Planning a thesis, DNP or quality improvement project that involves people or patient data, and unsure what your IRB will ask? This guide explains exempt, expedited and full board review, consent, privacy, risk and benefit, QI versus research, and the questions reviewers ask most.
If you are a graduate nursing student whose project involves people, patient information or staff, and you are not sure whether it needs IRB review, this guide is for you. It covers theses, dissertations, DNP projects and quality improvement projects. It explains how ethics review works, how to decide what level of review your project needs and how to write the parts of an application that reviewers care about most.
An institutional review board (IRB), sometimes called a research ethics committee, reviews projects to protect the rights and welfare of participants. Your own institution decides what its IRB requires, so use this guide to prepare, and follow your institution's instructions and forms.
Quick answer. Do not decide alone whether your project needs review. Describe it to your IRB or research office, and let them decide whether it is exempt, expedited, full board or not human subjects research. Then write a clear protocol with a consent process, privacy protections and a fair account of risk and benefit. Do not start collecting data until you have written approval or determination.
Modern research ethics in the United States rests on the Belmont Report, and on the federal regulations known as the Common Rule (45 CFR 46), which most institutions apply. The U.S. Office for Human Research Protections hosts the regulations and guidance, and the Belmont Report is available on its site.
| Belmont principle | What it means | How it shows up in your application |
|---|---|---|
| Respect for persons | People are autonomous, and those with reduced autonomy need protection | Informed consent, voluntary participation, extra care for vulnerable groups |
| Beneficence | Do no harm, maximize possible benefits and minimize possible harms | Risk-benefit assessment and risk minimization |
| Justice | Fair distribution of the burdens and benefits of research | Fair selection of participants, no exploitation of convenient groups |
Most institutions also require human subjects training before you submit. It is often completed online, and certificates typically expire, so check that yours is current.
Under the Common Rule, research is a systematic investigation designed to develop or contribute to generalizable knowledge. Quality improvement (QI) aims to improve care or processes in a specific setting. The line can be blurry, and it matters, because the answer changes what review you need.
| Feature | More likely QI | More likely research |
|---|---|---|
| Purpose | Improve a process in this setting | Produce knowledge that applies beyond the setting |
| Intent to publish or generalize | Sharing lessons is not the main goal | Findings are intended to be generalizable |
| Design | Rapid cycles such as PDSA | Formal hypothesis, comparison, defined sample |
| Participants | Patients and staff receiving usual care changes | People enrolled to be studied |
| Data use | Internal decision making | Analyzed to answer a research question |
Some institutions issue a "not human subjects research" letter for QI projects, and a QI label does not remove your duty to protect patients and their data. If you plan to publish, tell the reviewer. The evidence-based practice change guide covers how projects are framed.
If a project is human subjects research, the level of review depends mainly on risk and on the type of activity. The IRB, not the researcher, makes the final decision about the level.
| Level | Typical features | Example of the type of project |
|---|---|---|
| Exempt | Minimal risk and fitting specified categories, such as some anonymous surveys or normal educational practices | An anonymous survey of adult nurses about workload |
| Expedited | Minimal risk, fitting a listed category, reviewed by one or a few reviewers instead of the full board | Interviews about experience with identifiable data collected |
| Full board | More than minimal risk, or vulnerable populations, or sensitive topics | An intervention study with patients, or research with people who may be at risk of harm |
Minimal risk means that the probability and size of possible harm are not greater than those ordinarily met in daily life or in routine physical or psychological examinations. Exempt does not mean unreviewed. Exempt studies still need to be submitted for a determination and must still respect participants.
Consent is a process, not just a signature. Participants must understand what they are agreeing to, and agree voluntarily.
| Weak | Stronger |
|---|---|
| Your data will be anonymized through de-identification procedures. | We will remove your name from your answers and store the files on a password-protected, encrypted drive. Only the research team will see them. |
| You will not be harmed. | This survey has few risks. Some questions may make you feel uncomfortable, and you can skip any question or stop at any time. |
Write for a general reader, aim for a modest reading level and keep the form short. Waivers or alterations of consent, or an information sheet in place of a signed form, are sometimes possible for minimal risk studies. Ask your IRB, and give reasons.
Students often want to recruit their own patients, colleagues or students. Explain how you will prevent pressure: for example, have someone else make the invitation, tell participants their decision will not affect their care, grades or employment, and never see who declined.
Illustrative example, not a real client.
Problem. A DNP student planned a project to introduce a new discharge education process on a unit. She assumed it was quality improvement and therefore did not need review, so she began collecting baseline data from patient records.
Tension. When she mentioned her plans to her project chair, he asked whether she had a written determination. She did not. The baseline data could be unusable if her institution decided the project was research, and she had already started.
Turn. She stopped collecting, wrote a one-page project summary covering purpose, methods, data and intended use of results, and sent it to the IRB office. She also told them she hoped to present the results at a conference.
Proof. The office issued a written determination and told her which data elements needed a privacy review. The determination went into her project file, and the privacy officer approved the data access route.
Payoff. She lost a short period but kept her data plan intact, and her chair could point to the written determination when her committee asked. The lesson is simple: ask before you collect.
Send your project summary and your institution's template, and get a quote for drafted or edited application text. The price is shown before you pay, and revisions are free for 14 days.
Reviewers look closely at how you will handle identifiable information, because a data breach can harm participants.
If you use patient records, the health privacy rules that apply to your organization may require authorization from patients or a waiver from an IRB or privacy board. Many projects use de-identified or limited data. Speak to your institution's privacy officer early, and get written permission from any site whose data you use.
The IRB must judge whether risks are reasonable in relation to the benefits. Help them by describing both honestly.
For each risk, say how likely it is, how serious it could be and what you will do about it, such as a list of support resources, the option to skip questions or a plan for responding if someone becomes distressed. Describe benefits accurately: often the benefit is knowledge that could help others, not a direct benefit to participants. Additional protections exist for some groups, so ask your IRB about any vulnerable populations you plan to include.
Follow your institution's template. Most ask for the same content, and clarity matters more than length.
| Section | What to write |
|---|---|
| Purpose and background | The question and why it matters, briefly |
| Design and procedures | Step-by-step description of what participants will do |
| Participants and recruitment | Who is eligible, how you will reach them, and how many |
| Consent process | How and when consent is obtained, with the form attached |
| Risks and benefits | Honest description, with minimization steps |
| Privacy and data management | Identifiers, storage, access, retention |
| Materials | Recruitment scripts, surveys, interview guides |
| Approvals and sites | Letters of support and any site requirements |
Keep the application consistent with your proposal. Any difference between the two, such as sample size or data collection method, will prompt questions. Use the methods section guide for describing procedures, and see the research proposal guide for how ethics fits with the whole plan. For guidance on sharing results and protecting participants when you do, see the dissemination plan guide.
| Reviewer question | What a good answer includes |
|---|---|
| Why is this exempt or minimal risk? | The category, and reasons the risk is no more than daily life |
| How will you protect confidentiality? | Coding, separate storage, access limits, and data destruction |
| Is participation truly voluntary? | Who invites, what participants are told and how pressure is avoided |
| What if a participant becomes distressed? | A stop rule, support resources and a plan for follow-up |
| Do you have permission from the site? | A support letter from an authorized person |
| Why do you need identifiable data? | A specific reason, or a change to collect less |
| What will you do with the results? | Where they will be shared and how participants are protected |
Some common student project types raise predictable questions. The table below summarizes what reviewers tend to ask, and it is a preparation aid, not a substitute for your IRB's rules.
| Situation | What reviewers often ask | How to prepare |
|---|---|---|
| Online survey | Is it anonymous? How is data stored? Are IP addresses collected? | State the platform's settings and your storage plan |
| Interviews or focus groups | How are recordings protected? Can others in a group identify participants? | Describe transcription, coding, deletion and group confidentiality limits |
| Chart review or existing records | Is consent or a waiver needed? What identifiers are used? | Justify the data you need, and get privacy office and site approval |
| Recruiting your own students or staff | Could people feel pressured? | Use a neutral recruiter, and separate the study from grades or evaluations |
| Vulnerable participants | What extra protections are in place? | Ask early, and expect a higher level of review |
| Multi-site project | Who reviews? Do sites accept one review? | Ask about reliance arrangements as soon as the sites are known |
Reviewers read many applications. Clear, specific, honest text is faster to approve, and vague text produces questions.
| Section | Weak | Stronger |
|---|---|---|
| Risk | There are no risks. | Risks are minimal. Some questions may cause mild discomfort. Participants may skip any question or stop at any time. |
| Recruitment | Nurses will be asked to participate. | An email from the unit educator, not the researcher, will invite all staff nurses. Participation is voluntary, and the researcher will not know who declined. |
| Data | Data will be kept confidential. | Responses will be coded, the key stored separately, and all files kept on an encrypted institutional drive accessible only to the research team. |
| Benefit | Participants will benefit from the study. | There is no direct benefit to participants. Findings may help improve education for future nurses. |
The stronger versions are examples of the style. Your own text must describe your actual procedures, and your protocol must match it.
Ethics review is a step in your project plan, not an afterthought. Students who plan for it avoid the most common cause of delay.
Keep your approval letter, approved forms and any amendments together in your project file. If plans change, contact the IRB before you act. See the DNP project methodology guide for how ethics fits into a project's methods section.
Often, but not always. The IRB decides. Topic sensitivity and the population can change the level, so submit for a determination.
Anonymous means no one, including the researcher, can link data to a person. Confidential means the researcher can, but promises not to disclose. Do not promise anonymity if you collect identifying details.
It depends on your institution and on whether the project is designed to produce generalizable knowledge. Ask for a determination, and keep it in writing.
It varies by institution and by level of review. Ask your IRB office for typical timelines, and allow time for revisions.
Sometimes. Secondary use may still need review or a determination, especially if the data are identifiable. Check the original consent and your institution's rules.
A clear, honest ethics application usually reflects a well-designed project. It shows that you know who you are asking to take part, what you need from them and how you will protect them. For designing the study itself, see the research proposal guide and the DNP project methodology guide.
To have consent forms, protocols or application text drafted or edited, get your instant quote. The price is shown before you pay. Delivered work comes with 14 days of free revisions, your details are not shared with third parties, and refund terms are on the money-back guarantee page. Your IRB makes all decisions about review, and you should use any support in line with your institution's academic-integrity rules.