Under the Common Rule (45 CFR 46.104), a project qualifies as "exempt" only if it fits one or more specific exemption categories. Exemption does not mean the project is free of rules. It means the activity is low risk and excused from full board review, provided it still satisfies that category's own conditions. The next step is straightforward: submit an exempt determination request to your IRB or human research protections program (HRPP) rather than deciding on your own.
TL;DR:
- Most exempt projects involve low risk but still require a formal submission to IRB or HRPP for determination, not self-assessment by investigators.
- Exemption categories 2 and 3 focus on minimal risk public behavior studies and benign behavioral interventions, often triggering limited IRB review if sensitive identifiable data is involved.
- Projects involving prisoners, deception, or identifiable biospecimens without broad consent usually do not qualify for exemptions and require full or expedited review.
- The critical factor is mapping the data flow and identifying who holds the re-identification key, as this often determines exemption eligibility more than the study design itself.
- Proper documentation of privacy protections and deidentification methods is essential, especially for categories 4 and limited IRB review, to avoid delays and ensure defensibility.
Table of Contents
- What Are the Human Subjects Research Exemption Categories?
- Is This Even Human Subjects Research?
- When Does Limited IRB Review Apply to Exempt Projects?
- Do Exemptions Apply to Children or Prisoners?
- Who Should Determine Whether Research Is Exempt?
- What Should Healthtech Teams Watch for Before Filing?
- Where the Conventional Advice Gets This Wrong
- How The StartupMD Supports Exemption Readiness
- Sources
- FAQ
What Are the Human Subjects Research Exemption Categories?
The 2018 Common Rule lists eight exemption categories, and institutions can choose to limit which ones they'll accept. Categories 1 through 4 cover the bulk of what most research offices see, according to OHRP guidance.
- Exemption 1 covers research in established educational settings involving normal educational practices, such as comparing two teaching methods.
- Exemption 2 applies to educational tests, surveys, interviews, and observation of public behavior, provided the data is either not identifiable or disclosure poses minimal risk.
- Exemption 3 covers benign behavioral interventions paired with data collection through surveys or interviews, common in usability testing and patient experience research.
- Exemption 4 governs secondary use of identifiable private information or biospecimens already collected, including scenarios where data is public, recorded in a deidentified form, or handled by a HIPAA-covered entity under specific subcategories.
- Exemptions 5 through 8 are narrower: federal demonstration or public benefit program evaluations, certain taste and food quality studies, and broad-consent storage or secondary use of biospecimens.
Healthcare SaaS companies running product analytics or patient engagement studies typically land in 2, 3, or 4. Categories 2(iii) and 3(C) carry a wrinkle worth flagging early: when the data involves identifiers and sensitive information, the NIH IRB guidance notes these trigger a limited IRB review focused specifically on privacy and confidentiality, not a full board sign off.
Is This Even Human Subjects Research?
Before you hunt for an exemption category, confirm the project is research at all. The Common Rule defines research as a systematic investigation designed to develop or contribute to generalizable knowledge, and it defines a human subject as a living individual from whom data is obtained through intervention, interaction, or identifiable private information. Quality improvement and program evaluation projects often fail that first test entirely, meaning they need no IRB involvement rather than an exemption, according to guidance distinguishing QI from research.
Use these four axes to sort a project:
- Intent to generalize. Are you trying to fix your own clinic's workflow, or are you trying to produce findings meant for publication and broader application?
- Methods. Standardized measurement, control groups, and hypothesis testing point toward research; ad hoc process tracking points toward QI.
- Interaction or intervention. Any direct contact with participants beyond normal operations raises the stakes.
- Identifiability. Data tied to a person, even indirectly through a device ID or timestamp pattern, changes the analysis.
A hospital adjusting its discharge checklist and tracking readmissions internally is likely QI, according to a peer reviewed analysis of QI versus human subjects research. A healthtech company running the same intervention across five partner hospitals with the intent to publish a generalizable efficacy claim probably is not. When the answer sits anywhere near the middle, submit a determination request rather than guess. Include your protocol, the data elements collected, and your stated purpose.
When Does Limited IRB Review Apply to Exempt Projects?
Some exempt categories still require what the regulations call limited IRB review, a narrower check that looks only at whether privacy and confidentiality protections are adequate under §46.111(a)(7). This applies most often to Exemption 2(iii) and Exemption 3(C), where sensitive identifiable data is involved but full board review isn't warranted.
Exemption 4 deserves particular attention for healthtech teams working with clinical data. It permits secondary research use of identifiable private information or biospecimens when the data is publicly available, recorded by the investigator in deidentified form, or held by a HIPAA-covered entity under one of several narrow subcategories described in the regulatory text. HIPAA and the Common Rule operate on separate tracks, but when your data source is a covered entity, both frameworks apply simultaneously.
Documentation that strengthens a Category 4 or limited-review submission includes:
- A description of the deidentification method applied to the dataset
- Who holds access to any re-identification key, and under what controls
- Whether the data use falls under broad consent already obtained
- A data flow diagram showing every party that touches the information before it reaches your research team
Pro Tip: Write your privacy plan before you write the rest of the protocol. If you can't clearly state who holds the re-identification key, your IRB office will ask, and that question alone can add weeks to a review. Guidance on HIPAA deidentification methods covers the technical standards in more detail.
