No, most systematic reviews don’t need IRB approval unless you interact with people or use identifiable private data.
Here’s the plain answer up top: a literature-based review that only summarizes published studies usually falls outside human-subjects oversight. The moment you plan to interact with living individuals or handle identifiable private information, the rules change. This guide explains where the line sits, what documents to keep, and how to write clean methods text that passes editorial checks and institutional audits.
IRB Requirements For Systematic Reviews: When Is Approval Needed?
Start by asking two questions. Is your project “research”? Does it involve “human subjects”? Under the Common Rule, research means a systematic investigation designed to create generalizable knowledge. A human subject is a living individual from whom you obtain data through interaction or intervention, or whose identifiable private information you collect or analyze. If the answer to both questions is yes, you’re in IRB territory. If either answer is no, formal oversight typically doesn’t apply.
Fast Scenarios Map
The table below maps common review setups to likely oversight paths. Treat it as a decision helper, not a substitute for an official determination.
| Scenario | Human Subjects? | Likely IRB Action |
|---|---|---|
| Screening and extracting data only from published papers | No | No review needed |
| Using aggregate data shared publicly (registries, supplements) with no identifiers | No | No review needed |
| Requesting individual participant data that include direct identifiers | Yes | IRB review required |
| Re-contacting trial authors to obtain nonpublic, identifiable records | Yes | IRB review required |
| Surveying investigators about their unpublished methods or outcomes | Yes | IRB review required; may be exempt if criteria met |
| Using de-identified individual data with a written no-re-identification agreement | Usually no | Often not required; seek determination |
| Mining case reports that include identifiable details | Yes | IRB review required |
| Class assignment that never leaves the classroom | Usually no | IRB often not required; local policy applies |
Why Many Evidence Syntheses Don’t Trigger Oversight
Pure literature synthesis uses material already in the public domain. You do not intervene, you do not interact, and you do not access protected files tied to named people. That means no living individual is the source of new data for your project. In that case, the activity isn’t human-subjects research under the federal definitions, so IRB review is not expected.
Where The Line Moves Into IRB Space
The line moves as soon as the project expands beyond public, non-identifiable material. Three common ways that happens:
- Direct contact. You email, survey, or interview living individuals to obtain data for the review.
- Identifiable records. You obtain datasets that carry names, medical record numbers, dates of birth, addresses, images, or any combination that can single out a person.
- Access to nonpublic files. You receive a data transfer from a sponsor or author that contains private information not available to the public.
When any of these apply, you should submit to your IRB before you begin. Some projects may qualify for exempt categories or limited review, but those are IRB determinations, not self-assignments.
Authoritative Rules You Can Cite
The governing federal text lives in the Common Rule. See the definition of “human subject” and related terms in 45 CFR 46. A plain-language summary is also available from the NIH human-subjects definition page. Link these sources in your protocol or manuscript when you explain why your review did or did not require oversight.
Edge Cases You Should Think Through
Individual Participant Data (IPD) Meta-Analysis
IPD can be de-identified or identifiable. A de-identified file with a no-re-identification clause may fall outside oversight, yet many institutions still ask for a written “not human subjects research” determination. If the file includes direct identifiers or a code-key the team can access, that crosses into human-subjects research and needs review.
Contacting Authors
Sending a one-time note to clarify a published value is administrative. Launching a structured email survey to collect new data is human-subjects research. The trigger is systematic interaction designed to create generalizable knowledge.
Case Reports And Case Series
Summarizing published case reports poses no new risk. Pulling medical charts to assemble a new series is different. If you can identify people from the data you obtain, you need oversight.
Quality Improvement Versus Research
Some syntheses support local improvement only. If the goal is internal program assessment with no intent to contribute to general knowledge, many institutions route this through a quality office rather than the IRB. Policies vary; seek a written call from your local office.
What Your Methods Section Should Say
Editors and reviewers look for a short, precise statement. Keep it accurate and source-backed. Here are sample wordings you can adapt.
Sample Language When Oversight Is Not Required
“This evidence synthesis used only publicly available reports and datasets without identifiable private information. Under the Common Rule, the activity does not involve human subjects; institutional review board oversight was not required.”
Sample Language When You Sought A Determination
“The project was submitted to the institutional human research protection program and was determined not to involve human subjects under 45 CFR 46; no review was required (determination letter on file).”
