Lesson 7 · IRB and HRPP Administration: From Coordinator to CIP

7. DOD, DOJ, NIH, VA, and EPA: How Agencies Layer the Common Rule

55 min

After this lesson you can

  • Explain how Common Rule agencies codify Subpart A and add their own requirements
  • Describe Department of Defense additional protections for research involving service members
  • Describe Department of Justice and Bureau of Prisons requirements for research with prisoners
  • Describe NIH-specific policies: Certificates of Confidentiality, single IRB, training, genomic data sharing, and the clinical trial definition
  • Describe Department of Education, Veterans Affairs, and EPA variations

Video coming soon

Scheduled for release on September 21, 2026.

DOD, DOJ, NIH, VA, and EPA: How Agencies Layer the Common Rule shows how a single protocol can face different requirements depending on who funds it. The base rule is the same, but each agency adds its own layer, and the CIP exam expects you to know them.

5 Key Facts from This Lesson

  1. The Department of Defense codifies the Common Rule at 32 CFR 219 and requires a research monitor for research involving greater than minimal risk.
  2. The Department of Justice adopts only Subpart A at 28 CFR 46, and research in the Federal Bureau of Prisons is governed by 28 CFR 512, not 45 CFR 46 Subpart C.
  3. Certificates of Confidentiality have been issued automatically for NIH-funded research that collects identifiable sensitive information since October 2017.
  4. The Department of Education layers FERPA, a records rule, and PPRA, a parental consent rule for surveys on eight protected topics, on top of 34 CFR 97.
  5. EPA's regulation at 40 CFR 26 prohibits research involving intentional exposure of pregnant women, nursing women, and children.

Exam traps

The distinctions exam questions on this topic are most often built to test. Know them cold.

  • DOJ adopts Subpart A only; federal prison research protections come from 28 CFR 512, not 45 CFR 46 Subpart C

  • The NIH single IRB policy of 2018 and the Common Rule requirement at 46.114 of 2020 are different instruments with different scopes

  • Certificates of Confidentiality are automatic for NIH-funded research since October 2017; others may still apply

  • 10 U.S.C. 980 is a statute; an IRB cannot waive consent under it

  • PPRA is a parental consent rule about surveys; FERPA is a records rule; both belong to Education

Practice quiz

  1. Question 1
    Which statute requires advance informed consent for DOD-funded research with only a narrow Secretary of Defense waiver?
  2. Question 2
    Research conducted within the Federal Bureau of Prisons is governed by:
  3. Question 3
    NIH Certificates of Confidentiality became automatic for NIH-funded research collecting identifiable sensitive information effective:
  4. Question 4
    Under DoD Instruction 3216.02, research involving greater than minimal risk requires:
  5. Question 5
    The Protection of Pupil Rights Amendment primarily requires:

Recap

  • Codification: each signatory publishes Subpart A in its own CFR title and adds layers by regulation, instruction, or terms of award
  • DOD: 32 CFR 219, DoDI 3216.02, 10 U.S.C. 980, the research monitor, command influence protections
  • DOJ: 28 CFR 46 Subpart A only; 28 CFR 512 for federal prisons with no incentives
  • NIH: Certificates of Confidentiality, single IRB policy, education and GCP training, clinical trial definition, genomic and data sharing, inclusion, data and safety monitoring
  • Education, VA, EPA: PPRA and FERPA; VHA Directive 1200.05 and the Research and Development Committee; intentional exposure prohibitions and the Human Studies Review Board

Coming next

Lesson 8 begins Domain 2 with IRB membership, quorum, and authority.

Saved in your browser only: no account, no server.

This course is for educational purposes only and is not legal, regulatory, or compliance advice. Regulations and guidance change, so confirm every requirement against the current eCFR text, OHRP and FDA guidance, and your institution's IRB policies before relying on it. CIP® is a registered certification mark of Public Responsibility in Medicine and Research (PRIM&R). This course is produced independently by Subthesis and is not affiliated with, endorsed by, or reviewed by PRIM&R or the CIP Council. The instructor is not a Certified IRB Professional. Completing this course does not confer CIP certification, satisfy CIP eligibility requirements, or count as CIP recertification continuing education.