When Do External Organizations Need IRB Approval?

Overview

Research is often conducted in collaboration with multiple organizations external to Stanford. Depending on their role and activities in the research, external organizations may need to obtain their own IRB review and approval. IRB approval is generally required for activities requiring delegated authority or designated responsibilities and oversight from the Protocol Director. This includes direct interaction with participants and/or their personal information to make research decisions and document research observations.

The United States Department of Health and Human Services (DHHS) Office for Human Research Protections (OHRP) uses the phrase “engaged in human subjects research” to describe when an organization is performing activities that require IRB oversight and approval. Stanford IRB’s guidance is based on the guidance provided by OHRP. See the following guidance from OHRP on Engagement of Institutions in Human Subjects Research and Determining When Institutions are Engaged in Research.

This webpage includes:

Activities That Require IRB Approval
Activities That Generally Do Not Require IRB Approval
Locations the Stanford IRB Covers
Considerations When an Organization Does Not Have an IRB
When Single IRB Review is Required
Additional Requirements for Studies Involving External Organizations

Activities That Require IRB Approval for an Organization

The following table provides examples of when the activities performed by organizations would require IRB approval.

Activity	Example(s)
Screening individuals for eligibility as part of the study recruitment process	Organization staff access private information or records of individuals to determine if they qualify to participate in a study based on eligibility criteria.
Actively identifying/approaching individuals for study screening and enrollment	Organization staff contact individuals (by phone/email/in person) and obtain information to determine if they qualify for and for enrollment into a study.
Conducting the informed consent process or obtaining informed consent	Organization staff review the consent form, discuss study participation, and facilitate obtaining consent from individuals in-person or virtually. Organization staff serve are the contact person for questions or concerns in a self-led consent process, such as with an online questionnaire.
Delivering an intervention or conducting a study activity that is developed or modified for the study	Organization staff perform a diagnostic, treatment, or other medical procedure that is being tested for safety and/or effectiveness. Organization staff implement test scenarios with participants to observe their behavior or physiological response. Organization staff provide services, programs, or care that they usually deliver, but in a randomized manner determined by the research protocol. Organization staff administer an investigational drug on behalf of the Stanford researcher during an at-home visit. Organization staff administer a survey to students on behalf of the researcher. Organization staff conduct focus groups or interviews for the study.
Conducting research-related observations and recording study data	Organization staff observe students’ behavior in a classroom setting or complete data collection forms for the study. Organization staff complete clinical trial case report forms by collecting data directly from participants or from the medical record.
Accessing identifiable study data or specimens Note: All relevant data and privacy protection laws must be followed.	An investigator at the organization receives identifiable research data to conduct data-analysis.
Being the primary recipient of a federal award/grant	A researcher at the organization is the Principal Investigator (PI) or prime awardee of a federal grant and provides a sub-contract to Stanford researchers to conduct the human subjects research activities. All other research activities will be performed at Stanford.

Activities That Generally Do Not Require IRB Approval for an Organization

The following table provides examples of when the activities performed by organizations would not require IRB approval.

