IRB Exemption Categories (1–3): What They Mean and When They Apply

Overview

IRB exemptions are designed to reduce administrative burden for low-risk human subjects research, but they are frequently underutilized when institutions apply the criteria more conservatively than the regulations require.

That conservatism is understandable: exemption decisions feel final, and teams worry about making the wrong call. But when exemptions are applied thoughtfully—especially Categories 1–3—institutions can speed the start of minimal-risk work while still protecting people through privacy and confidentiality safeguards, including limited IRB review when required.

What “exempt” actually means (and what it doesn’t)

Under the Common Rule, certain categories of human subjects research are exempt from some regulatory requirements when the only involvement of human subjects fits within the exemption categories listed in 45 CFR 46.104(d).

“Exempt” means the activity falls within a defined category of low-risk research. Jaime Hernandez JD, MBE, founder of Practical Ethics Research Solutions and presenter of the Being Creative when Applying the IRB Exemptions webinar series, explains that “Once a study meets the criteria for one or more exemption categories, it is exempt from having to comply with the rest of the Common Rule requirements.  Most notably, there is no requirement to make engagement determinations for exempt research, or to apply the elements of consent at 46.116.”

When identifiers or sensitive information are involved, the regulations may still require additional safeguards. Most notably, limited IRB review to ensure adequate privacy and confidentiality protections.

When Categories 1–3 apply

Exempt Categories 1-3 apply to research that collects new information directly from people.

Category 1: Normal educational practices – Focuses on research in established or commonly accepted educational settings involving normal educational practices that are not likely to adversely affect students’ learning or the assessment of educators.

Category 2: Surveys, interviews, educational tests, observation of public behavior – A workhorse exemption for social/behavioral research, but it’s also one of the most misunderstood, especially, when teams want to record identifiers or when the topic could be sensitive. The key issue is not just what method is used; it’s how information is recorded and whether disclosure could create risk.

Category 3: Benign behavioral interventions: Can apply when adults are involved, and the intervention is brief, harmless, painless, and not physically invasive. Many teams overlook it entirely.

The “flexibility” many institutions miss

A common misconception is that exemptions require anonymity. In reality, research under Exempt Categories 1–3 can, in some cases, include collection and maintenance of identifiable information—but when identifiable, sensitive information is involved, the research needs a privacy/confidentiality plan and limited IRB review (for Exempt Categories 2 and 3).

The webinar Being Creative when Applying the IRB Exemptions: Part 1 explores this misconception and other “flexibilities…often overlooked” in Categories 1-3.

Limited IRB review in plain English (what reviewers are checking)

Limited IRB review is a targeted review that focuses on whether there are adequate provisions to protect privacy and maintain confidentiality when identifiers and potentially sensitive information are involved in an otherwise exempt study.

An operationally simple approach is to align exemption determinations with the OHRP decision charts, which are explicitly intended to help IRBs and investigators decide whether an activity is research involving human subjects and whether it may be exempt under the 2018 Requirements.

A practical way to reduce back-and-forth (without lowering protections)

As a starting point, it is helpful to anchor exemption practices in a proportionate view of risk and protection. Hernandez notes: “Exempt research should be low risk. Therefore, participant protections should be reasonable for the risks they prevent. There is no ethical or regulatory duty to eliminate all research risks.” This underscores that protections should be aligned with actual risk, helping avoid unnecessary procedural steps that can contribute to repeated review cycles.

Here are a few recommendations (not regulatory requirements) that tend to reduce cycles between investigators and IRBs:

• Start with a consistent decision aid. Many institutions rely on OHRP’s published decision charts as a common baseline for exemption thinking.
• Ask for the privacy/confidentiality plan up front whenever identifiers or sensitive topics are present. This mirrors what exemption guidance highlights as the point of limited IRB review.
• Document the rationale in the file (category + why it fits + whether limited IRB review was required). This supports consistency across reviewers and helps with training new staff.

Common pitfalls that delay exemption determinations

Some of the most frequent “sticking points” aren’t about the exemption category itself—they’re about scope or population:

• Prisoner involvement affects whether exemptions can be used.
• Minors introduce additional constraints, including limits on applying certain parts of Category 2 to research involving children.
• Sensitive topics + identifiers raise the bar on privacy/confidentiality planning and trigger limited IRB review under certain conditions.

Training and Education

When it comes to exemption determinations, both compliance and efficiency improve when investigators and reviewers share the same mental model of where flexibility exists and where it doesn’t. CITI Program’s three-part webinar series on Being Creative when Applying the IRB Exemptions discusses flexibilities and answers questions about applying the criteria.

References

1. National Institutes of Health (NIH), Office of Human Subjects Research Protections. n.d. “Exempt Research.” Accessed June 1, 2026.
Protection of Human Subjects, 45 CFR § 46 (2018).
2. U.S. Department of Health and Human Services (HHS), Office for Human Research Protections (OHRP). 2018. “Attachment B — Interpretation Revised Common Rule Exemptions (SACHRP).” Accessed June 1, 2026.
3. U.S. Department of Health and Human Services (HHS), Office for Human Research Protections (OHRP). 2020. “Human Subject Regulations Decision Charts: 2018 Requirements.” Accessed June 1, 2026.