Human Subjects Research and Institutional Review Board (IRB)

Approval by the IRB is required by regulation before research with participants can take place. This is research that involves interacting with participants or with their identifiable data and/or specimens. Interaction with participant can also include remote and/or virtual interactions (e.g. online survey research). Depending on the risk level, research with participants may fall under three different categories: Exempt Review, Expedited Review, or Full Committee review.

Study participants are partners in the research process. The UofL IRB is charged with reviewing research studies to ensure the rights, safety, and welfare of research participants are protected. Federal regulations define the requirements that must be met for IRBs to approve research with participants.

Getting Started

Information for navigating each step of the IRB process can be found in the menu links on this page. The HSPPO also has created document templates, guidance materials and other tools to assist researchers in developing a study protocol, submitting to the IRB for approval, and running a compliant research study.

For additional assistance finding information on this website or accessing iRIS, you may email our office or chat with an IRB staff member.

Before submitting to the IRB there are steps to take to establish a profile in iRIS and to complete required Human Subjects & HIPAA Research training. iRIS is the IRB electronic submission system. Anyone working on a study who meets the definition of "key personnel" must be added to the research team in iRIS before they can begin working on the research.

Key personnel are research personnel who are directly involved in conducting the research with human participants through an interaction or intervention for research purposes, including participating in the consent process by either leading it or contributing to it; OR who are directly involved with recording or processing identifiable private information, including protected health information, related to those participants for the purpose of conducting the research study

iRIS profile:

All research personnel must:

  • Upload a CV in the iRIS system.
  • Complete the required annual Attestation and Disclosure Form in the iRIS system.
  • Complete the required combined Human Subjects and HIPAA Research basic course through the CITI website.

Login to iRIS using an ULINK/Outlook user name and password:

To complete a profile in the iRIS system:
1. Upload your CV

2. Complete the “Attestation and Disclosure Form”.

CITI Human Subjects/HIPAA Training:

Individuals are required to take "Human Subjects and HIPAA Research" training before they can be added to a study team. The Human Subjects training course is combined with the HIPAA-Research course. The University of Louisville has chosen to utilize the CITI Program training modules. The certification period, upon successful training completion is 4 years.

The basic course has 5 required modules and 5 electives. Total of 10 courses with passing score of 75%.

The refresher course has 1 required module and 7 electives. Total of 8 courses with passing score of 75%.

If you are a VA researcher and have taken the VA human subjects training, you must complete the HIPAA Privacy -VA Researchers - Basic Course. Completion of the course is required if you will submit any projects for IRB review.

    Course Website:

    Course Registration: Video Tutorial

    Register for CITI or update your account

    If you need assistance, please consult our guides to registering and troubleshooting with the CITI program.

    Checking CV/Training:

    All research team members are required to have a CV in iRIS and current CITI Human Subjects & HIPAA training. To verify if your research team is in compliance, login to use the Power BI reports.The IRB will not issue initial approval, continuation approval, or approve the addition of personnel if these items are not completed.

    If your submission was stopped in iRIS for "training validation," proof of training for the personnel in question must be submitted to the iRIS Service Desk at: Below the search box, you will find "training update needed". Click on this icon and complete the form. Submissions will not be routed to the IRB until the training has been updated in the iRIS system.

    Non-University of Louisville Research Team Members:

    UofL Sponsored IT accounts can be requested for specific external individuals who need access to the iRIS system to conduct research activities reviewed by the UofL Institutional Review Board (IRB). Sponsorship is obtained through submitting a UofL IT Sponsored Account Request Form linked below. All requests will be reviewed by HSPP staff to ensure that there is a valid need for the account.

    Please review the HSPPO UofL Sponsored IT Account Guidelines and complete the request form as indicated.

    Please also note, the sponsored IT account does not give permission to work on a research project. If you are external to UofL, additional requirements may apply to be added to a UofL research team.

    Find your IRB Analyst:

    Each submission is assigned to a specific IRB Analyst. The IRB Analysts are the first members of the IRB team to review your study upon submission. They are a great resource to reach out to at any time for questions or training.


    If you plan to conduct research outside of the United States, even by remote means (e.g. electronic survey, Teams interviews, etc.), the foreign country’s research and data privacy laws may apply. Researchers must be aware of the rules, laws, and regulations in the countries where they plan to conduct research. University of Louisville’s legal/privacy team will review these projects to ensure the university and the research can comply with the country specific requirements. It's important to plan ahead and reach out to the HSPPO as soon as possible. The additional reviews will add to the processing timeline.

    Tips for your IRB submission:

    • Review Chapter 13.4 for the HSPPO Policy Manual;
    • Have knowledge of the rules that apply to protected data collected in the countries the research will take place in;
    • Include information in the local research protocol and IRB application outlining how the countries specific requirements will be met. In addition, include information on how the data will be stored and encrypted; and
    • Include a statement the informed consent document(s) (including unsigned consents) informing participants that their data will be shared outside of the country.

    The University of Louisville IRB reviews projects led by students. Students consists of those in undergraduate, graduate, post-doctorate, fellowships, and resident programs. The UofL IRB requires student led research to go through the same review process as any other research project at the University that involves participants. Student led research must be overseen by someone with a UofL faculty or staff appointment. This person must serve as the principal investigator (PI). The student may serve as a co-investigator or sub-investigator. It is the PI’s responsibility to ensure that applicable research policies, processes, and regulations are being followed. The PI is also responsible for issuing sign off of the research plan. After the PI signs off on the initial IRB submission, the student can submit to the IRB and respond to any questions or changes that the IRB may have. The IRB uses an electronic submission system called iRIS.