What Is a 'Not Human Subjects Research' Determination and When Do You Need One?

Most researchers think there are two buckets: your project either needs IRB approval or it qualifies as exempt. But there's a third possibility that comes up more often than people realize. Your project might not be human subjects research at all. When that's the case, what you want is a "not human subjects research" determination, usually shortened to NHSR. This post covers what NHSR means, when it applies, and why you may want to get one.

The two-part test

Under 45 CFR 46.102, two conditions must both be true for a project to count as human subjects research:

1. It has to be "research." The Common Rule defines research as a systematic investigation designed to develop or contribute to generalizable knowledge. If your project isn't aimed at producing findings that extend beyond your specific context (internal process audits, operational reviews, institutional quality checks), it may not meet this threshold.

2. It has to involve "human subjects." A human subject is a living individual about whom you obtain data through intervention or interaction, or about whom you obtain identifiable private information or biospecimens. Both pieces matter: the person has to be living, and the information has to be identifiable to them (or you have to be interacting with them directly).

If either condition isn't met, the activity falls outside the Common Rule. No IRB review required under 45 CFR 46. That's an NHSR determination.

Common scenarios that result in NHSR

A few patterns come up regularly.

Quality improvement projects. A hospital evaluating whether a new discharge workflow reduces readmission rates, purely for internal improvement with no plans to publish or generalize, will often qualify. The question is intent: is this designed to produce generalizable knowledge, or to improve a specific process at a specific institution?

Case reports and case series. Describing a single patient's clinical course for educational purposes, without systematic investigation, typically isn't research under the Common Rule definition.

Secondary analysis of fully de-identified data. If you're working with a dataset already stripped of all 18 HIPAA identifiers (or certified as de-identified by a qualified expert) and you have no access to a key that could link records back to individuals, there are no "human subjects" in the regulatory sense. The second prong of the test isn't met.

Public health surveillance and program evaluation. Certain public health activities conducted by or on behalf of public health authorities fall outside the research definition, though it depends on how the activity is scoped.

NHSR vs. exempt: these are not the same thing

People confuse these constantly. An exempt determination means your project is human subjects research, but it falls into one of the categories under 45 CFR 46.104(d) where the risks are low enough that the full requirements of the Common Rule don't apply. An NHSR determination means your project isn't human subjects research in the first place. It doesn't reach the exempt analysis because it doesn't meet the threshold definitions.

In practice: exempt studies still need an IRB to confirm the exemption. NHSR activities don't, strictly speaking, require IRB involvement at all. But just because you don't need an IRB to weigh in doesn't mean you shouldn't get one to.

Why you still want it in writing

Even when you're personally convinced your project is NHSR, there are good reasons to get a formal determination letter from an IRB.

The most common one: journals. Most peer-reviewed journals require documentation of ethical oversight. If you submit a manuscript without an IRB determination letter, even an NHSR letter, editors will send it back. Having the letter ready before you write the paper saves weeks of delay.

Collaborators may care too. If you're working with a hospital, university, or health system, their compliance offices will want written documentation that someone independent evaluated your project's regulatory status. Your own assessment won't cut it.

Then there's scope creep. A QI initiative that starts as purely internal might later look publishable. A dataset you believed was fully de-identified might turn out to have indirect identifiers you hadn't considered. A formal NHSR determination creates a clear record of what was evaluated and when.

If you're wondering whether your project needs IRB approval and you're leaning toward "no," the determination letter is your documentation that you thought it through properly.

How an IRB issues an NHSR determination

You submit a description of your project: what you're doing, what data you're using, how it was collected, what you plan to do with the results. The IRB reviews it against the 45 CFR 46.102 definitions and either confirms NHSR or tells you it does qualify as human subjects research (in which case you'd proceed to an exempt or non-exempt review). Either way, you get a letter documenting the outcome.

Mistakes that catch people off guard

Assuming QI is always NHSR. It often is, but not always. QI that is designed to produce generalizable knowledge, or that uses a research design to test a hypothesis, can cross the line into research. If you're running a controlled comparison, randomizing patients, or planning from the start to publish the findings, an IRB reviewer may conclude your QI project is actually research. What matters is intent and design, not the label.

Assuming de-identified data is always NHSR. This one has a wrinkle. If someone else de-identified the dataset before you received it and you have no way to re-identify individuals, you're likely in NHSR territory. But if you had access to identified data and performed the de-identification yourself, or if you hold a key that links codes back to identifiers, the data is still identifiable private information in your hands. Human subjects are involved, and you're back in research-regulation territory. The question isn't whether the data looks de-identified. It's whether you could link it back.

Getting an NHSR determination from Tempus IRB

Tempus IRB handles NHSR determinations as part of our exempt review process. You submit your project description, we evaluate it against the regulatory definitions, and you get a determination letter. Flat fee of $1,300, typically turned around within a day. If it turns out your project does meet the definition of human subjects research, we'll let you know and walk you through the appropriate review pathway. Sign up to submit, or email us if you want to talk it through first.

This post is for informational purposes only and does not constitute legal advice.