Sample Language When Oversight Applies
“The review included collection of new survey data from investigators. The protocol received IRB approval prior to initiation (protocol number XXX).”
Process: From Idea To Green Light
Follow a simple sequence so you don’t stall later during peer review or audit.
- Define the data path. Only public, aggregate material? Any contact with living people? Any nonpublic files?
- Map identifiers. List every field that could point to a person. Names, medical record numbers, addresses, emails, dates of birth, full dates tied to events, free-text notes, images, audio, video.
- Lock a storage plan. If you will receive any nonpublic file, set access controls and document retention up front.
- Ask for a determination when in doubt. IRB offices can issue a letter that the activity is not human-subjects research. Save the letter with your records.
- Write clean methods text. Include the rule link and the exact determination you received.
Documentation You Should Keep
Keep a small packet for your project folder. It saves time during submission and journal review.
- Copy of your protocol or review plan
- Search strategies and screening forms
- Data extraction templates
- Any correspondence where data were shared
- IRB determination or approval letter, if obtained
- Data use agreements, if applicable
Comparison Of Common Review Types
This second table helps teams flag the oversight status for typical designs and data sources once projects become more complex.
| Review Type | Typical Data Source | Oversight Signal |
|---|---|---|
| Standard literature synthesis (with meta-analysis of published totals) | Published papers, registries, public supplements | No IRB review |
| IPD meta-analysis (fully de-identified file) | De-identified datasets with no code-key access | Often no review; seek determination |
| IPD meta-analysis (keyed or identifiable file) | Nonpublic datasets with direct identifiers or accessible code-key | IRB review required |
| Survey of corresponding authors to obtain missing outcomes | New survey responses | IRB review required; may be exempt |
| Chart abstraction to create a new case series for the review | Medical records tied to living individuals | IRB review required |
| Methodology review with no person-level data | Methods papers, editorials, guidelines | No IRB review |
Manuscript And Protocol Tips That Reviewers Appreciate
Keep The Oversight Statement Short
One or two sentences often suffice. Name the rule, name the determination, and move on.
Point To Reporting Standards
Use a standard checklist and say so in the text. PRISMA 2020 is widely used and improves clarity in methods and results. Many journals ask for the checklist at submission.
Note Your Data Access
State whether you used public material, requested files, or analyzed IPD. Add any restrictions from data use agreements.
Policy Details In Plain Words
Under the Common Rule, you enter human-subjects territory when you obtain information through interaction or intervention with a living person, or when you obtain or analyze identifiable private information. Aggregate counts in a published table are not identifiable. A spreadsheet with dates tied to medical events can be identifiable if the set of fields can single out a person. An honest, short description in your protocol keeps everything clean and auditable.
Student Projects And Class Reviews
Many class assignments synthesize published research only. Those projects often do not meet the federal definition of human-subjects research. If students plan to present outside the course, archive the work, or publish, the calculus can change. A quick email to the IRB office for a determination protects students and instructors.
Multi-Institution And International Work
When teams span institutions, each site may ask for its own determination or rely on a single IRB. Collaborative reviews that only use public, non-identifiable material usually need simple letters rather than full protocols. When identifiable files move across borders, add data transfer agreements and confirm local privacy rules before you begin.
Checklist: Prove You Don’t Need IRB Review
Before screening your first abstract, run through this quick list:
- No contact with living individuals
- No intervention or interaction
- No identifiable private information
- All data sources are public or fully de-identified
- Short oversight statement drafted for the protocol
- Links to governing rules inserted
Clean, Citable Sources For Your Paper
When you need to point an editor to the rule itself, cite 45 CFR 46. When you want a clear overview in plain language, cite the NIH definition page. These links are specific, not homepages, and they load the exact sections journals ask to see.
Common Misconceptions
“Every Publication Needs IRB Approval.”
Not so. Many publication types fall outside human-subjects research. Policy papers, narrative reviews, and literature-only syntheses are frequent examples.
“De-Identified Means Exempt Across The Board.”
De-identified often helps, yet context matters. If a code-key exists and your team can access it, the file is not truly de-identified for you.
“Emailing Authors Never Triggers Oversight.”
Routine clarification is fine. Structured data collection by email is research interaction and can require review.
Key Takeaways
- Literature-only syntheses typically do not require IRB review.
- Interaction with people or use of identifiable data triggers oversight.
- When uncertain, request a written “not human-subjects research” determination.
- State your oversight status in one or two precise sentences with links to the governing rule.