45 CFR 46.101(b) Exempt Research: Eight Categories at 46.104(d)

The exempt research categories that used to sit at 45 CFR 46.101(b) were relocated on January 21, 2019, when the revised Common Rule took effect. They now live at 45 CFR 46.104(d), and the old subsection is marked “[Reserved]” in the Code of Federal Regulations. The exemptions were not eliminated. They were reorganized, expanded from six categories to eight, and tied to two new mechanisms: limited IRB review and broad consent. If you found a reference to 45 CFR 46.101(b) exempt research and are trying to figure out the current rule, everything you need is at 46.104.¹²

What Changed in the Move From 46.101(b) to 46.104

Before 2019, the Common Rule’s exemptions for low-risk human subjects research lived at 45 CFR 46.101(b)(1) through (b)(6). The revised Common Rule, published in 2017 and effective January 21, 2019, pulled those exemptions out into a standalone section and rewrote several of them.³

Three structural shifts matter. The list grew from six categories to eight. A brand-new category for benign behavioral interventions was added, along with two categories built around broad consent for the storage and secondary research use of identifiable private information and biospecimens. And a new review pathway called limited IRB review was created so that certain studies involving identifiable data could stay exempt while receiving targeted oversight for privacy and confidentiality.

The Eight Current Exempt Categories at 46.104(d)

An exemption applies only when the entire study qualifies. If a project mixes exempt and non-exempt activities, the whole thing goes through standard IRB review.²

Category 1: Normal Educational Practices

Research in established or commonly accepted educational settings that studies normal educational practices, such as instructional strategies or comparisons among teaching techniques or curricula.² The revised rule added a condition: the research must not be likely to adversely affect students’ opportunity to learn required content or the assessment of educators who provide instruction.⁴ Educational setting is read broadly to include public schools, after-school programs, professional development seminars, and postsecondary institutions.⁵

Category 2: Surveys, Interviews, Educational Tests, and Observation of Public Behavior

Research involving educational tests, survey procedures, interview procedures, or observation of public behavior is exempt under one of three conditions: subjects cannot readily be identified from the recorded information; disclosure outside the research would not reasonably place subjects at risk of criminal or civil liability or harm to their finances, employability, or reputation; or an IRB conducts a limited review and finds adequate privacy and confidentiality protections.² The revised rule broadened this category so identifiable information, including sensitive data, may be recorded provided limited IRB review occurs.⁴

Category 3: Benign Behavioral Interventions

New in the 2018 revision. This category covers research involving benign behavioral interventions with adult subjects who prospectively agree to participate. The interventions must be brief, harmless, painless, not physically invasive, and not likely to have a significant adverse lasting impact, and the investigator must have no reason to think subjects will find them offensive or embarrassing. Data is gathered through verbal or written responses or audiovisual recording.⁶⁴⁷

Category 4: Secondary Research Using Identifiable Data or Biospecimens

Secondary research using identifiable private information or identifiable biospecimens is exempt when at least one of four conditions is met: the materials are publicly available; information is recorded so identities cannot readily be ascertained, the investigator does not contact subjects, and no re-identification is planned; the research uses identifiable health information regulated under HIPAA for health care operations, research, or public health activities; or the research is conducted by or on behalf of a federal department or agency using government-generated or government-collected information, subject to applicable privacy laws.² Before 2019, this exemption covered only existing data and specimens. The revision expanded it to include prospective collection.⁴

Category 5: Public Benefit or Service Program Research

Research and demonstration projects conducted or supported by a federal department or agency and designed to study or evaluate public benefit or service programs. The revised rule added a requirement that these projects be published on a federal website.⁴

Category 6: Taste and Food Quality Studies

Taste and food quality evaluations and consumer acceptance studies, if the food is either wholesome and additive-free, or contains food ingredients, agricultural chemicals, or environmental contaminants at or below levels determined safe by the FDA, EPA, or USDA’s Food Safety and Inspection Service.² This category carried over from the pre-2018 rule essentially unchanged.

Category 7: Storage or Maintenance for Secondary Research

New in 2018. The storage or maintenance of identifiable private information or biospecimens for potential secondary research is exempt when broad consent has been obtained and an IRB conducts a limited review. The IRB confirms that broad consent was properly obtained and documented and that adequate privacy and confidentiality protections are in place.²

Category 8: Secondary Research Use With Broad Consent

Also new in 2018. Secondary research use of identifiable private information or biospecimens is exempt when broad consent has been obtained and documented, an IRB conducts limited review, the IRB determines the research falls within the scope of the broad consent, and the investigator does not plan to return individual results to subjects as part of the study.²

What Limited IRB Review Actually Is

Limited IRB review is a streamlined oversight mechanism that applies to specific provisions within categories 2, 3, 7, and 8. Unlike full board or expedited review, its focus is narrow: an IRB chair or qualified designee evaluates whether there are adequate provisions to protect subjects’ privacy and maintain data confidentiality.⁸ For categories 7 and 8, the IRB also verifies that broad consent was properly obtained and documented.⁹

Research involving identifiable data can remain exempt rather than being pushed into full committee review, so long as those targeted privacy protections are confirmed. Limited IRB review does not require continuing review, does not require posting of consent forms, and does not trigger the reporting requirements associated with standard IRB-approved studies.¹⁰ Because the regulation offers little detail on what specific safeguards reviewers should look for, implementation varies across institutions, and some IRBs report difficulty distinguishing when limited review is sufficient versus when expedited review fits better.⁷

Broad Consent and When It Applies

Categories 7 and 8 depend on broad consent, authorized at 45 CFR 46.116(d). Traditional informed consent is study-specific; broad consent lets subjects agree in advance to the future storage and secondary use of their identifiable information or biospecimens across a range of research types. Broad consent is optional. Investigators may still use study-specific consent or request an IRB waiver, and broad consent is limited to secondary research; it cannot be used for primary interventions or interactions with subjects.¹¹

