alterlab-ieu/alterlab-academic-skills/alterlab-research-ethics

Research Ethics — Ethics, Compliance & Integrity Agent

A comprehensive research ethics tool for faculty and researchers navigating the complex landscape of research compliance. Covers the full ethics lifecycle: from understanding foundational principles, through ethics board applications, to ongoing compliance during data collection, analysis, and publication.

Overview

Research ethics is the application of moral principles to the design, conduct, and reporting of research involving human participants, animal subjects, sensitive data, and dual-use technologies. This skill provides practical guidance grounded in international ethical frameworks, helping researchers move from ethical principles to compliant practice.

This is not a substitute for your institution's ethics board or legal counsel. It is a tool to help you prepare stronger applications, anticipate ethical issues, and maintain compliance throughout the research lifecycle.

When to Use This Skill

This skill should be used when:

• Preparing an IRB/ethics committee application
• Drafting informed consent forms and information sheets
• Writing data management plans for grant applications
• Assessing whether a study requires ethical review
• Working with vulnerable populations
• Designing research involving deception
• Ensuring GDPR or HIPAA compliance in research
• Addressing research integrity concerns (plagiarism, fabrication, falsification)
• Disclosing conflicts of interest
• Planning research with dual-use potential
• Teaching research ethics courses
• Responding to ethics board revision requests

Does NOT Trigger

Formal legal determinations (for example, whether a specific cross-border transfer is lawful) belong with institutional counsel or the data protection officer; this skill prepares the analysis and the questions to ask them.

Core Capabilities

1. Foundational Ethical Principles

The Belmont Report (1979) — Three Core Principles

The Belmont Report remains the foundational document for research ethics in the United States and has influenced ethics frameworks worldwide.

Declaration of Helsinki (WMA, 2024 revision)

The 2024 revision (adopted October 2024) is the only official version; the WMA states earlier versions should be cited only for historical purposes. It replaces "subjects" with "participants" throughout, addresses all individuals and organizations involved in research (not only physicians), and adds an explicit scientific-integrity / zero-tolerance-for-misconduct provision. Note that the 2024 revision renumbered paragraphs relative to 2013, so verify any paragraph number against the current text before citing it.

Key principles extending beyond the Belmont Report:

• Research involving human participants must conform to generally accepted scientific principles
• The well-being of the individual research participant must take precedence over all other interests
• Every research study involving human participants must be registered in a publicly accessible database before recruitment of the first participant
• Negative and inconclusive results must be published or otherwise made publicly available
• Post-study provisions: participants who benefit from the research should have access to the intervention
• Meaningful engagement with participants and their communities before, during, and after the study

Singapore Statement on Research Integrity (2010)

Four principles:

1. Honesty in all aspects of research
2. Accountability in the conduct of research
3. Professional courtesy and fairness in working with others
4. Good stewardship of research on behalf of others

2. Ethics Board Applications

Does Your Study Require Ethical Review?

Does your study involve...
│
├── Human participants (interviews, surveys, experiments, observations)?
│   └── YES → Review required: exempt, expedited, or full board depending
│             on risk (under 45 CFR 46 many minimal-risk surveys/interviews
│             are exempt, but the IRB office, not the researcher, makes
│             that determination)
│
├── Human data (medical records, educational records, social media data)?
│   └── YES → Review required (level depends on identifiability)
│
├── Human biological samples (blood, tissue, DNA)?
│   └── YES → Review required (level depends on identifiability and how
│             samples are collected; genetic data often draws extra scrutiny)
│
├── Animal subjects?
│   └── YES → IACUC/animal ethics review required
│
├── Publicly available, de-identified data only?
│   └── MAYBE → May qualify for exemption; check with your IRB
│
├── Quality improvement / program evaluation (not generalizable)?
│   └── MAYBE → Some institutions exempt; consult your IRB
│
└── None of the above?
    └── NO ethical review likely required
 
When in doubt, submit to your ethics board for a determination, and apply
before collecting any data: boards generally cannot approve research
retroactively, and data gathered without approval may be unusable.

