Skip to main content

IRB workflow

From protocol to enclave access. Five steps, predictable timelines.

Two parallel tracks: your home institution's IRB and our internal research-ethics review (IREB). Most studies complete both in 21–35 days. Here's exactly what to send, when, and what we send back.

Step 1
Pre-application call
Day 0 · 30 min
Step 2
Protocol & analytic plan
Day 1 → 7
Step 3
Parallel IRB / IREB review
Day 7 → 28
Step 4
DUA + technical onboarding
Day 28 → 33
Step 5
Enclave access · pre-registration
Day 33 → ongoing
01
Day 0 · 30 minutes · no commitment

Pre-application call.

Before you write anything, talk to us. A 30-minute call lets us tell you whether the data we have can answer your question, whether your design will pass our IREB, and what your home IRB will likely flag — before you spend a month drafting.

Booked via
researchers@conceptualhealth.com
Who joins
PI · Research Coordinator · CH liaison
Output
Memo · feasibility scoring
  • Feasibility check — n estimate against current cohort, axis coverage, follow-up depth.
  • Ethical pre-screen — pediatric / behavioral-health / SUD / minor-protected populations get flagged immediately.
  • Methodological notes — observational vs interventional, synthetic-cohort fit, power-calc sanity check.
  • Funding fit — whether your study qualifies for academic / non-profit pricing or commercial pricing.
02
Day 1 → 7 · self-paced · we coach

Protocol & analytic plan.

Two documents: a standard scientific protocol your home IRB needs anyway, and a CH analytic plan describing exactly which queries you intend to run inside the enclave. Pre-registration of analytic plans is non-negotiable — it's how we keep aggregate-only outputs honest.

Protocol length
8–15 pages typical
Analytic plan
Queries + cohort defs + outputs
Pre-registration
OSF or AsPredicted, your choice
  • Hypothesis & cohort definition — exact ICD/CPT/RxNorm/LOINC codes; inclusion/exclusion windows.
  • Queries you'll run — list them, paste skeleton SQL/R; we'll review for k-anonymity and PHI risk.
  • What leaves the enclave — coefficients, k≥11 aggregates, plots; never row-level data.
  • Subgroups + sensitive axes — declare any protected population (pediatric, BH, SUD) up front.
  • Pre-registration link — once accepted, we register a hash of your analytic plan to chain so deviations are visible.
03
Day 7 → 28 · parallel tracks · 21 days typical

Parallel IRB & IREB review.

Run both reviews simultaneously, not sequentially. Your home IRB sees the standard protocol; our internal Research Ethics Board (IREB) reviews the analytic plan against patient consent scope, axis sensitivity, and cohort-level re-identification risk.

Home IRB · typical
14–28 days
CH IREB · typical
10–14 days
Reliance agreement
Single-IRB possible
  • Home IRB submits — full protocol, consent script (we provide language), DUA draft, your CV + COI.
  • CH IREB reviews — analytic plan, query scope, output review (k-anonymity), sensitive-axis policy, re-id risk score.
  • Pediatric / SUD / BH studies — escalated to a second-tier review with patient-advocate seat.
  • Conditional approvals — common; usually we ask for k≥20 instead of k≥11, or for a sensitivity-axis to be aggregated higher.
  • Reliance agreement — for sIRB studies, we'll cede review to your IRB and add a CH addendum.
04
Day 28 → 33 · 5 business days

DUA + technical onboarding.

Both reviews approved → you sign the data-use agreement, your team completes the technical onboarding, we provision your enclave node and credentials.

Signatories
PI · Institution AOR · CH
Onboarding
2-hour live + async modules
Provisioned
SSH + JupyterLab + RStudio
  • Data-use agreement (DUA) — signed by your institution's Authorized Organizational Representative. CH is the data-source signatory.
  • HIPAA business-associate addendum — for any covered-entity collaborator.
  • CITI training verification — Human Subjects Research + GCP modules current within 3 years.
  • Technical onboarding — enclave architecture, output-review workflow, what gets logged on chain, how to request schema extensions.
  • Account provisioning — JupyterLab + RStudio + DBeaver inside the enclave. SSH only via short-lived OIDC tokens.
05
Day 33+ · ongoing access

Enclave access & pre-registration.

You're in. Your analytic plan is hash-registered to the chain. Run your queries, request output review, publish. Every output that leaves the enclave is logged; every patient whose data was queried sees a high-level study card in their Research feed.

Output review
Same-day · k-anon enforced
Schema extensions
7-day request cycle
Publication
Pre-print encouraged · DOI assigned
  • Run queries — within the analytic plan's scope. Anything outside requires a plan amendment (3-day IREB turnaround).
  • Request output review — every CSV / figure / coefficient table you want to take outside is reviewed for re-id risk + k-anonymity. Same-day for routine, 48h for unusual.
  • Patient-side study card — patients whose data was used see the title, PI, institution, and a one-paragraph plain-language summary. They cannot block (consent was upstream) but they always see.
  • Publication policy — pre-print encouraged. We do not require pre-publication review; we do require a DOI-pinned data citation.
  • Schema-extension requests — if you want a field we don't expose, file an extension; usually turned around in a week.

Frequently asked

What researchers ask before submitting.

Can we use a single-IRB model with CH as the relying institution?

Yes. We have a reliance agreement template (v3) that cedes review to your IRB. We add a CH addendum scoped to enclave usage and the analytic-plan pre-registration. About 60% of our active studies use sIRB.

What if our IRB requires more than the standard DUA?

Common, especially at large academic medical centers. We accept reasonable amendments — most often around publication rights, IP, indemnification scope. If your ORA wants something we can't do, we'll tell you in 48 hours; no surprise stalls at signature.

Are pediatric studies handled differently?

Yes. Pediatric protocols go to a second-tier IREB review with a patient-advocate seat. Approval typically takes 21 days instead of 14. Output k-thresholds rise from k≥11 to k≥20. Pediatric school-affiliation graphs require explicit guardian consent at the source.

What about behavioral-health and substance-use disorder cohorts?

BH and SUD cohorts are governed under our 42 CFR Part 2 + state-BH-statute policy (in active development for the BH clinic surface). Until then, BH/SUD studies are reviewed case-by-case with patient-advocate seat at IREB and require additional consent at the source.

Can we run an interventional study, not just observational?

Not directly through the enclave. Interventional studies require a partner clinical site to deliver the intervention; CH provides the cohort frame and outcomes telemetry. We've co-built two such studies. Email researchers@conceptualhealth.com for the interventional addendum to the DUA.

What's the appeals path if IREB doesn't approve our analytic plan?

You get the rejection memo with specific cited concerns. You can revise and resubmit (no fee, no penalty); usually a single revision resolves it. If you disagree with a decision, written appeal to the IREB chair triggers a second-look by an external bioethicist within 14 days.

Do you charge for IRB review?

No. IREB review is free. The data-access pricing kicks in at step 5 — see the pricing page. Academic / non-profit tier is substantially below commercial.

Can our results be embargoed?

No. We require any aggregate output that leaves the enclave to also be queryable as a chain-attestation by the affected patient population. You can embargo against the press, but not against the participants whose data made it possible.

Ready to start

Book the pre-application call.

Don't write a line of protocol until we've told you whether the data can answer your question. 30 minutes, no commitment.