The Quality Assurance (QA) component of the Florida Atlantic University Human Research Protection Program (HRPP) evaluates the current practices of the IRB and Florida Atlantic research community against defined standards and best practices of the Office of Human Research Protections (OHRP), FDA, State of Florida, and institutional policy and process. The purpose of this program is to assess research activities conducted under and in accordance with the University’s Federal Wide Assurance Agreement with OHRP.

Visits will occur bi-annually and are intended to be collegial. These visits are an opportunity for researchers to request any help they may need, and to provide feedback on the protocol process. Protocols may selected randomly or for-cause if warranted.

Identifying Projects for Random Review

• Include IRB approved protocols in which subjects have been enrolled or identifiable data have been obtained.
• May include Exempt, Expedited, or Greater than Minimal Risk protocols.
• May include funded projects or unfunded projects.

Identifying Projects for For-Cause Review

• The reviews can be requested by the Florida Atlantic IRB, the Vice President for Research or the University Compliance Officer.
• The reviews are typically implemented due to unusual circumstances, significant risks to subjects, routine failure of an investigator to comply with federal and/or institutional requirements, allegations or concerns about the conduct of the study brought to the IRB’s attention, or any case requiring further scrutiny as deemed appropriate.

Reviewers may ask to see a number of items during the visit. Areas include the following:

• Recruitment & Compensation
• Subject Inclusion and Enrollment
• Informed Consent (Content and Process)
• Data Collection, Storage, Transmittal, Destruction, and Security
• Adverse Events
• Project Personnel (Qualifications and IRB Training)
• Amendments
• Protocol Adherence (Violations/Deviations)
• Other areas as determined by the review

• Know and observe applicable federal regulations, state law and institutional SOPs and/or policies.
• Know and follow the IRB-approved protocol.
• Know the study-related roles and responsibilities of the principal investigator and other research team members. Review the protocol with the research team members, identify and discuss any concerns or questions regarding conduct of the study. Ensure that each research team member has access to the most current documents, including, but not limited to, the informed consent document, protocol, and case report forms.
• Differentiate between the study-related and healthcare provider roles and responsibilities.
• Create and use tools to assist in the compliant conduct of the study (worksheets, data collection forms, logs, checklists, etc.).
• Develop and maintain an effective system for data collection and storage.
• Implement quality assurance measures to ensure your study is conducted in accordance with the IRB approved protocol, institutional policy, and required regulations.

• Principal Investigator Obligations (HRP-400)
• Definitions (HRP-401)
• Documenting Informed Consent (HRP-403)
• Research with Pregnant Women, Fetuses and Neonates (HRP-405)
• Research with Children (HRP-406)
• Research with Prisoners (HRP-407)
• Classroom Research (HRP-408)
• Research with Vulnerable Populations (HRP-409)
• Additional DOD Obligations (HRP-410)
• Additional DOE Obligations (HRP-411)
• Additional DOJ Obligations (HRP-412)
• Additional ED Obligations (HRP-413)
• Additional FDA Obligations (HRP-415)
• Additional ICH-GCP Obligations (HRP-416)

Tools to help researchers navigate the complexities of conducting research. These materials are intended to address any gaps while implementing research.

You can schedule a consultation with an HRPP team member for assistance with your project. We can help you determine if an IRB application needs to be submitted, understand how regulations apply to your project or activity, and answer specific questions about your IRB application. We recommend you have your documents available (protocol, application, consent form, etc.) for sharing. Schedule a consult.

Invite HRPP staff to your meeting, class, or other gathering and we will prepare a presentation specific to your needs. Typically outreach presentations last 60 minutes, including time for question and answer. To schedule an outreach event, email us.

Tools to help researchers manage their protocols as they progress through the research lifecycle. These tools can assist in maintaining compliance and monitoring the conduct of research activities. Use of these tools is encouraged, but not required.

Computer and internet-based research protocols must address the same risks (e.g., violation of privacy, legal risks, and psychosocial stress) and provide the same level of protection as other types of research involving human participants.