IRB Application Template

A complete section-by-section IRB/ethics board application template — Study Overview, Purpose & Background, Participants (including vulnerable-population flags), Procedures, Risks & Benefits, Informed Consent (waivers/assent), and Data Management — has moved to references/irb_application_template.md. Copy and adapt those sections for your institution's submission portal.

3. Informed Consent Drafting

Essential Elements of Informed Consent (45 CFR 46.116): the full consent-form template (invitation, purpose, procedures, risks, benefits, compensation, confidentiality, voluntary withdrawal, and signature blocks) plus a checklist of online-research consent considerations have moved to references/informed_consent_templates.md.

4. Data Management Plans

DMP Template (aligned with funder requirements): a full funder-aligned data management plan template — data description, collection standards, ethics/legal compliance, storage & security, preservation & sharing, and roles & responsibilities — has moved to references/data_management_plan_template.md.

5. GDPR Compliance for Research

The General Data Protection Regulation applies to research involving personal data of individuals in the EU/EEA.

GDPR Lawful Bases for Research:

Key GDPR Requirements for Researchers:

## GDPR Compliance Checklist for Research
 
### Before Data Collection
-[ ] Identify lawful basis for processing
-[ ] Conduct Data Protection Impact Assessment (DPIA) if high-risk processing
-[ ] Prepare privacy notice / information sheet (Art. 13/14)
-[ ] Appoint Data Protection Officer contact (if required)
-[ ] Establish data processing agreement with any third parties
-[ ] Document processing activities in institutional register (Art. 30)
 
### Privacy Notice Must Include
-[ ] Identity and contact details of the controller
-[ ] Contact details of the Data Protection Officer
-[ ] Purposes and lawful basis for processing
-[ ] Categories of personal data collected
-[ ] Recipients or categories of recipients
-[ ] Data transfers outside EU/EEA (and safeguards)
-[ ] Retention period or criteria for determining it
-[ ] Data subject rights (access, rectification, erasure, portability, objection)
-[ ] Right to withdraw consent (if consent is the lawful basis)
-[ ] Right to lodge a complaint with a supervisory authority
-[ ] Whether provision of data is statutory, contractual, or voluntary
-[ ] Existence of automated decision-making (if applicable)
 
### Data Subject Rights (with research exemptions under Art. 89)
-Right of access (Art. 15) — may be limited if it would seriously impair research
-Right to rectification (Art. 16) — applies
-Right to erasure (Art. 17) — may be limited under Art. 17(3)(d)
-Right to data portability (Art. 20) — applies if consent-based
-Right to object (Art. 21) — may be limited for public interest research
 
### Data Minimization
-[ ] Collect only data necessary for research purposes
-[ ] Pseudonymize as early as possible
-[ ] Anonymize when identifiability is no longer needed
-[ ] Destroy linking keys when no longer required

6. HIPAA Considerations for Research

## HIPAA Research Checklist
 
### Does HIPAA Apply?
HIPAA applies if you are accessing Protected Health Information (PHI)
from a HIPAA-covered entity (healthcare provider, health plan, clearinghouse).
 
### PHI Includes Any of the 18 Identifiers:
1.Names
2.Geographic data smaller than state
3.Dates (except year) related to an individual
4.Phone numbers
5.Fax numbers
6.Email addresses
7.Social Security numbers
8.Medical record numbers
9.Health plan beneficiary numbers
10.Account numbers
11.Certificate/license numbers
12.Vehicle identifiers and serial numbers
13.Device identifiers and serial numbers
14.Web URLs
15.IP addresses
16.Biometric identifiers
17.Full-face photos and comparable images
18.Any other unique identifying number or code
 
### Accessing PHI for Research — Three Pathways
1.**Individual Authorization** — Patient signs HIPAA authorization form
2.**IRB/Privacy Board Waiver** — Meets criteria for waiver of authorization
3.**De-identified Data** — All 18 identifiers removed (Safe Harbor method)
   or expert determination that re-identification risk is very small
 
### Limited Data Set
-Removes direct identifiers but may retain dates, zip codes, ages
-Requires a Data Use Agreement (DUA) between covered entity and researcher
-Still considered PHI — must be protected

7. Research with Vulnerable Populations

Vulnerability Categories and Additional Protections: