What does the Common Rule’s generalizable-knowledge test mean for healthcare research?
The federal regulation governing human subjects research in the United States is the Common Rule, codified at 45 CFR 46 and adopted by 20 federal agencies. The Common Rule defines research as: “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” Studies that meet this definition AND involve human subjects require Institutional Review Board (IRB) review.
The phrase “generalizable knowledge” is the bright line. A study designed to inform decisions at one institution or product team — even if it uses systematic methods — typically does not meet the threshold. A study designed to produce findings that other institutions, researchers, or sponsors will use to inform their decisions does meet the threshold.
Healthcare insights teams running workforce, patient experience, product UX, and operational research most often fall on the QI (quality improvement) side of the line. Clinical research, academic-partnered studies, and any study with a publication or external benchmarking objective most often fall on the research side.
The 4-axis QI-vs-research determination
The IRB community has converged on four axes that, taken together, determine whether a study is QI or research.
1. Intent
The single most predictive axis. QI intent: improve operations, retention, patient flow, EHR adoption, product fit at one institution or product team. Research intent: develop generalizable findings other institutions or researchers will use. A study can be methodologically rigorous and still be QI if the intent is institutional improvement.
2. Scope
QI scope: single site, single product team, single hospital system, single payer’s member population. Research scope: multi-site, multi-system, population-level, or designed for external comparison. Multi-site QI is possible but rare and typically pulls studies toward research review.
3. Intervention
QI intervention: observational only, or introducing operational changes (new workflow, new training, new EHR feature) without varying clinical care. Research intervention: introducing changes designed to test efficacy, randomizing care delivery, or affecting clinical decisions. Studies that randomize patients to different care protocols are research, full stop.
4. Data flow
QI data flow: findings used internally; reports stay within the institution. Research data flow: findings disseminated externally — published, presented at conferences, shared with peer institutions for benchmarking, included in regulatory submissions.
A study that scores QI on all four axes is almost always IRB-exempt. A study that scores research on any one axis typically requires IRB review.
How do healthcare insights teams typically determine QI vs research?
Specific study types and their typical determinations:
- Workforce experience / nurse retention research at one health system: QI (institutional improvement intent, single-site scope, observational, internal data flow). The most common determination for hospital insights teams.
- Patient experience deep-dives at one system: QI when scoped to the customer institution; pulls toward research if findings inform a multi-system benchmark or vendor’s published Net Promoter database.
- EHR adoption studies at one health system: QI (operational improvement intent, single-site, observational).
- Healthcare SaaS product UX research: QI (product improvement intent, single-product scope, observational, internal data flow). Same logic as any B2B SaaS UX research, but with HIPAA-grade data handling layered on.
- Pharma message validation / concept testing with HCPs: Generally not human-subjects research because HCPs are responding as professionals about products, not as patients about their own care. Some IRBs scope this as exempt; others as not-research at all.
- Pharma patient research (decision drivers, treatment journey): Often IRB-required if findings will inform regulatory submissions, publications, or claims documents. Sponsor compliance teams typically default to IRB review for patient research even when QI framing is plausible.
- Hospital system + academic partnership research: Almost always IRB-required. The academic partner’s home institution typically holds primary jurisdiction.
The recording consent requirement
Recording consent is a separate requirement on top of any research or QI consent. The Common Rule requires informed consent for participation in research; state wiretapping and one-party-vs-all-parties consent laws govern recording. California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington are all-parties consent states — every participant must consent to recording before the call starts.
For voice and video AI-moderated interviews, the consent flow should: (a) disclose that the interview is being recorded, (b) disclose that an AI moderator will conduct the conversation, (c) disclose how recordings and transcripts will be used, (d) capture explicit consent before the moderator begins. This is independent of whether the study is QI or research.
What is the difference between HIPAA Authorization and research consent?
When a study captures Protected Health Information from patients, HIPAA Authorization may be required in addition to research consent. The two are distinct:
- Research consent (Common Rule): authorizes the participant’s involvement in the research study itself.
- HIPAA Authorization (45 CFR § 164.508): authorizes the use and disclosure of the participant’s PHI for purposes outside HIPAA’s standard treatment, payment, and operations exceptions.
IRBs can grant a Waiver of Authorization under specific conditions (45 CFR § 164.512(i)), allowing PHI use without individual authorization when impracticable. Most healthcare insights research that doesn’t capture clinical PHI at the individual level can avoid this by structuring studies to collect only de-identified data or aggregate-level information.
Special populations and additional protections
Certain participant populations trigger additional regulatory protections regardless of QI-vs-research determination:
- Children (under 18): Subpart D of the Common Rule (45 CFR 46 Subpart D); requires assent from the child plus permission from parents/guardians.
- Pregnant women, fetuses, neonates: Subpart B; specific risk-benefit analysis required.
- Prisoners: Subpart C; significant additional review.
- Cognitively impaired adults: No federal subpart but most IRBs require representative consent and additional safeguards.
Even QI-scoped studies involving these populations typically route to IRB review at most institutions.
What this means for healthcare research procurement
For healthcare insights teams selecting a research vendor, the practical implications:
- Verify vendor flexibility on both QI and research paths. Vendors that only support one path (or that try to make IRB determinations themselves) are a procurement risk.
- Request template research protocols and consent forms. Vendors with these on the shelf demonstrate operational maturity for research-scoped engagements.
- Confirm recording consent flow. Vendors that don’t capture all-parties consent before recording in conversational AI studies create state-law exposure.
- Document the QI-vs-research determination in writing. A short determination memo or IRB letter retained in the engagement file protects the customer if the study scope changes mid-engagement.
- Front-load the determination. A 5-10 business day IRB review at the start saves weeks of remediation if a study scoped as QI ends up needing publication-grade documentation later.
Carevoices supports both paths. For QI-scoped engagements we field on the customer’s documented determination (or written self-attestation for institutions that don’t require formal letters). For research-scoped engagements we provide template research protocols, consent forms, recording consent flows, and data flow diagrams that IRBs typically require for full review or expedited review. We do not make IRB determinations for customers — that determination remains with the customer’s IRB or compliance office.