Navigating the IRB Process
Penn IM Research Hub
RegulatoryFoundational Research CurriculumIntroduction
If you are pursuing a research project as a resident, you will almost certainly need to navigate the Institutional Review Board (IRB). The IRB is the federally mandated committee that reviews and approves research involving human subjects, ensuring that studies meet ethical standards for participant protection, informed consent, and scientific merit.
For many trainees, the IRB process feels opaque and intimidating, but with the right preparation it is very manageable. This guide covers the full arc: from determining whether your project requires IRB approval, to selecting the right review category, preparing your protocol, submitting through Penn's eIRB platform, and managing your study after approval.
Key Update: Penn's eIRB Platform
Penn launched a new electronic IRB submission system, eIRB, on February 9, 2026, replacing the legacy HSERA system. All new submissions should be made through apps.research.upenn.edu/irb. Legacy HSERA is now read-only for accessing prior approval letters.
Do You Need IRB Review?
Not every project a resident undertakes is "human subjects research" in the regulatory sense. Two categories of activity commonly lead to confusion: purely administrative or retrospective work involving no living subjects (which may not be research at all), and Quality Improvement (QI) projects aimed solely at improving local practice without intent to generalize. QI projects may not require formal IRB approval, but the line between QI and research can shift quickly once publication or dissemination is on the table. Use the decision tool below to get oriented, and when in doubt, consult the IRB or your faculty PI before starting.
Step 1: Does your project involve living human subjects?This includes collecting data directly from individuals, observing their behavior, using their identifiable private information, or obtaining their specimens.
Levels of IRB Review
There are three levels of IRB review at Penn. The applicable level is ultimately determined by the IRB, but understanding the criteria helps you anticipate the review timeline and tailor your protocol appropriately.
Exempt
Days to 2 weeksResearch that falls into federally defined categories of minimal-risk activity. Submission is still required; the IRB must confirm the exemption. Most retrospective chart reviews and anonymous surveys fall here.
• Retrospective chart reviews with de-identified data
• Anonymous surveys or questionnaires
• Secondary analysis of publicly available datasets
• Educational interventions in established training settings
Expedited
1–3 weeksMinimal-risk research that does not qualify as Exempt. Reviewed by a single designated IRB member rather than the full board. Prospective observational studies and surveys collecting identifiable data typically fall here.
• Prospective observational studies (no intervention)
• Chart reviews with identifiable data
• Survey studies collecting identifiable information
• Minor procedures such as blood draws or non-invasive measurements
Full Board
4–8+ weeksResearch involving more than minimal risk or vulnerable populations. Reviewed at a monthly convened board meeting. Penn has 8 boards, each meeting once monthly. Clinical trials and interventional studies typically require Full Board review.
• Randomized controlled trials
• Studies with investigational drugs or devices (IND/IDE required)
• Research primarily targeting children, prisoners, or pregnant women
• Studies with procedures exceeding minimal risk
Note: "Exempt" does not mean the study does not need to be submitted. It means the IRB has determined that the study falls into a federally defined low-risk category. The IRB makes all final category determinations.
Exempt Category Guide
If your study qualifies for Exempt review, you will need to select a specific exempt category in eIRB. The categories are defined by the federal Common Rule (45 CFR 46.104) and numbered 1 through 8. Categories 7 and 8 involve "limited IRB review" and require broad consent for future secondary use of biospecimens or data; they are rarely applicable to typical resident projects. Below are the categories most relevant to resident research, with guidance on which to select for common study types.
| Study Type | Likely Category |
|---|---|
| Retrospective chart review (fully de-identified) | Category 4(ii) |
| Retrospective chart review (identifiable or limited dataset, HIPAA-covered) | Category 4(iii) |
| Case-control study using existing records | Category 4(ii) or 4(iii) |
| Anonymous survey of physicians or trainees | Category 2 |
| Confidential survey (identifiable responses) | Category 2 (Limited Review) |
| Qualitative interviews (de-identified) | Category 2 |
| Educational intervention in residency curriculum | Category 1 |
Category Details
Category 4 and Resident Research
Category 4 is by far the most commonly applicable exempt category for resident research. The key sub-clause for most EHR-based studies is 4(iii): the HIPAA-regulated use of identifiable health information for research purposes. If your institution has a Data Use Agreement or you are accessing the Penn Medicine clinical record through approved channels, this sub-clause typically applies. Your faculty PI and the IRB office can confirm which sub-clause is appropriate for your specific study.
