health providers and laboratories to make a report to the local or state health department when they become aware of possible communicable and infectious diseases and conditions. The section also provides for immunity from prosecution for individuals who report, and for confidentiality of the identifiable data in the records. Of note, in Iowa reportable conditions include cancer and birth defects with reporting to the State Health Registry located at UI. When it is possible that identification of a reportable condition may occur in the research setting, investigators must include this information in the informed consent document.