Activity	Example(s)
Advising the research process or protocol development	Key stakeholders at the organization give feedback on questions for a focus group, interview, or survey to be used in the study. A community advisory board at the organization informs the researcher on how to best engage the proposed participant population, including methods for recruitment, informed consent, retention, communication, and compensation. A faculty member at another organization acts as a scientific advisor for the design of a clinical trial.
Sharing information about the research to support recruitment	An individual posts research flyers at the organization location. Organization staff post about the study on social media. Organization staff send a message about the study on the organization’s email listserv. Organization staff share information about the study via word-of-mouth. Organization staff refer interested individuals to the study, including seeking permission from the individual to be contacted by the researcher for recruitment.
Performing a programmatic or commercial services that the organization normally provides for non-research purposes and was not modified as part of the research.	A teacher at the organization provides usual classroom instruction while researchers observe students to collect study data. An organization, such as a phlebotomy service, performs standard blood draws for research participants and sends the samples or results to the researcher. An organization, such as a home health nursing agency, performs usual medical monitoring for a research participant in an at-home visit.
Providing a physical space for the researchers and participants to meet and perform study activities	The organization provides a private study room for the researcher to meet and interview participants or conduct medical exams.
Providing data to the researcher that was already collected for non-research purposes (secondary data), when the organization is not involved in the research analysis Note: All relevant data and privacy protection laws must be followed.	The organization provides a dataset about patients with a specific medical condition to researchers for analysis. The organization provides customer satisfaction data from surveys they routinely collect to researchers for analysis. The organization, such as a software company, provides user data from an app to researchers for analysis.
Accessing or analyzing de-identified research data De-identified means not having the ability to identify OR re-identify participants. For Protected Health Information (PHI) to be de-identified, it must be stripped of all direct identifiers. Data is not considered de-identified if: you have a coded dataset and have access to the code key, or you have previously interacted with the participants directly and could re-identify them based on that interaction.	A study collaborator at the organization receives de-identified data to perform analysis for that study and provides the results back to Stanford. An investigator at the organization receives de-identified research data to conduct a secondary analysis for a separate project. An investigator at the organization receives coded data that does not include PHI, and an agreement is in place confirming they will not receive the code key.
Disseminating aggregate study findings or participating in the publication process	The organization sends a newsletter to share general findings from a study that their patrons participated in. An organization provides expert insight and editorial support for a manuscript that will be submitted to an academic journal, and the community partner is listed as an author.

Locations the Stanford IRB Covers

The Stanford IRB has the responsibility and authority to review human subject research and clinical investigations for the following locations/organizations:

Stanford University
Stanford Medicine Health Care, including:
- Stanford Cancer Institute
- Stanford Healthcare Tri-Valley
Stanford Medicine Children’s Health, including:
- Lucille Packard Children’s Hospital
Veterans Affairs Palo Alto Health Care System

Community-Engaged Research

Community-based participatory research is a partnered approach to research that equitably involves community members, organizational representatives, and academic researchers in all aspects of the research process, such as developing research questions that are of importance to patients and community partners, co-designing and implementing research to solve problems, and using data to influence policies and programs.

The Office of Community-Engaged Research (OCEnR), which is part of the Maternal & Child Health Research Institute (MCHRI) at Stanford, promotes health equity for maternal and child health populations by supporting community-engaged research initiatives and advancing strong collaborative partnerships between community, academic, and policy entities.

Please see the IRB Considerations for Community- & Patient- Engaged Research for commonly asked questions regarding working with the IRB on community- or patient-engaged research studies.

Considerations When an Organization Does Not Have Their Own IRB

If the activities conducted at the organization require IRB approval and they do not have an Institutional Review Board, the organization will need to rely on an external IRB for approval of those research activities. Relying on an external IRB requires additional steps to establish a reliance agreement.

Contact the Stanford Single IRB team to discuss options for IRB oversight for the external organization:

singleirb@stanford.edu
650-736-9024
Join one of the weekly Single IRB Office Hours. No registration is needed.

For questions related to engagement of international sites, contact irbeducation@stanford.edu.

When Single IRB Review is Required

Single IRB review may be required for federally supported research in which more than one U.S. organization is performing activities that require IRB approval. The single IRB review process is an arrangement where one IRB of record (or Reviewing IRB) provides the regulatory and ethical review services for multiple organizations participating in the same study.

Stanford may serve as the Reviewing IRB on a case-by-case basis. For projects where Stanford cannot be the Reviewing IRB, other options are available including reliance on commercial IRBs or other academic IRBs. Stanford has a Master Service Agreement with Advarra and WCG IRB.

Review additional information on the IRB website at Single IRB Review.

Additional Requirements for Studies Involving External Organizations

Other Institutional Reviews may be required in addition to IRB approval, including research-related agreements between Stanford and the external organization.

Page updated August, 2025