All studies, including those using computer and internet technologies, must:

1. Ensure that the procedures fulfill the principles of voluntary participation and informed consent.
2. Maintain the confidentiality of information obtained from or about human participants.
3. Adequately address possible risks to participants.

One-way ads that do not involve direct communication with potential subjects (i.e. paid Facebook Ads), are reviewed according to existing IRB review policies.

• Principal Investigator's contact information.
• Purpose of research.
• Inclusion/exclusion criteria in summary form.
• A brief list of procedures involved.
• Details on how to enroll, including time as well as other required commitments (number of visits, total duration during follow-up visits, etc.).
• Location of research and contact person for further information.

Informed consent is one of the fundamental principles of ethical conduct in human subjects research. It is mandated by Federal regulations 45 CFR 46.116 and 46.117, as well as 21 CFR Subpart B.

Obtaining consent for a research project is a PROCESS and not the act of simply signing a form. Whenever required by federal regulations, informed consent must be obtained and documented. The language of the consent must be designed in a way that will be understood by the age group as well as reading and comprehension level of the target audience.

Usually, consent is documented when the research participant signs a form. Other mechanisms include audio- or videotaping the subject's agreement to participate. However, this is often difficult in internet-based/online research.

Under certain circumstances, for low risk studies, the requirement to document (obtain signatures or record the consent process) informed consent for online research activities can be altered or waived. See Florida Atlantic IRB Policy ¹⁰

People under the age of 18 cannot legally consent to participate in a research study. However, researchers recruiting from the internet cannot know the exact age of respondents. For this reason, it is best to limit online research studies to minimal risk research that would typically qualify for a waiver of parental consent under federal regulations (See section IV of Florida Atlantic IRB policy "Children in Research") ¹¹ unless you are able to authenticate the identity and age of your respondents through reliable means.

For internet research involving confidential and sensitive information, researchers must obtain written consent (on-line or hard copy) and within the studies procedure, include the proper methodology to verify the identity and age of the participant as well as to assure the security of the data.

When anyone who has access to the internet is a potential research subject, it may be difficult to ensure that he/she understands the consent information. One method of enhancing comprehension includes incorporating short questionnaires within the consent process to assess understanding of the information presented, and direct the subjects to additional explanatory material. Another method is to design and implement an interactive consent process tailored to the potential subjects' characteristics or primary language.

The principle of respect for persons requires that subjects be allowed to withdraw from a research study without negative consequences. Online survey instruments must explain at the outset what options are available, if any, for retrieving and discarding responses, and for some studies, it may be appropriate to provide a "no response" option for questions subjects may consider to be sensitive or intrusive.

The internet provides unique opportunities for conducting observational research in "private" settings. For example, a researcher can join a closed group (e.g. a "members only" chat room devoted to a mutual topic of interest) with relative ease to observe interactions among the members while concealing his/her identity. Such research can only be approved if the IRB determines that the deception is justified. Any research involving deception should have a plan for debriefing subjects, so they may learn about the research that occurred and have the opportunity to withdraw use of their data if they choose.

Research involving the collection of data about people from medical records, through social media or networking sites involves the same considerations as any other research with human participants.

These considerations include:

• Determining an appropriate and effective informed consent process;
• Assuring that participation is voluntary;
• Protecting privacy and confidentiality of individuals and the data collected;
• Minimizing risks and maximizing benefits; and
• Assuring equitable selection of participants.

However, with the dynamic and evolving nature of norms and technologies in social media use, translating these principles into real practice can be challenging.

On-line research id different geographical areas adds an additional level of complexity (researcher located in one area, participants in another (or multiple locations) and the data is stored in another location.

Researchers should take steps to authenticate online research participants.

Using bot prevention tools and tactics will help ensure rigor in data collection. This includes actions such as:

• Including two or three open-ended questions in the study and require responses to them. Monitor these questions for unusual responses or identical responses across “participants.”
• Track timestamps.
• Flag impossible dates and times, bundles of participants beginning and completing the survey at the same time, and respondents who completed the survey impossibly fast.
• Use a completely automated, public Turing test to tell computers and humans apart (CAPTCHA).
• Make it personal: Consider including a public link to screen potential participants for eligibility, with ballot-stuffing protections in place. Those who meet eligibility requirements can then be sent a unique link to the survey that can be used only once.
• Include at least one hidden item: This can be accomplished by adding the @HIDDEN action tag to an item in REDCap or by adding custom JavaScript code to an item in Qualtrics
• Add redundancy: Ask the same question — “What is your age?” is a good example — at two separate points and check for differences in responses.
• Add honeypot questions: These are embedded in a survey but are coded in a way that prevents human participants — but not bots— from viewing and responding to them.

Florida Atlantic Researchers should seek expert IT review when purchasing a mobile app or building their own app for collection of data from research participants. If the app is commercially available, Florida Atlantic central university purchasing needs to be part of the process to assure legal and data security review occurs. It is the researcher's responsibility to understand known or potential risks of any downloaded app, whether free or at a cost and disclose those risks to study participants. App downloads frequently collect data stored or linked on the phone on which the app is installed. Researchers must clearly delineate such risks to participants. The "terms of service" of commercially available apps must be understood by the researcher utilizing the app and communicated to the study participants.

All surveys conducted at Florida Atlantic should preferably be conducted using Qualtrics or REDCap. If researchers are interested in using other survey software OIT should review the software data security and purchasing process to assure they are following the appropriate university channels.

The Florida Atlantic - HIPAA website provides information and guidance on the policies, procedures and forms related to HIPAA compliance at Florida Atlantic: www.fau.edu/hipaa/

Encryption: strongly recommended for PHI data.

Florida Atlantic has established a MRI research center featuring a GE 3T Premier MRI scanner on the Boca Raton campus. Researchers at FAU can access the scanner following approval from the IRB and the FAU MRI Committee, in accordance with the established FAU MRI scanner utilization policy.

About ResearchMatch

ResearchMatch allows researchers to search for de-identified volunteers who have registered themselves as being interested in participating in research. The researcher creates a cohort of people that meet selected key inclusion and exclusion criteria for the study by using the filters on ResearchMatch and then sends their IRB approved message to potential volunteers via ResearchMatch.

Interested participants create a "profile" with their basic health information. This allows researchers to search for potential participants that meet certain criteria. The potential participant can be sent the IRB message about the study and can then choose whether to provide their contact information to the researcher. This is an excellent resource for researchers looking to identify potential participants outside of usual-care settings.

The researcher finds the contact information of those interested individuals on their ResearchMatch dashboard and can then contact them directly.

• Register for ResearchMatch here
• Need help? Free training for researchers occurs every 2nd Thursday of the month. You may also use this guide.
• Using ResearchMatch requires IRB approval. Please use the appropriate language in your application when requesting to use ResearchMatch.
• Here are some contact message examples.
• We recommend you use a REDCap survey/screening survey to recruit participants.

• Federal Regulations for the Protection of Human Subjects
  • 45CFR46 (Office for Human Research Protections)
  • 21CFR50 (Food and Drug Administration)
• The Belmont Report
• Using an E-Consent
• Phase 0 and Phase I Investigator Initiated Projects
• Conducting Research Online
• Florida Atlantic Campus Surveys
• Florida Atlantic RedCap
• Florida Atlantic BHRIC
• Research at Palm Beach County Schools
• Research at Broward County Schools
• External Researchers Recruiting at Florida Atlantic

• National Science Foundation Data Management
• National Institutes of Health Data Management and Sharing Policy
• Office for Human Research Protections (Various Topics)

All of Us Research Program

The National Institutes of Health’s (NIH) All of Us Research Program provides health data from diverse U.S. research participants. FAU researchers can access every tier of the All of Us Research Program including the "Controlled Tier," which includes genomic data.

For a description of the tiers, to access the data, register with the All of Us Researcher Workbench with a Florida Atlantic email address, visit All of Us.