Do Exemptions Apply to Children or Prisoners?
Several categories carry population restrictions that surprise first-time applicants. Exemptions are limited or unavailable for research involving prisoners, and Subpart D narrows which categories apply to children, according to HHS guidance on exemption categories.
- Prisoners fall under Subpart C protections that override most standard exemptions, regardless of how low risk the study appears.
- Children can qualify under Exemptions 1 and 4 in some cases, but Exemption 2 survey and interview research generally excludes them.
- NIH investigators face additional agency-specific limits on which exemption categories they may use at all, separate from what an individual institution permits.
- Deception of participants, even mild, and storage of identifiable biospecimens without documented broad consent both commonly disqualify a project from exemption.
Always verify Subparts B and C applicability before assuming a project involving a protected population is exempt.
Who Should Determine Whether Research Is Exempt?
The single biggest governance risk in this area is letting investigators decide their own exemption status. OHRP guidance specifically warns against self-determination because of the conflict of interest it creates: the person most motivated to skip full review is also the one deciding whether they can.
- Assign determination authority to trained IRB office staff or designated IRB members, not to the investigators running the study.
- Require a written checklist covering the exemption category claimed, population involved, data identifiability, and privacy protections in place.
- File the determination using your institution's template. NIH and most university HRPPs publish exempt determination templates that structure the request and speed review.
- Retain records of the determination and its rationale for as long as your institutional policy requires, typically matching your standard research record retention period.
What Should Healthtech Teams Watch for Before Filing?
Vendor-collected telemetry and patient engagement app data create re-identification risk that many founders underestimate. Before submitting, map exactly who holds identifiers, confirm PHI status, plan a deidentification approach, and flag whether limited IRB review applies. If that mapping gets complicated, bringing in a fractional CMO or regulatory advisor early tends to save far more time than it costs.
Where the Conventional Advice Gets This Wrong
Most explainers on this topic treat exemption categories like a checklist exercise: match your study design to a number, file the paperwork, move on. That framing misses the part that actually causes delays and audit findings in healthtech specifically, which is the data supply chain behind the study, not the study design itself.
A behavioral intervention study with a survey component looks straightforward on paper. It becomes complicated the moment your patient engagement platform, your analytics vendor, and your EHR integration each hold a different piece of the identifiability puzzle. Category 4 eligibility, and whether limited IRB review kicks in at all, hinges on questions institutional templates rarely ask directly: who holds the re-identification key, and can your research team technically reach it even if policy says they shouldn't?
My view, after watching healthcare SaaS teams navigate this repeatedly, is that the exemption category should be the second question, not the first. The first question is always the data flow map. Get that right, and the category usually falls out naturally. Get it wrong, and no amount of correctly filed paperwork will save the determination from being challenged later.
— Paul Bergeron MD, MBA
How The StartupMD Supports Exemption Readiness
The StartupMD is the alternative to guessing your way through an exemption request or hiring a generalist compliance consultant who has never sat on a clinical study team. Every determination we support draws on clinical and startup experience rather than generic compliance templates.
For healthcare SaaS companies and digital health startups, exemption determinations rarely fail because of the wrong category. They fail because nobody mapped the data flow, documented the deidentification method, or flagged a HIPAA-covered vendor before the IRB asked. That is exactly where Fractional Chief Medical Officer and Advisory Services engagements from The StartupMD add the most value: faster, more defensible determinations with documentation that holds up if a reviewer or auditor asks follow-up questions later.
If your team is preparing an exemption request, evaluating a new clinical data partnership, or simply unsure whether your current study design needs full board review, visit our services page to start a conversation about what a fractional regulatory advisor can review before you file.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Exempt research determination (OHRP guidance)
- 45 CFR §46.104 - Exempt research (e-CFR / LII)
- Exempt Research (NIH IRB guidance)
FAQ
What Qualifies as Human Subjects Research?
A project qualifies when it's a systematic investigation intended to develop generalizable knowledge and it involves a living person through intervention, interaction, or identifiable private information. If either half of that definition is missing, such as a purely internal quality improvement effort with no publication intent, it typically isn't human subjects research at all, according to IRB guidance distinguishing research from QI.
What Are Some Examples of IRB-Exempt Research?
Common examples include anonymous surveys about workplace satisfaction, educational studies comparing two teaching approaches in a normal classroom, and secondary analysis of a deidentified patient dataset already collected for other purposes. Most fall under Exemptions 1 through 4, which NIH describes as the most commonly applicable categories.
What Is Nonexempt Human Subjects Research?
Nonexempt research involves human subjects but doesn't meet any exemption category's specific criteria, often because it carries more than minimal risk, involves a vulnerable population like prisoners, or uses deception without adequate safeguards. These projects require full or expedited IRB review rather than an exempt determination.
What Is Exempt From an IRB Review?
Nothing is fully exempt from institutional oversight. Even exempt projects require someone with designated authority, usually IRB office staff rather than the investigator, to formally confirm the exemption applies and to document that determination in writing, as OHRP guidance makes clear.