A broad consent form must include a general description of the kinds of secondary research that may be conducted, the types of information or specimens involved, whether materials may be shared, the duration of storage (which can be indefinite), and a disclosure that subjects may not be told about specific future studies. No federal template exists. If a subject is asked for broad consent and declines, an IRB cannot later waive consent for that individual’s data. That provision has led some institutions to hold back. The University of Wisconsin–Madison, for example, opted not to implement broad consent or categories 7 and 8, citing unclear definitions and burdensome tracking requirements.¹²

How the Exemptions Apply to Vulnerable Populations

The exempt categories do not apply uniformly. Section 46.104(b) sets out the rules for research subject to the Common Rule’s additional protections for specific groups.²

Pregnant women, fetuses, and neonates (Subpart B): all eight categories are available if their conditions are met.
Prisoners (Subpart C): exemptions generally do not apply, with one narrow exception for research aimed at a broader subject population that only incidentally includes prisoners.
Children (Subpart D): categories 1, 4, 5, 6, 7, and 8 are available if their conditions are met. Category 2 applies only to educational tests or observation of public behavior where the investigator does not participate in the observed activities. The limited-IRB-review path within category 2 may not be used for research involving children at all.

An October 2024 HHS final rule updated Subparts B, C, and D to align their language with the 2018 revisions, correcting cross-references and clarifying when pre-2018 and 2018 requirements apply.¹³

Who Decides a Study Is Exempt

The regulation does not name a single decision-maker. For most categories, the text describes conditions the investigator must meet, such as how information is recorded and whether identifiers are used, without saying who formally certifies that those conditions are satisfied. For categories that require limited IRB review, the IRB’s role is explicit. For category 5, the determination is tied to the approval of the relevant federal department or agency head.²

The Office for Human Research Protections has long recommended that investigators not make independent exemption determinations for their own research, citing the inherent conflict of interest. OHRP advises institutions to build their own policies, such as checklists, web-based forms, or designated staff reviewers, and to document the specific exemption category so it is available for audit.¹⁴ At most universities, researchers submit the study to the IRB, which certifies whether it qualifies as exempt.¹⁵

Where Exempt Sits Among the Review Levels

Exempt review is the lightest tier of IRB oversight. Three practical differences separate it from the alternatives:

Exempt review covers research that falls within one of the eight categories at 46.104(d). The study is still submitted to the IRB, but the review is typically handled by staff or a small number of IRB members, and exempt studies generally have no expiration date and no continuing review.¹⁵
Expedited review is for non-exempt research that presents no more than minimal risk and fits one of nine established expedited-review categories. A single experienced IRB member reviews the protocol, standard informed consent requirements apply, and under the revised rule continuing review is generally not required unless the IRB decides otherwise.¹⁰
Full board review is required for any non-exempt research that does not qualify for expedited review. A quorum of diverse IRB members must be present at a convened meeting, and continuing review is required at least annually.¹⁰

Minimal risk, used in both the exempt and expedited contexts, means the probability and magnitude of harm or discomfort anticipated in the research are not greater than those ordinarily encountered in daily life or during routine physical or psychological examinations.

FDA-Regulated Research Is Handled Separately

The Common Rule exemptions do not automatically apply to clinical investigations regulated by the FDA. FDA rules for IRB review are codified at 21 CFR Parts 50 and 56, and the FDA has not yet fully harmonized its regulations with the 2018 revised Common Rule. Until that rulemaking is completed, research involving FDA-regulated products must comply with both sets of rules where they overlap, following whichever provides greater protection to subjects.¹⁶ Some institutions, including UCSF, do not apply exempt certification to any FDA-regulated research as a matter of institutional policy.¹⁵

If Your Study Started Before January 21, 2019

Section 46.101(b) is marked “[Reserved]” in the current eCFR, but the old rule has not vanished as a governing standard. Under the transition provision at 45 CFR 46.101(l), research initiated before January 21, 2019 that received an exemption determination under the old 46.101(b) remains subject to the pre-2018 requirements unless the institution affirmatively transitions the study to the 2018 requirements. That transition decision is documented on a project-by-project basis and is irreversible: once a study moves to the new framework, it cannot revert.¹⁷ For any research initiated on or after January 21, 2019, the 2018 requirements and the 46.104 framework apply exclusively.¹⁸

1
eCFR. 45 CFR 46.101
2
eCFR. 45 CFR 46.104 — Exempt Research
3
CITI Program. Changes to Exempt Categories Presentation Slides
4
Florida International University. Revised Common Rule
5
Boise State University. Guidelines on Normal Educational Practices
6
HHS. Human Subject Regulations Decision Charts — 2018 Requirements
7
National Center for Biotechnology Information. Benign Behavioral Interventions Exemption Under the Revised Common Rule
8
HHS. Draft Guidance — Limited IRB Review Related Exemptions
9
Cornell Law Institute. 45 CFR 46.111
10
HHS. Types and Manners of IRB Review
11
National Center for Biotechnology Information. Broad Consent Under the Revised Common Rule
12
University of Wisconsin–Madison. Common Rule Changes
13
Federal Register. HHS Policy for the Protection of Human Research Subjects: Update to Additional Protections for Specific Populations
14
HHS OHRP. Exempt Research Determination FAQ
15
UCSF. Levels of Review
16
FDA. Guidance on the Revised Common Rule and FDA Regulations
17
HHS OHRP. Guidance on Compliance Dates and Transition Provision
18
Michigan State University. HRPP Manual — Transition Provision