Review Level Estimator
Answer four questions about your study to get an estimate of which review level is most likely. This tool is for orientation only; the IRB makes all official category determinations.
Does your study involve any experimental or investigational intervention beyond standard clinical care?e.g., a new drug, device, procedure, or behavioral intervention being tested. Routine clinical care, questionnaires, and blood draws are generally not experimental interventions.
Does your study primarily involve a vulnerable population?This includes children under 18, pregnant women, prisoners, or individuals with diminished autonomy or decision-making capacity as the primary study population.
Will you work with data that can be linked back to individual patients?Identifiable data includes MRN, name, date of birth, or any combination of variables that could uniquely identify someone. Fully de-identified data per HIPAA's Safe Harbor standard is NOT identifiable.
Will you prospectively enroll participants (interacting with or recruiting people going forward)?If you are only analyzing existing records, specimens, or datasets and not recruiting or interacting with new participants, answer No.
The Submission Process
IRB submission at Penn follows a structured workflow. Here are the key steps from preparation through approval.
Penn IRB Submission Walkthrough
The Penn IRB has published an interactive, screen-by-screen walkthrough of the eIRB submission platform. Review it before your first submission.
Complete Required Training
All study personnel must complete CITI Biomedical Research training before starting research activities. At Penn, this is a one-time completion with no renewal required. The PI and all co-investigators must be listed on the protocol with current certifications.
Identify a Faculty Principal Investigator
Residents and trainees cannot serve as the Principal Investigator (PI) on an IRB protocol at Penn. You will need a faculty physician to serve as PI. The PI is ultimately responsible for protocol compliance, so clarify this role with your mentor early.
Determine Your Study Type and Review Level
Use the decision tools on this page to determine whether IRB review is required and which review level your study is likely to fall under (Exempt, Expedited, or Full Board). When in doubt, submit; the IRB will confirm the appropriate category.
Prepare Your Protocol
Draft the key sections of your protocol: Lay Summary, Background and Significance, Specific Aims, Study Design, Subject Selection, Privacy and Confidentiality Plan, and Risk/Benefit Analysis. The IRB will also require an informed consent form for studies with direct participant interaction. Use the Protocol Template Builder below to get started.
Submit via Penn eIRB
Log in to the Penn eIRB platform (launched February 2026, replacing the legacy HSERA system) to create a new submission. The Penn IRB has published an interactive walkthrough of the submission process.
Respond to IRB Queries
The IRB reviewer may request clarifications, additional information, or protocol modifications. Respond promptly through the eIRB platform. Work with your faculty PI on substantive changes. Studies requiring Full Board review are scheduled for the next available monthly board meeting.
Receive Approval and Begin Research
You will receive an approval letter specifying the review category, protocol number, and approval period. Keep this document; you will need the IRB number for publications, grant applications, and conference submissions. Do not begin any research activities before receiving written approval.
Protocol Template Builder
Writing a protocol from scratch is one of the biggest stumbling blocks for trainees. Below you will find study design-specific template language for eight core sections of an IRB protocol, including sections directly drawn from the eIRB submission form. Select your study type and section, then use the template as a starting point, customizing the bracketed placeholders with your study-specific details.
How to use: Replace all [bracketed text] with your study-specific details. These templates are starting points; your faculty PI should review and refine all protocol sections before submission.
Step 1: Select your study type
Step 2: Select a protocol section
This study examines [condition/disease] in patients seen at [institution]. Using existing medical records, we will analyze information from approximately [N] patients with [condition] to better understand [research question in plain language]. The study does not involve any contact with patients; we will only review data that was already collected as part of their routine clinical care. Understanding [research question] may help improve how we [care for / treat / identify] patients with [condition] in the future.
Writing Tips
The lay summary should be written for a non-expert reader. Avoid jargon, spell out acronyms, and keep it to 2-4 sentences. This is often read by non-physician IRB members, so clarity matters more than precision here.
After Approval
Getting IRB approval is not the end of your responsibilities; it is the start of ongoing compliance obligations. Here are the key things to know:
Record Your IRB Protocol Number
Your IRB approval letter will include a protocol number (e.g., #850928). Record this; you will need it for every abstract submission, conference presentation, grant application, and manuscript you submit.
Continuing Review (for Full Board Studies)
Full Board studies require annual continuing review to maintain active approval. Expedited studies may also require periodic renewal. Exempt studies do not require continuing review. The IRB will send reminders, but it is your responsibility to submit renewal materials on time.
Protocol Amendments
Any modification to your approved protocol, including changes to study personnel, study design, consent procedures, or data collection instruments, requires an amendment to be submitted to and approved by the IRB before implementation. This includes adding a new co-investigator such as yourself when joining an existing study.
Adverse Event Reporting
Unanticipated problems involving risk to participants, including unexpected adverse events in clinical trials, must be reported to the IRB promptly. Your faculty PI is primarily responsible for this, but as a co-investigator you should be familiar with the reporting obligations.
Record Retention
Research records must be retained for at least three years after the end of the study, or longer for FDA-regulated studies. Work with your faculty PI to ensure appropriate data storage and security throughout the project and after it concludes.
Common Pitfalls to Avoid
Starting data collection before IRB approval
Instead: Never collect data, recruit participants, or access protected health information for research purposes before receiving written IRB approval. Studies begun without approval may need to be terminated and cannot be published.
Assuming QI does not need any IRB involvement
Instead: If there is any chance you will publish or present findings beyond your institution, get an IRB determination at the start. Retroactive approval is not possible, and journals increasingly require proof of IRB review or exemption.
Not adding yourself to the protocol
Instead: As a trainee, you must be listed as a co-investigator on the IRB protocol before accessing any study data. If you join an existing study, your faculty PI must submit an amendment to add you before you access any records.
Vague or overly broad study descriptions
Instead: The IRB reviews what you propose to do, not what you might want to do in the future. Overly vague aims or undefined datasets lead to revision requests and delays. Be specific about your data sources, variables, and analyses.
Forgetting to renew approval
Instead: Full Board approvals expire annually. If your approval lapses, you must stop all research activities until renewal is approved. Set a calendar reminder several weeks before your approval anniversary date.
Not obtaining consent when it is required
Instead: Any study with direct participant interaction (surveys, interviews, blood draws, clinical interventions) requires informed consent unless a waiver is granted by the IRB. Consent must be documented and stored. Work with your PI to design and obtain IRB-approved consent forms before enrollment begins.
Key Resources
Penn eIRB Platform
Submission PortalSubmit and manage IRB protocols at Penn (launched February 2026, replacing HSERA).
Penn IRB Website
Penn IRBGuidance documents, forms, templates, meeting schedules, and IRB staff contact information.
eIRB Submission Walkthrough
Interactive GuidePenn IRB's interactive, screen-by-screen walkthrough of the eIRB submission interface.
CITI Training
TrainingComplete required Biomedical Research (and other) CITI training courses.
45 CFR 46.104: Exempt Categories
Federal RegulationFederal definitions of all exempt research categories under the Common Rule.
Essential Research Trainings
Hub ModulePenn IM Research Hub module on required research trainings, including CITI and HIPAA.
Continue Learning
Explore other modules in the Research Curriculum: