You are here

Operations Manual - Laws, Regulations, and Standards

Operations Manual - Part 11

[Operations Manual Table of Contents]


There are many laws, regulations, formal and informal guidance documents, and other standards that govern research activities. These expectations are implemented by government bodies (e.g., federal or state government), federal agencies (e.g., the Department of Health and Human Services [HHS]), or other national or international institutions (e.g., International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use). Importantly, these bodies may regulate the same or similar activities, which can result in conflicting guidance. This can be shown in the illustration below. In these circumstances, researchers must generally comply with the most conservative requirements.

This section provides an overview of governmental and non-governmental bodies that commonly implement laws or other requirements regulating research activities.  For each body, this section also describes the laws and standards most commonly applicable to individuals engaged in research or charged with research oversight.  Section II of this Part describes topics that are likely applicable to researchers and provides an overview of the key rules governing each topic.

A. Federal Agencies: Federal Research Laws and Regulations

Several federal agencies conduct or support human research. A number of these federal agencies have created additional, agency-specific regulations for the research they support. Each Institutional Review Board (IRB) is responsible for ensuring that investigators and research staff meet these additional regulations when conducting research supported by a particular agency.

An outline of federal agencies, as well as an overview of the laws and standards they oversee, is provided below.  This section is limited to standards that are commonly applicable to research at the University of Michigan (U-M); other standards may also apply.

1. The "Common Rule" (adopted by multiple agencies)

In 1979, the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research published the Belmont Report, which outlined basic ethical principles in research involving human subjects. In 1991, this Federal Policy for the Protection of Human Subjects – i.e., the “Common Rule” – was published. The Common Rule has been adopted by the following federal agencies:

The Office of Science and Technology Policy signed the federal policy for protection of human research participants but did not codify the Common Rule because it does not itself directly conduct or sponsor research.

The Common Rule is the foundation of human research protection principles. Its specific requirements are integrated throughout this Operations Manual (OM) as well as in the standard operating procedures of the University’s IRBs and other review units. Many of the departments or agencies who have adopted the Common Rule have set standards or issued guidance to institutions regarding its implementation. These standards should be consulted, as they will inform the manner in which the corresponding University research is reviewed and conducted.

Absent an interpretation from the sponsoring agency to the contrary, the guidance provided by the Department of Health and Human Services (HHS) and the requirements of all of the subparts of 45 CFR 46 apply to University research supported by Common Rule agencies.  Further 45 CFR 46 includes several subparts that impose additional protections for identified vulnerable populations specifically, pregnant women, fetuses, and neonates (45 CFR 46 Subpart B); prisoners (45 CFR 46 Subpart C); and children (45 CFR 46 Subpart D). Many agencies have not adopted Subparts B, C, or D; unless the agency provides guidance to the contrary, however, the University interprets the subparts to apply to all federally supported University research.

For research that is not federally supported, and in accordance with the University’s Federalwide Assurance (FWA) with the Office of Human Research Protections (OHRP) the University adheres to equivalent protections that are consistent with the requirements of 45 CFR 46 and the subparts, but that allow flexibility in IRB review of these projects.

2. Department of Health and Human Services

The U.S. Department of Health and Human Services (HHS) and its various offices and operating divisions regulate human research supported with HHS federal funds or involving the use of investigational drugs, biologics, and devices. An overview of some of these offices/divisions and the laws these organizations oversee is provided below.

(a) Office for Human Research Protections

The Office for Human Research Protections (OHRP) is part of the Office for the Assistant Secretary of Health under HHS. The Office for Human Research Protections provides guidance and regulatory oversight of biomedical and social-behavioral research in order to protect the rights, welfare, and well being of human subjects. The Office for Human Research Protections has oversight for three laws/standards of note:

i. The Common Rule

The Public Health Service Act (42 U.S.C 6A) and its amendments empower HHS to issue regulations for the protection of human subjects. These are compiled in 45 CFR 46 Subpart A. The Department of Health and Human Services has issued additional rules for research that it conducts or sponsors involving pregnant women, fetuses, and neonates (45 CFR 46 Subpart B); prisoners (45 CFR 46 Subpart C); and children (45 CFR 46 Subpart D). HHS provides guidance and information concerning its interpretation of the Common Rule and related regulations through regular issuance of educational materials, determination letters directed to organizations following investigations of research noncompliance, other guidance documents, and frequently answered questions (FAQs).

ii. Federalwide Assurance (FWA)

Institutions engaged in human subjects research that is supported by any agency of HHS are required to commit to HHS that they will comply with the requirements in the HHS Protection of Human Subjects regulations at 45 CFR 46. This commitment is conveyed through the submission and maintenance of an FWA, which describes the University’s commitment to the protection of human subjects.

iii. The Genetic Information Nondiscrimination Act (GINA)

GINA is a Federal law that prohibits discrimination in health coverage and employment based on genetic information. GINA, together with the nondiscrimination provisions of the Health Insurance Portability and Accountability Act (HIPAA), generally prohibit health insurers or health plan administrators from requesting or requiring genetic information of an individual or an individual's family members, or using such information for decisions regarding coverage, rates, or preexisting conditions. GINA also prohibits most employers from using genetic information for hiring, firing, or promotion decisions, and for any decisions regarding terms of employment.

Since GINA has implications regarding the actual or perceived risks of genetic research and an individual's willingness to participate in such research, OHRP has provided guidance for investigators and IRBs so that they are aware of the protections provided by GINA as well as the limitations in the law's scope and effect. IRBs should consider the provisions of GINA when assessing whether genetic research satisfies the criteria required for IRB approval of research, particularly whether the risks are minimized and reasonable in relation to anticipated benefits and whether there are adequate provisions in place to protect the privacy of subjects and maintain the confidentiality of their data.

GINA is also relevant to informed consent. When investigators develop, and IRBs review, consent processes and documents for genetic research, they should consider whether and how the protections provided by GINA should be reflected in the consent document's description of risks and provisions for assuring the confidentiality of the data.

iv. Review of Research Funded by the National Institute on Disability, Independent Living, and Rehabilitation Research (NIDILRR)

When an IRB reviews research funded by the U.S. Department of HHS’s National Institute on Disability, Independent Living, and Rehabilitation Research (NIDILRR) that “purposefully" requires inclusion of children with disabilities or individuals with mental disabilities, at least one IRB member must be concerned with the welfare of these research participants. NOTE: Prior to 2014, the NIDILRR was known as the National Institute on Disability and Rehabilitation (NIDRR) and was located in the Department of Education.

(b) Food and Drug Administration

The U.S. Food and Drug Administration enforces the Food, Drug and Cosmetic Act and associated regulations, including regulations covering human subjects protections (21 CFR part 50), IRBs (21 CFR part 56), investigational drugs (21 CFR part 312), biologics (21 CFR 312 and 21 CFR subchapter F), and investigational devices (21 CFR part 812). Additional information about research regulated by the FDA and special requirements for that research is provided in Part 8 of this OM and directly from the FDA.

(c) National Institutes of Health, Office of Biotechnology Activities

The Office of Biotechnology Activities (OBA) oversees research involving recombinant DNA (rDNA). OBA develops and implements NIH policies and procedures for the safe conduct of rDNA activities and human gene transfer (see NIH Guidelines for Research Involving Recombinant DNA Molecules). Its duties include review and evaluation of the composition of institutional biosafety committees and development of registries of activities related to rDNA and human gene transfer research. OBA-regulated research is subject to oversight by the University's Institutional Biosafety Committee (IBC).

(d) Office of Research Integrity

The Office of Research Integrity (ORI) is located in the Office of the Assistant Secretary for Health under HSS. ORI promotes integrity in biomedical and behavioral research supported by the Public Health Service (PHS). ORI facilitates the responsible conduct of research through educational, preventive, and regulatory activities and monitors institutional investigations of research misconduct. ORI's response to misconduct depends on the circumstances, but may include government-wide debarment. ORI publishes all findings of misconduct. The University's local policy on research misconduct is described in the Standard Practice Guide 303.03. (See also the University's policy on integrity in scholarship.)

e. Office for Civil Rights

HHS also is responsible, through its Office for Civil Rights, for implementation and enforcement of privacy and security rules issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which protects individually identifiable health information (see 45 CFR 160 and 164). While the privacy and security rules do not directly regulate human subjects research, they do govern the circumstances under which “covered entities” (health care providers, health plans, and health care clearinghouses) who control information necessary for many research activities may use, disclose, or provide access to that information. HIPAA is further discussed in Section II.B.2 of this part.

3. Department of Defense (DoD)

​The University has signed and maintains an addendum to its FWA that it will apply DoD regulations and policies for the protection of human research subjects when conducting, reviewing, approving, overseeing, supporting or managing human subjects research involving the DoD. The Institutional Official (IO) is authorized to review and sign the addendum. The DoD may require the submission of research records for archiving.

The U-M has developed guidance regarding research involving the DoD. Researchers are responsible for reviewing these documents in order to understand DOD’s special requirements.  These include but are not limed to:

  • Submission of research proposal to the Human Research Protection Office of the DoD component for administrative review after U-M IRB review has been completed;
  • Special education requirements for Navy-funded funded human subjects research;
  • Appointment of research monitor for all research involving more than minimal risk to research participants;
  • Special protections for U.S. military personnel participating in research;
  • Disclosure and consent; and
  • Prohibition of research involving Prisoners of War.

The DoD has issued hte following regulations and guidance:

  • 10 USC 980, Limitations on the Use of Humans as Experimental Subjects
  • 32 CFR 219, Protection of Human Subjects
  • DoD Instruction 3216.02, Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research, November 8, 2011 
  • DoD Directive 3210.7, Research Integrity and Misconduct

4. Department of Justice (DOJ)

As mentioned, the DOJ has adopted the Common Rule at 28 CFR 46.  Further, the DOJ has published additional requirements for research conducted with the Bureau of Prisons, and research involving the National Institute of Justice.

a. Research Conducted with the Bureau of Prisons (28 CFR 512)

Research conducted with/in the Federal Bureau of Prisons is subject to the requirements of the Common Rule and the rules for the protection of prisoners  found in Subpart C. Additional unique regulatory requirements are outlined in 28 CFR 512. The U-M has developed a general guidance regarding research conducted with the bureau of prisons. Researchers are responsible for reviewing these documents in order to understand the regulatory requirements and University policies related to:

  • Research proposal and design;
  • Subject selection and incentives;
  • Investigator requirements and responsibilities;
  • Confidentiality, privacy, and access to records; and
  • Disclosure and consent.

b. Research Involving the National Institute of Justice (NIJ) (28 CFR 22)

Research projects involving the NIJ must meet the requirements of 28 CFR 22 – Confidentiality of Identifiable Research and Statistical Information. Among those requirements are the following: 

  • A Privacy Certificate must be approved by the NIJ Human Subjects Protection Officer; and
  • All investigators and research staff are required to sign Employee Confidentiality Statements, which are maintained by the responsible investigator.

The NIJ has published more information, which can be found at:

5. Environmental Protection Agency (EPA)

As mentioned, the EPA has adopted the Common Rule at 40 CFR 26. Further, the EPA has published additional requirements for research it supports or conducts and for research intended for submission to the EPA.

For research conducted or sponsored by the EPA, IRB determinations and approval must be submitted to the EPA Human Subjects Research Review official for final review and approval before research can begin. The U-M has developed guidance regarding research sponsored by or intended for submission to the EPA. Researchers are responsible for reviewing these documents to understand the applicable principles and the University policy.

6. Department of Education (ED)

The Department of Education has adopted the Common Rule at 34 CFR 97. In addition to the Common Rule, human subjects research involving education records conducted at institutions receiving ED funding must comply with additional requirements, including the Family Educational Rights and Privacy Act (FERPA) (34 CFR 99), which is described in Section II of this Part, and the Protection of Pupil Rights Amendment (PPRA) (34 CFR 98), described below.

The Protection of Pupil Rights Amendment (PPRA) (20 USC 1232h; 34 CFR 98) applies to school districts and K-12 schools that receive funding from the U.S. Department of Education (ED).

PPRA is intended to protect the rights of parents and students in two ways:

  1. To ensure that schools and contractors make instructional materials available for inspection by parents, if those materials will be used in connection with an ED-funded survey, analysis, or evaluation in which their children participate; and
  2. To ensure that schools and contractors obtain written parental consent before minor students are required to participate in any ED-funded survey, analysis, or evaluation that reveals information concerning:
  • Political affiliations;
  • Mental and psychological problems potentially embarrassing to the student and his/her family;
  • Sex behavior and attitudes;
  • Illegal, anti-social, self-incriminating, and demeaning behavior;
  • Critical appraisals of other individuals with whom respondents have close family relationships;
  • Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;
  • Religious practices, affiliations, or beliefs of the student or student's parent;  or
  • Income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

In the case of non-ED-funded research conducted at schools that receive ED funding, the PPRA would instead permit a parental opt-out approach. The PPRA also addresses parental notice and opt-out requirements in connection with non-emergency invasive physical examinations conducted by/at the school.

7. Department of Energy (DOE)

The Department of Energy has adopted the Common Rule at 10 CFR 745 and has published additional requirements for research it supports or conducts. See HRPP guidance on additional requirements for research supported by the DOE.

B. State Governments and Laws:  Other Contractual Requirements

Studies conducted at the University or other in-state facilities are subject to the laws and regulations of the state of Michigan. Studies performed in whole or in part in other states may be subject to different requirements. For example, different states may have different requirements for informed consent; confidentiality, privacy, and security standards; public health reporting mandates; limitations on participation of vulnerable populations in research; professional licensing requirements; etc. For research conducted out-of-state, researchers are expected to comply with the requirements of those other states. Typically, University IRBs rely on local IRB or ethics board oversight to assure project compliance with local laws and regulations. Where the design of the research does not anticipate local review, investigators may contact the U-M Office of the Vice President and General Counsel to determine whether the protocol is likely to implicate state laws that are inconsistent with those of Michigan.

Contracts signed with sponsors and funders of research and with research performance sites may also impose further restrictions. The Principal Investigator (PI) is responsible for assuring that the study complies with all of these requirements.

C. International Research

The U-M facilitates the conduct of international (transnational) human subjects research by its faculty, students, and staff. International research frequently poses special concerns for IRBs and PIs to consider when evaluating risks and benefits to subjects and the appropriateness of study procedures. IRB standard operating procedures (SOPs) must describe procedures for obtaining local IRB or ethics committee approval or must describe alternative procedures for seeking input on subject protection when an IRB or ethics board is not available or not necessary based on the research design. Additional requirements may be mandated by research sponsors, U.S. government agencies, and international agencies, depending on the specific location of the research and the nature of the study. The HHS Office of Human Research Protections maintains an online compilation of international laws and regulations pertaining to human research protections. 

Principal investigators are responsible for understanding and complying with the ethical and legal aspects of conducting human subjects research in an international setting.

1. World Medical Association (WMA)

The World Medical Association (WMA) is an international organization created to ensure the independence of physicians. A central objective of the WMA is to establish and promote the highest possible standards of ethical behavior and care by physicians. In pursuit of this goal, the WMA has adopted global policy statements, many of which are recognized internationally as the global ethical standards for the topics they address, on a range of issues related to medical professionalism, patient care, research on human subjects, and public health.

One of the WMA’s most important policy statements is the Declaration of Helsinki, which outlines ethical principles for medical research involving human subjects, including research on identifiable human material and data.

2. International Conference on Harmonisation Good Clinical Practice (ICH-GCP)

Good Clinical Practice (GCP) is an international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials that involve human subjects. Compliance with the standard provides public assurance that the rights, safety, and well being of trial subjects are protected, consistent with the principles of the Declaration of Helsinki, and that the clinical trial data are credible. 

The objective of the ICH-GCP Guideline (published in 1996) is to provide a unified standard for the European Union (EU), Japan, and the United States to facilitate the mutual acceptance of clinical data by the regulatory authorities in these jurisdictions.

When U-M is a proposed performance site in a multisite clinical trial, a sponsor may require that the FDA-approved protocol and any investigator SOPs associated with that protocol would, if followed, assure ICH-GCP compliance, including training requirements. In those instances, the IRB will make the determinations required by institutional policy and will also review the submitted research plan to identify aspects that may be inconsistent with ICH-GCP. Such review will include evaluation of the adequacy of the available nonclinical and clinical information on an investigational product to support the proposed clinical trial, and consideration whether the proposed clinical trial is scientifically sound and described in a clear, detailed protocol. The IRB will bring any issues of concern to the attention of the investigator, who may in turn ask for clarification from the sponsor.

If an investigator in the research contract agrees to conduct an investigation in full compliance with the investigator obligations under ICH-GCP, any compliance review conducted by ORCR will be done against the complete set of ICH-GCP requirements.  Investigator obligations under ICH-GCP include the following:

Investigators who agree to perform research represented to be ICH-GCP-compliant are required to follow the protocol as written and will be advised by the IRB to review all investigator obligations in the ICH-GCP as well as any aspects of ICH-GCP incompletely or not at all captured in the research protocol and investigator SOPs. To that end, investigators should reference the full ICH-GCP Guideline.

If an investigator in the research contract agrees to conduct an investigation in full compliance with the investigator obligations under ICH-GCP, any compliance review conducted by the Office of Research Compliance Review (ORCR) will likewise be done against the applicable set of ICH-GCP requirements.


It is not feasible to comprehensively list all laws applicable to human research, as there are many laws covering a wide variety of topic areas (e.g., privacy, fraud and abuse, civil rights, employment, and non-discrimination, etc.) that may impact research in some way. As mentioned in Section I, these laws are implemented by federal, state, and international bodies. At times, different regulatory agencies will address the same topic through different rules. For example, the definition of “child” varies under federal and state laws. Researchers are required to determine the laws and standards applicable to their projects and follow them accordingly. Researchers may contact the U-M Office of the Vice President and General Counsel for general assistance in determining which laws and standards may be applicable to their project.

This section describes legal standards, under federal and Michigan law only, that may often apply to research performed by University faculty, staff, and students. 

A. Informed Consent and Legally Authorized Representatives

Consent is addressed in Parts 3, 6, and 7 of this OM. Thus, this section contains a general overview of the federal law regarding consent as conveyed in the Common Rule and a general overview of the laws regarding consent in the state of Michigan.

Other federal agencies (e.g., FDA, DOJ) may implement additional or different consent requirements for research projects they sponsor. If research is conducted in a state other than Michigan, different laws may also apply. Researchers must determine the consent requirements that apply to their projects.

1. General Requirements for Informed Consent

Federal research laws and institutional policy require that written informed consent be secured from prospective subjects before they participate in studies, unless informed consent requirements have been waived by the IRB or the research is determined to be exempt. Exempt research may require some version of informed consent to comply with the ethical principles of the Belmont Report and other ethical guidelines. 

The general requirements for informed consent are discussed in Part 6 of this OM. The federal requirements as implemented by HHS can be found at 45 CFR 46.116 and 46.117. Additional HHS guidance can be found at the following sites:

Different federal agencies may have slightly different requirements.

Michigan requirements regarding consent are largely consistent with federal law. The Michigan Department of Community Health has issued Guidelines for Informed Consent.

Failure to obtain informed consent for research involving certain clinical procedures may, depending on the circumstances, violate federal and state laws and institutional policies.

2. Who May Give Consent

Competent adults (those able to understand the nature and consequences of their actions) must consent on their own behalf to participate in research. Children and adults with diminished capacity, however, are considered vulnerable and susceptible to coercion and undue influence. In general, neither of those groups may provide legally effective informed consent.

(a) Children as Subjects

i. Federal Law (45 CFR 46.408; 45 CFR 46.116)

Subpart D of the Common Rule (45 CFR 46.402(a)) defines “children” as people “who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted.” This generally means that the laws of the state in which the research will be conducted need to be consulted. In many states, the legal age to consent to treatments or procedures involved in the research can depend on the age and legal status of the individual (e.g., emancipated or married), as well as on the specific procedures involved (e.g., general medical care, substance abuse counseling, completion of a survey or interview, or consumption of alcohol).

HHS outlines the Common Rule consent requirements for research involving children at 45 CFR 46.408. Specifically, the law requires the IRB ensure that adequate provisions are made for:

  • Soliciting the assent of the children (when, in the judgment of the IRB, the children are capable of providing assent), and;
  • Obtaining the permission of the children’s parent(s) or guardian(s).

In limited circumstances, the IRB may determine that assent is not a requirement with respect to some children involved in research for one of the following reasons: 

  • The capability of the children is so limited (based on an assessment of their age, maturity, or psychological state) that they cannot reasonably be consulted;
  • The intervention or procedure involved in the research holds out a prospect of direct benefit that is important to the health or well-being of the child and is available only in the context of the research; or
  • The assent can be waived using the criteria described in 45 CFR 46.116 for waiver of consent.

The IRB must determine and document whether assent is required of all children, some children, or none of the children and the corresponding rationale for its determination. Per 45 CFR 46.408(e), when an IRB determines that assent is required, it must determine whether and how assent must be documented.

In addition, 45 CFR 46.408 requires that the IRB ensure that – to the extent required by 45 CFR 46.116 – adequate provisions are made to obtain the permission of the child’s parent(s) or guardian(s). However, per 46 CFR 46.408(c), if the IRB determines that a research protocol is designed for conditions or for a subject population for which parental or guardian permission is not a reasonable requirement (for example, in the case of neglected or abused children), it may waive the consent requirements, as long an appropriate mechanism is substituted to protect the children who will participate, and as long as that the waiver is not inconsistent with federal, state or local law. The choice of an appropriate substitute mechanism depends upon the nature and purpose of the activities described in the protocol, the risk and anticipated benefit to the research subjects, and their age, maturity, status, and condition. Note that this exception does not apply to research subject to FDA oversight.

Children who reach the age of majority while participating in a study must be re-consented if continuing interventions or interactions are planned (including collection or analysis of identifiable private information), as described in 45 CFR 46.116. The IRB may grant a waiver of re-consent under 45 CFR 46.116(d), if it finds that required conditions are met, but must document its decision and rationale for doing so.

ii. Michigan Law (MCL 722.1-722.6; MCL 722.51-722.55)

Michigan law defines the “age of majority” in MCL 722.51 (The Age of Majority Act of 1971, MCL 722.51-722.55). An individual who is eighteen or older is an “adult” and is able to consent to undergo most medical procedures. Parents or legal guardians generally must consent on behalf of children younger than eighteen, with the following exceptions:

  • Emancipated minors (generally those who are validly married or are on active duty in the United States armed forces) (MCL 722.4e(1)(g));
  • Children seeking prenatal and pregnancy-related care (excluding abortions) (MCL 333.9132; MCL 722.903);
  • Children age 14 and above seeking limited outpatient mental health services (MCL 330.1707);
  • Children receiving substance abuse treatment (MCL 330.1264); and
  • Children seeking treatment for sexually transmitted diseases, including HIV/AIDS (MCL 333.5127).

The latter four exceptions are intended to permit children to seek the designated services confidentially. If research involves only the above services either alone or accompanied only by surveys, interviews, medical records reviews, or similar minimal risk activities, a minor generally may consent in his or her own right if receiving the services confidentially. However, if the minor is not otherwise receiving the services confidentially, or if the research involves experimental procedures, unapproved drugs or devices, or any intervention that might add to the minor’s risk, consent of a parent with legal custody (or, in the case of certain research involving more than minimal risk, both parents) or legal guardian is required. A summary of who may consent to a child’s participation in research in Michigan is posted at: Who May Consent for Participation in Research Studies.

(b) Incompetent and Incapacitated People

Federal law requires that a legally authorized representative consent to research participation on behalf of an adult with diminished capacity. More information is available at: OHRP's FAQs.

Michigan law (MCL 700.1105) defines an "incapacitated individual" as one “who is impaired by reason of mental illness, mental deficiency, physical illness or disability, chronic use of drugs, chronic intoxication, or other cause, not including minority, to the extent of lacking sufficient understanding or capacity to make or communicate informed decisions.” Per MCL 700.5314, the legal guardian may consent to medical treatment for a legally incapacitated individual.

More information on the University’s general policies regarding consent processes can be found at: guidance on informed consent.  If it is unclear who should act for a prospective subject, it may be necessary to petition a court to appoint a temporary guardian. A person faced with questions or concerns regarding who is responsible to make decisions for an incompetent person may contact the Office of the Vice President and General Counsel.

3. Michigan Laws Requiring Special Consent

Like many states, Michigan has adopted laws and regulations imposing specific consent requirements for certain types of clinical activities, any of which may be the subject of clinical research. These requirements generally apply equally to the clinical and research context. When devising an informed consent process and developing the form for documenting consent, an investigator who seeks through a clinical trial to treat patients with one of the conditions discussed below should incorporate the state-required language or forms into the research informed consent process. In such a case, a copy of the research informed consent should be incorporated into the patient/subject’s medical record to document regulatory compliance.

(a) Breast Cancer Treatment (MCL 333.17013)

A physician treating breast cancer must inform a patient diagnosed with breast cancer, orally and in writing, about alternative methods of treatment, including surgical, radiological, or chemotherapeutic treatments, or any other generally accepted medical treatment. The physician also must inform the patient about the advantages, disadvantages, and risks of each method of treatment, as well as about the procedures involved in each method. Providing the patient with a standard written summary produced by the Michigan Department of Community Health entitled Breast Cancer: What You Should Know Before Treatment can satisfy this rule. A form signed by the patient indicating the patient received a copy of the brochure (or an equivalent written summary) must be included in the patient’s medical record.

(b) Electroconvulsive Therapy (ECT) (MCL 330.1717)

ECT (or any procedure intended to produce convulsions or coma) may be administered to a recipient of mental health services only if consent is obtained as described below:

Recipient Who May Consent Conditions

Adult ≥ 18


  • If the recipient has a guardian, follow the guardian rules below.

Child < 18 years old

Parent or legal guardian 

  • For a parent to provide consent, the parent must have physical and legal custody.
  • For a legal guardian to provide consent, the guardian must have the power to execute consent for ECT procedures.
  • Two child/adolescent psychiatrists, neither of whom may be the treating psychiatrist, must have examined the child and documented their concurrence with the decision to administer ECT in the child’s medical record before the procedure.
  • The child must be informed of his/her right to object to the procedure at least 72 hours (excluding Sundays and holidays) prior to the procedure.
  • The child or child's advocate may object to the procedure, orally or in writing to a probate court. In this case, the procedure may not be initiated before a court hearing.

Recipient with guardian (e.g., incapacitated individual)

Legal guardian

  • For a legal guardian to provide consent, the guardian must have the power to execute consent for ECT procedures.
  • Two psychiatrists must examine the recipient and document their concurrence with the decision in the patient’s medical record before the procedure.

Recipient with durable power of attorney (DPOA) or advance directive

Patient advocate or
designated representative

  • The patient advocate or designated representative must have power to execute an ECT consent under the DPOA or advance directive.

Per MCL 330.1717, if ECT is advisable for a recipient and an individual eligible to give consent for the procedure is not located after diligent effort, a probate court may, upon petition and after a hearing, consent to administration of the procedure on the recipient’s behalf.

(c) Genetic Testing (MCL 333.17020 and 333.17520)

The following rules do not apply to procedures performed as a component of biomedical research subject to FDA and OHRP oversight. However, they do establish best practice in Michigan and, therefore, should be followed when judged appropriate in the context of an individual research project.

A physician or other provider may perform a pre-symptomatic or predictive genetic test only after obtaining specific informed consent from the patient or patient's legally authorized representative. The informed consent must confirm that the physician or provider has explained, and the patient or his legally authorized representative understands, all of the following, at a minimum:

  • The nature and purpose of the pre-symptomatic or predictive genetic test;
  • The effectiveness and limitations of the pre-symptomatic or predictive genetic test;
  • The implications of taking the pre-symptomatic or predictive genetic test, including, but not limited to, the medical risks and benefits;
  • The future uses of the sample taken from the test subject in order to conduct the pre-symptomatic or predictive genetic test and the information obtained from the pre-symptomatic or predictive genetic test;
  • The meaning of the pre-symptomatic or predictive genetic test results and the procedure for providing notice of the results to the patient; and
  • Who will have access to the sample taken from the patient in order to conduct the pre-symptomatic or predictive genetic test and the information obtained from the pre-symptomatic or predictive genetic test, and the patient's right to confidential treatment of the sample and the information.

A copy of the informed consent form should be provided to the person who signed it. The original form, signed by the patient or his legally authorized representative, must be placed in the patient’s medical record. The Michigan Department of Community Health (MDCH) has developed a patient information brochure and model informed consent document that it recommends for use with genetic testing. If the MDCH model form is used, the person receiving the test is legally barred from later claiming that he or she was not provided with adequate or informed consent.

(d) HIV/AIDS Testing (MCL 333.5133)

A physician (or person working on his behalf) may order a test to diagnose HIV infection only after providing the patient with certain pre-test information and after obtaining the written informed consent of the patient. The pre-test information must include, at a minimum:

  • An explanation of the test including, but not limited to, the purpose of the test, the potential uses and limitations of the test, and the meaning of test results;
  • An explanation of the rights of the patient including, but not limited to: (i) the right to withdraw consent at any time before test administration; (ii) the right to confidentiality of the test results; (iii) the right to consent to and participate in the test on an anonymous basis; and (iv) the person or class of persons to whom the test results may be disclosed under Michigan law.

Each patient must be given a pamphlet developed by the Michigan Department of Community Health titled “What You Should Know About HIV.” A form signed by the patient indicating he or she has received the pamphlet must be included in the person’s medical record.

In addition, the consent must be documented in the patient’s medical records. A sample consent form has been produced by the Michigan Department of Community Health.

If the results of an HIV test indicate that the patient is HIV-infected, state law requires that the physician inform the patient of the positive test results and provide the patient with appropriate counseling regarding HIV infection and AIDS. It also requires that the physician and/or person from the local health department notify all known sexual and/or needle-sharing partners of the patient that they may have been exposed to HIV. 

If the test is performed solely for research purposes and the test is performed in a way that the identity of the subject is not revealed to the researcher and the results are not revealed to the subject, the consent requirements described above may not apply. In addition, these requirements may not apply if the subject is incompetent and his or her legally authorized representative is not readily available to receive the MDCH pamphlet or provide proxy consent.

Separately, the OHRP has published federal guidelines for AIDS studies.

(e) Pregnancy Termination (MCL 333.17015)

A physician may not perform an abortion without the patient's informed written consent, given freely and without coercion. At least 24 hours before the procedure, the physician (or a qualified assistant) must: 

  • Examine the patient, confirm the pregnancy, and determine the probable gestational age of the fetus.
  • Orally describe, in language understandable to the patient, the probable gestational age of the fetus, what to do in case of complications from the procedure, and how to obtain pregnancy prevention information from the Michigan Department of Community Health (MDCH).
  • Provide information (approved by the MDCH) regarding the abortion procedures available, the risks and possible complications of such procedures, and services available through public agencies to assist the patient (i.e., support services). If the procedure has not been recognized by MDCH, but is otherwise allowed under Michigan law, and the department has not provided a written standardized summary for that procedure, the physician will develop and provide a written summary that describes the procedure, any known risks or complications of the procedure, and risks associated with live birth.
  • Provide the patient with a written description of the fetus (including pictures, illustrations, or descriptions), provided by the MDCH, based on the nearest probable gestational age of the fetus.
  • Provide the patient with a physical copy of the prenatal care and parenting information pamphlet developed by the MDCH.
  • Provide the patient with a physical copy of the prescreening summary on prevention of coercion to abort. 

The state-approved materials with this information are located on the MDCH web site.

After the expiration of the 24-hour period but before performing an abortion on a patient, a physician must obtain the patient's signature on the acknowledgment and consent form (provided by MDCH and subject to the requirements described below), provide a copy to the patient, and retain a copy in the patient’s medical record.

However, before obtaining the patient's signature on the acknowledgment and consent form, a physician must do all of the following in the presence of the patient:

  • Provide the patient with the physician's name, confirm with the patient that the coercion to abort screening (required under section MCL 333.17015a) was performed, and inform the patient of her right to withhold or withdraw her consent to the abortion at any time before performance of the abortion.
  • Orally describe, in language designed to be understood by the patient, taking into account her age, level of maturity, and intellectual capability, 1) the specific risk and /or possible complications associated with the procedure, and 2) the specific risk of complications if the patient chooses to continue the pregnancy.

If a U-M investigator wants to conduct a medical research investigation that involves pregnancy termination they should consult with the IRB to ensure compliance with other state and federal laws.

(f) Surgery for Mental Health Patients (MCL 330.1716)

A recipient of mental health services may undergo surgery only if consent is obtained from one of the following:

  • The recipient, if he or she is 18 years of age or older and without a guardian for medical care;
  • The recipient's guardian, if the guardian is authorized to consent to surgery on behalf of the recipient (a guardian or individual with durable power of attorney must be specifically empowered to consent to the recipient's participation in research);
  • The parent of the recipient, if the parent has legal and physical custody and the recipient is younger than 18 years of age; or
  • The individual with durable power of attorney for healthcare with respect to the recipient.

If surgery is advisable, and there is no one eligible to consent, a probate court may consent to the surgery after receiving a petition and conducting a hearing. If surgery is necessary because the life of the recipient is threatened and there is not time to obtain consent, per MCL 330.1716 (2), surgery may be performed without consent after the medical necessity for the procedure has been documented and the documentation has been entered into the patient’s record.

(g) Terminal Illness (MCL 333.5651-333.5661)

The “Michigan Dignified Death Act” is an informed consent law that ensures that patients with advanced illness have the ability to make informed decisions to receive, continue, discontinue, or refuse medical treatment. An advanced illness is defined under the law (MCL 333.4653(1)(a)) as a “medical or surgical condition with significant functional impairment that is not reversible by curative therapies and that is anticipated to progress toward death despite attempts at curative therapies or modulation, the time course of which may or may not be determinable through reasonable medical prognostication.” 

Under the law, a physician who has diagnosed a patient with an advanced illness and is recommending medical treatment (including treatment received during the course of a clinical trial) must:

  • Orally and in writing inform a patient that he/she can designate a patient advocate to make medical treatment decisions on his behalf in the event he is not able to participate in his medical treatment decisions because of his medical condition.
  • Orally inform the patient, the patient’s surrogate, or (if applicable) the patient advocate about the recommended treatment and alternatives, as well as the advantages, disadvantages, and risks associated with the recommended medical treatment and the alternative medical treatments. 
  • Orally and in writing inform the patient, patient’s surrogate, or patient advocate that the patient has the right to make an informed decision regarding receiving, continuing, discontinuing, and refusing medical treatment, as well as the right to choose palliative care treatment and appropriate pain and symptom management.

A physician may provide the patient, patient surrogate, or patient advocate a copy of a standardized written summary produced by the Michigan Department of Community Health that contains the above information. More resources are available from the MDCH.

B. Confidentiality of and Access to Research Records and Other Information

Confidentiality of patient records and research records is governed by both federal and state law.

1. General Research Records

The “Confidential Research and Investment Information Act,” MCL 390.1551-390.1557, exempts from disclosure under the Michigan Freedom of Information Act (FOIA, MCL 15.231-MCL 15.246; see below) intellectual property created by individuals employed or contracted by the University for research, education, and related activities until a reasonable opportunity has been provided to publish. The law also protects copyrightable and patentable information, until a reasonable opportunity has been provided to obtain a copyright or patent. Additional laws and regulations provide more limited protection to certain research information, including MCL 333.2611 (MDCH-supported health services research).

2. Research Involving Use or Disclosure of Patient Health Information

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) has issued privacy and security regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). These regulations protect against unauthorized use and disclosure of individually identifiable information created or received by health plans, health care clearinghouses and most health care providers ("covered entities"). Components of the University that are covered entities and therefore directly regulated by HIPAA include:

  • U-M Health System Hospitals & Health Centers (including the U-M Medical School);
  • IU-M Group Health Plans;
  • Mary A. Rackham Institute (University Center for the Child and Family, University Center for Language and Literacy, and the Adult Psychological Clinic);
  • School of Dentistry Provider Clinics;
  • U-M-Flint Urban Health and Wellness Center; and
  • University Health Service.

In general, a covered entity may allow protected health information under its control to be used or disclosed for research only with written authorization. This authorization is described in 45 CFR 164.508. To be valid, the authorization must include at least the following information:

  • A description of the information to be used or disclosed that identifies the information in a specific and meaningful way;
  • The names or other identification of the specific people or categories of people (e.g., "your primary care physician" or "your health care providers") who can make the use or disclosure;
  • The names or other identification of the specific people or categories of people who may receive the information (e.g., "the U-M," "the researchers," "the IRB and other University officials," "study sponsors," "government oversight agencies");
  • A description of each purpose of the authorized disclosure (e.g., "to conduct the study," "to analyze any adverse reactions to the study intervention," "for study oversight,");
  • An expiration date (e.g., January 1, 2016) or expiration event (e.g., "one year from signing" or "at the end of the study" or "none");
  • Signature of the individual (or the person's legally authorized representative) and date;
  • A statement of the individual's right to revoke his or her authorization in writing and any exceptions to that right;
  • Whether treatment or payment will be conditioned on granting the authorization; and
  • The potential for the information used or disclosed for the research to be redisclosed and no longer protected by HIPAA.

This authorization must be written in plain language. This information may be incorporated into a research consent form or provided separately to prospective subjects, depending on the requirements of the IRB overseeing the research. In limited cases (described in 45 CFR 164.512), an IRB or Privacy Board may waive these authorization requirements.

In addition to the federal privacy and confidentiality standards, Michigan law (MCL 333.20201) generally provides that patients are entitled to the privacy of their medical information and prohibits hospitals and other health facilities from providing copies of patient medical records to third parties without prior authorization. Patients may refuse the release of their records outside a health facility except as required for transfer to another health facility or as required by law or third party payment contract. 

Federal and Michigan law also provides additional confidentiality protections to certain types of records.

(a) Information Pertaining to HIV/AIDS (MCL 333.5131)

All reports, records, and data pertaining to testing, care, treatment, reporting, and research, and information pertaining to partner notification under MCL 333.5114a, that are associated with serious communicable diseases or infections of HIV infection and acquired immunodeficiency syndrome (AIDS) are confidential and can only be released pursuant to Michigan law.

Michigan law (MCL333.5131) allows the disclosure of information pertaining to HIV infection or acquired immunodeficiency syndrome (AIDS) in the following situations:

  • In response to a court order, but only if (1) the court determines that other ways of obtaining the information are not available or would not be effective; and (2) the public interest in and need for the disclosure outweigh the potential for injury to the patient. The court order must:  limit disclosure to those parts of the patient’s record that are determined to be essential to fulfill the objective of the order; limit disclosure to those individuals whose need for the information is the basis of the order; and include other measures necessary to limit disclosure for the protection of the patient.
  • To the Michigan Department of Community Health, a local health department, or other health care provider (1) to protect the health of an individual; (2) to prevent further transmission of HIV; (3) to diagnose and care for a patient.
  • By a physician or local health officer to a known contact of the individual who is HIV infected or has been diagnosed as having acquired immunodeficiency syndrome (AIDS), if the physician or local health officer determines that disclosure is necessary to prevent a reasonably foreseeable risk of further transmission of HIV. (In this case, the physician or local health official has a duty to disclose the information to the known contact or to refer the  individual who is HIV infected or has been diagnosed as having acquired immunodeficiency syndrome (AIDS) to a local health department for assistance with partner notification.  The referral shall include available contact information for known contacts of this individual.)  To the extent released, the information should not identify the individual to whom the information pertains unless reasonably necessary to prevent a foreseeable risk of transmission.
  • If the disclosure is expressly authorized in writing by the individual who is HIV infected or has been diagnosed as having acquired immunodeficiency syndrome (AIDS). Written authorization must be specific to HIV infection or acquired immunodeficiency syndrome a minor or incapacitated, written authorization may be executed by the parent or legal guardian of the individual.
  • As otherwise required or permitted by Michigan law.

(b) Mental Health Treatment (MCL 330.1748)

Michigan law accords special protection to the privacy of mental health records. Mental health information may be disclosed as necessary for outside research, evaluation, accreditation, or statistical compilation. In this case, the individual subject should not be identified in the disclosed data set unless the identification is essential to achieve the purpose for which the information is sought or if preventing the identification would clearly be impractical. Under no circumstances may the information be disclosed if the subject is likely to be harmed by the identification.

In general, information in the record of a recipient of mental health services must be kept confidential and only may be disclosed with specific authorization of the recipient, with the following exceptions:

  • If the recipient is a child, the authorization may be granted by the recipient’s parent with legal custody.
  • If the recipient is an incompetent adult, authorization may be granted by the recipient’s legal guardian.
  • If the recipient is deceased, the authorization may be granted by the personal representative or executor of the estate. 

The law also significantly restricts any redisclosure. Even when information is disclosed, the identity of the person to whom it pertains should be protected whenever feasible.

(c) Substance Abuse Treatment (42 CFR 2; MCL 330.1260-330.1287)

i. Federal Law

Federal law imposes restrictions upon the disclosure and use of alcohol and drug abuse patient records that are maintained in connection with the performance of any federally assisted alcohol and drug abuse treatment program. These regulations prohibit the disclosure and use of patient records unless certain circumstances exist. If a patient consents to a disclosure of his records, a program may disclose his records in accordance with that consent to any individual or organization named in the consent. The consent must include the following nine elements:

  • The specific name or general designation of the program or person permitted to make the disclosure;
  • The name or title of the individual, or name of the organization, to whom the disclosure is to be made;
  • The name of the patient;
  • The purpose of the disclosure;
  • How much and what kind of information is to be disclosed;
  • The patient signature (or signature of legally authorized representative);
  • The date of signature;
  • A statement that authorization may be revoked at any time except to the extent it already has been relied on to make a disclosure; and
  • The date, event, or condition upon which authorization will expire if not revoked (the authorization may not last longer than reasonably necessary to serve the purpose for which it is given).

Further, per federal law (42 CFR 2.52), patient-identifying information may be disclosed for the purpose of conducting scientific research if the program director makes a determination that the recipient of the patient-identifying information:

  • Is qualified to conduct the research;
  • Has a research protocol under which the patient-identifying information: i) will be maintained in accordance with federal security requirements (42 CFR § 2.16) or more stringent requirements; and ii) will not be redisclosed; and
  • Has provided a satisfactory written statement that a group of three or more individuals who are independent of the research project has reviewed the protocol and determined that: i) the rights and welfare of patients will be adequately protected; and ii) the risks in disclosing patient-identifying information are outweighed by the potential benefits of the research.

ii. Michigan Law

Per Michigan law, substance abuse diagnosis, prognosis, and treatment records are confidential and may be disclosed only with consent of the individual to whom the record pertains. The individual may withdraw consent at any time unless prohibited by federal law.

Without the individual’s consent, the content of his records can be disclosed only as follows:

  • To medical personnel, to the extent necessary to meet a bona fide medical emergency;
  • To qualified personnel, for the purpose of conducting scientific statistical research, financial audits, or program evaluation, but the personnel shall not directly or indirectly identify an individual in a report of the research audit or evaluation or otherwise disclose an identity in any manner; or
  • By court order, as described in MCL 330.1263.

3. Research Involving Student Records

The Family Educational Rights and Privacy Act (FERPA) (See 20 U.S.C. 1232g; 34 CFR 99) governs the disclosure of personally identifiable information from “education records” and access to education records by parents and eligible students. Note that FERPA does not apply to de-identified information from education records. FERPA applies to all public elementary and secondary schools as well as post-secondary institutions that receive federal funding through the U.S. Department of Education. The U-M is subject to FERPA.

“Education records” are defined under FERPA as records that directly relate to a student and that are maintained by an educational agency or institution, or a third party on the institution’s or agency’s behalf. “Education records” generally do not include the following: records maintained by law enforcement units, employment records related to students in their capacity as employees, provided that the employment is not a result of the person’s status as a student; medical records made by a physician, psychiatrist, psychologist, or other health professional for treatment of the student and disclosed only to individuals providing the treatment; and records created or received by an institution or agency after an individual is no longer a student at the institution and that are not directly related to the individual’s attendance as a student.

FERPA generally requires consent before “personally identifiable information” from a student’s education records can be disclosed. “Personally identifiable information” includes the student's name; the student’s or parent’s name or address; the student’s social security or student identification number; or other direct or indirect identifiers (such as birth date, place of birth, or mother’s maiden name) that could permit identification of the student. Consent must be provided by the either the parent or, if the student is 18 or older or is attending a postsecondary educational institution, by the “eligible student.”

Under FERPA, for consent to be valid, it must be written, signed, and dated, and must specify the records to be disclosed, the purpose of the disclosure, and the person or class of persons to whom the disclosure may be made. The FERPA regulations permit electronic consents, as long as they are in a form that identifies and authenticates a particular person as the source of the electronic consent. 

There are a number of situations in which FERPA allows disclosure of personally identifiable information from education records without prior written consent. Two exceptions are especially relevant in the research context:  1) disclosures of directory information (the “directory information exception”), or 2) disclosures to organizations conducting studies for, or on behalf of, educational agencies or institutions (the “study exception”).

(a) Directory Information Exception

An educational institution may disclose directory information without specific consent if it has given public notice to parents and eligible students of the types of information included in the institution’s definition of “directory information” and the right to opt out of disclosure of any or all types of directory information. (Some information, such as social security number, is considered too sensitive and may not be named as directory information.) If a parent or eligible student does not opt out, then the institution may disclose directory information without specific consent. An institution may also disclose the directory information of former students without notification or consent. 

As a postsecondary institution, at the U-M, only the student, and not the parents, has the right to opt out of disclosures of directory information. The U-M has defined “directory information” to include name, address and telephone number, U-M school or college, class level, major field, dates of attendance at the U-M, current enrollment status, degree(s) received and date(s) awarded, honors and awards received, participation in recognized activities, previous school(s) attended, and height and weight of members of intercollegiate athletic teams. More information can be found on the Office of the Registrar’s website.

(b) Study Exception

The exception permitting disclosure of personally identifiable information from education records for certain research activities conducted on behalf of educational institutions is limited. First, the exception applies only to research to develop, validate, and administer predictive tests; to administer student aid programs; or to improve instruction. Second, researchers must use the data provided only for these stated research purpose(s) and must do so in a way that would not permit personal identification of parents or students by individuals other than the researcher and those on the study team with legitimate interests in those data. Third, any personal information used in the study must be destroyed when it is no longer needed for the study. Finally, per 34 CFR 99.31 (a)(6)(iii)(C), the institution disclosing the personally identifiable information must enter into a written agreement with the researcher conducting the study on its behalf that commemorates the points above, as well as:

  • Specifies the purpose, scope, and duration of the study; 
  • Specifies the information to be disclosed; and
  • Sets forth “the time period in which the information [provided] must be destroyed.”

If a researcher violates these requirements, the educational institution that had disclosed personally identifiable information to that researcher may not allow that researcher to access personally identifiable information from education records for at least five years.

Although the study exception is framed as requiring the research to be undertaken “for, or on behalf of,” the disclosing institution, the FERPA regulations make clear (34 CFR 99.31 (a)(6)(iv)) that the educational institution authorizing the study “is not required to initiate a study or [to] agree with or endorse the conclusions or results of the study.”

In summary, any researcher who seeks to use personally identifiable information from student education records must consider FERPA. Even researchers who are affiliated with the educational institution cannot automatically access personally identifiable information from education records unless they are conducting specific types of studies for or on behalf of the educational institution or unless one of the other exceptions to FERPA’s general consent requirements applies. If the research project does not fall into one of the three permitted categories of study (test development, student aid programs, improved instruction), and no other FERPA consent exception pertains, then the researcher needs to obtain individual consent (from the parent or eligible student, as appropriate) in order to view identified files. IRB approval of the research project does not constitute institutional permission to access education records. Moreover, institutions (including the U-M) may require researchers to sign written agreements that go beyond the requirements of the study exception, described above, before accessing identifiable information from education records.

If the records are de-identified by the removal of all personally identifiable information, and the educational institution “has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information,” (34 CFR 99.31(b)(1)), then FERPA no longer applies, and the de-identified information can be released without specific consent. Again, though, many institutions, including the U-M, still require researchers to sign written agreements before accessing even de-identified information from education records, and IRB approval or exemption of the research project does not constitute institutional permission to access the requested records.

4. Mandatory Disclosure Requirements

Various state laws require University personnel to report information that might otherwise be considered confidential. Only Michigan law is discussed below. Researchers are responsible for complying with the laws of other states, when applicable.

(a) Michigan Freedom of Information Act

The Michigan Freedom of Information Act (FOIA) (MCL 15.231-15.246) requires “public bodies” including the U-M to allow people to inspect, copy, or receive copies of “public records.” A public record is defined as “a writing prepared, owned, used, in the possession of, or retained by a public body in the performance of an official function, from the time it is created.” Most records created by University faculty, staff, and trainees in the performance of their University functions, or retained on University property or in University electronic resources, are public records subject to disclosure under FOIA. However, the institution must deny requests for student education records subject to the protections of FERPA. In addition, the Confidential Research and Investment Information Act (CRIIA)(MCLA 390.1551-1557) offers some exemptions from disclosure for some sensitive materials provided by research partners and sponsors. 

(b) Public Health Reporting: Disease Surveillance

Michigan has adopted laws and regulations requiring disclosure by physicians, laboratories, and other health care professionals and facilities of certain information for public health activities. Mandatory reporting requirements apply to the following health-related services or events:

  • Abortions, within 7 days after the procedure (MCL 333.2835), including any resulting physical complications (MCL 333.2837)
  • Live births, within 5 days of the birth (MCL 333.2821)
  • Birth defects (defined to include congenital or structural malformations and biochemical or genetic diseases present at birth), as well as information relevant to incidents of birth defects, within 30 days of diagnosis, regardless of when detected (MCL 333.5721 and Mich. Admin. Code R. 325.9072)
  • Cancer diagnosis, within 180 days of diagnosis or initial treatment (MCL 333.2619 and Mich. Admin. Code R 325.9052)
  • Communicable diseases, within 24 hours, 3 working days, or 1 week, depending on the diagnosis (MCL 325.71-325.79; MCL 333.5111 and Mich. Admin. Code R. 325.171-325.199) (Additional information can be found on the MDHHS website.)
  • Deaths, within 48 hours of pronouncement (report to be made by personal physician or attending physician (MCL 333.2843)
  • Fetal death (defined as death of a fetus which has completed at least 20 weeks of gestation or weighs at least 400 grams), within 5 days of delivery (MCL 333.2834; 333.2803)

If these events occur during a research study conducted at a University health facility or by University health professionals, they generally must be reported as required by the Michigan Department of Community Health.

(c) Mandatory Reporting Abuse, Neglect, and Violence

Michigan has enacted laws designed to protect children and vulnerable adults from harm by requiring various professionals to report suspected abuse or neglect.

The following is a description of Michigan laws on mandatory abuse, neglect, and domestic violence reporting. When a researcher can reasonably anticipate that mandatory reporting requirements will be triggered during the course of a project (for example, where the researcher is a mandatory reporter and (i) members of these vulnerable populations are likely to be recruited to participate in the study or (ii) the researcher plans to explicitly question subjects about any history of abuse, neglect, or domestic violence), the informed consent discussion and document should include a description of the researcher’s mandatory reporting obligations.

i. Child Abuse and Neglect (Michigan Child Protection Law; MCL 722.621-722.638)

Physicians and other licensed healthcare professionals, social workers, school administrators, counselors, teachers, law enforcement officers, clergy members, and child care providers with reasonable cause to suspect child abuse or neglect are required to report their suspicions to Child Protective Services. The Michigan Department of Human Services maintains a list of professions required to report suspected child abuse or neglect. Failure to report may result in a misdemeanor conviction punishable by fines, civil penalties, civil liability for damages proximately caused by the failure to report, and up to three months in prison. Similar sanctions may be imposed for intentionally making false reports. In general, however, individuals who make reports in good faith are immune from liability for those reports. Note that withholding consent for medical treatment for a child based on a parent’s religious beliefs does not necessarily constitute abuse or neglect.

ii. Vulnerable Adults (MCL 400.11a)

The Michigan Social Welfare Act imposes similar reporting requirements and provides similar immunities for reporting suspected abuse or neglect of “vulnerable adults.” The term “vulnerable adults” refers to individuals who are unable to protect themselves because of mental or physical impairment or because of advanced age. Individuals who are required to make reports under this law include those who are employed, licensed, registered, or certified to provide health care, educational, social welfare, mental health, or other human services; employees of agencies licensed to provide these services; law enforcement officers; and certain medical examiners. There are penalties for failing to make a mandatory report.

iii. The "Gun and Knife Law" (MCL 750.411)

Although many people refer to this statute as the “gun and knife law,” the term is a misnomer. The law requires hospitals, pharmacies, and their managers to report immediately to law enforcement authorities any person brought to these facilities with a “wound or other injury inflicted by means of a knife, gun, pistol, or other deadly weapon, or by other means of violence.” It likewise requires physicians treating patients with these types of injuries to report.

(d) Court Orders and Subpoenas

A court order, administrative agency record request, or subpoena may be issued to require an institution (such as a hospital or university) or an individual (such as a researcher) to give testimony or to provide documents related to a case or other controversy. These documents often require release of confidential research records or clinical information. A University faculty, staff member, or trainee who receives a subpoena or court order related to University research should consult with an attorney in the Office of the Vice President and General Counsel at (734) 764-0304.

5. Protecting Against Disclosure: Certificates of Confidentiality

Certificates of Confidentiality (CoCs) are issued by the National Institutes of Health (NIH), and the Centers for Disease Control and Prevention (CDC) to protect the privacy of research subjects by allowing investigators and institutions to avoid compulsory release of information that could be used to directly or indirectly identify subjects participating in a research project. Certificates of Confidentiality are issued to institutions or universities where the research is conducted. They allow the investigator and others who have access to research records to refuse to disclose identifying information in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. A project may receive protection under a Certificate of Confidentiality even if the project is not sponsored or funded by NIH, as long as, in NIH’s view, the subject matter of the study falls within a mission area of the NIH, including its Institutes, Centers, and the National Library of Medicine. The CDC only issues CoCs for research sponsored by the CDC or for the Agency for Toxic Substances and Disease Registry (ATSDR).

Generally, any research project that collects personally identifiable, sensitive information and that has been approved by an IRB operating under either an approved FWA issued by the OHRP or the approval of the FDA is eligible for a Certificate. Information is considered sensitive if disclosing it could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation.

Usually, Certificates are issued for single, well-defined research projects following IRB approval. They may, however, be issued for cooperative multi-site projects under limited circumstances. Certificates are issued with expiration dates, but may be extended if the research continues past those dates. The protection afforded by a Certificate is in any event permanent; all personally identifiable information maintained about subjects in the study while the Certificate is in effect is protected forever.

Certain disclosures are permitted even when a Certificate has been issued. These include:

  • Voluntary disclosure of information by study subjects themselves or any disclosure that the study subject has consented to in writing, such as to insurers, employers, or other third parties;
  • Voluntary disclosure by the researcher of information on such things as child abuse, reportable communicable diseases, possible threat to self or others, or other voluntary disclosures provided that such disclosures are spelled out in the informed consent form;
  • Voluntary compliance by the researcher with reporting requirements of state laws, such as knowledge of communicable disease, provided such intention to report is specified in the informed consent form; or
  • Release of information by researchers to HHS as required for program evaluation or audits of research records or to the FDA as required under the federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.)

The existence of a Certificate, the protection it provides, and any limitations on that protection should be described in the informed consent form. The IO or his designee must sign the statement of CoC assurances before submission to NIH or CDC.

For more information about CoCs, see: 

C. Research Involving Prisoners and Other Detained Persons

Federal and institutional requirements for research involving prisoners and other detained persons are described in Part 7 of this OM and in special Bureau of Prisons regulations described in Section 4.a. and related guidance above. In addition, Michigan law (Mich. Admin. Code R. 791.733) requires correctional facilities to implement policies to prohibit the use of inmates for “medical, pharmaceutical, or cosmetic experiments.” This prohibition does not apply to individual treatment of an inmate based on the need for a specific medical procedure that is not generally available outside of the research. An IRB should not approve research that would be prohibited under this regulation, even if a particular facility has failed to implement the required policies.

D. Research Involving Pregnant Women, Fetuses, and Neonates

An IRB may approve University research involving pregnant women, human fetuses, neonates of uncertain viability, or nonviable neonates only if it meets the conditions described in Part 7 of this OM. Federal law describes the requirements for this type of research at 45 CFR 46 Subpart B and also in EPA regulations described in Section 5 and related guidance. 

Michigan law imposes additional requirements. Per MCL 333.2685-333.2691, a live human embryo, fetus, or neonate may not participate in non-therapeutic research if the research “substantially jeopardizes” its life or health, based on the judgment of the researcher and the available knowledge at the time of the research. Nontherapeutic research is prohibited if the researcher is aware that the embryo or fetus is subject to a planned abortion being performed for any purpose other than to protect the life of the mother. This prohibition does not apply to any diagnostic, assessment, or treatment procedures performed on the fetus with the purpose of either determining the life or status of the fetus or improving the health of either the fetus or the mother.

A dead fetus is not considered a “human subject” for purposes of the HRPP. However, Michigan law permits research on a dead embryo, fetus, or neonate only if the mother grants express written consent. This research is to be performed in accordance with the same standards applicable to research conducted pursuant to the Uniform Anatomical Gift Law.

E. Stem Cell Research

In addition to the limitations on embryonic research described above, Michigan law (MCL 333.16274 and 750.430a) prohibits “human cloning,” defined as “the use of human somatic cell nuclear transfer technology to produce a human embryo.” “Human embryo” means a human egg cell with a full genetic composition capable of differentiating and maturing into a complete human being. “Human somatic cell” means a cell of a developing or fully developed human being that is not and will not become a sperm or egg cell. “Human somatic cell nuclear transfer” means transferring the nucleus of a human somatic cell into an egg cell from which the nucleus has been removed or rendered inert. 

Michigan law does not, however, prohibit other scientific research or cell-based therapies.  The University has developed the U-M Policy on Research with Human Pluripotent Stem Cells including Human Embryonic Stem Cells and Induced Pluripotent Stem Cells, which describes the conditions, limitations, and restrictions imposed on stem cell research not otherwise prohibited by state law.

More information can be found in the NIH Guidelines on Human Stem Cell Research.

F. Document Control and Record Retention and Destruction

1. Generally

Document retention obligations may vary depending on the nature of the research and the academic unit with which the PI is affiliated. Generally, the most restrictive requirement applicable to a particular research record should be applied. Record retention requirements that may be applicable to research records include the following:

  • For any clinical research or other research involving the collection or use of protected health information (i.e., information subject to HIPAA requirements), the general rule of thumb is that documents must be retained at least 7 years after the last intervention or interaction with subjects (45 CFR 164.528). 
  • For FDA-regulated research, records must be retained the longer of: (i) 7 years after the last intervention; or (ii) 2 years after approval of the drug or device or, if there is no approval, then 2 years after termination of the study with FDA (21 CFR 312.57). 
  • All federal grant-related administrative/financial records must be maintained at least 3 years following the end of the grant (or in the case of a repeating 5-year grant, 3 years following the end of the relevant segment) (2 CFR 200.333). Private sponsors may require longer periods and this can be determined only by reviewing the sponsorship agreements on a case-by-case basis. 
  • Michigan law (MCL 333.16213) requires that licensed health care providers maintain patient records for seven years after the date of service, unless a longer federal or state requirement applies.
  • Because health care fraud and abuse laws allow the government to reach back up to 10 years ( 31 U.S.C. 3729), a 10-year retention period is recommended, but not mandated, where feasible for research that may be regulated by these laws. 
  • For other research, records should be retained for at least 3 years after termination of the study. 

2. IRB Responsibilities

Per 45 CFR 46.115 and 21 CFR56.115, each IRB is responsible for preparing and maintaining records adequate to document its activities, including:

  • Copies of all research proposals reviewed, scientific evaluations, if any, accompanying the proposals, approved sample consent documents, progress reports submitted by investigators, and reports of injuries to subjects;
  • Minutes of IRB meetings sufficiently detailed to show attendance at meetings; actions taken by the IRB; the vote on these actions, including the number of members voting for, against, and abstaining; the basis for requiring changes in or disapproving research; and a written summary of the discussion of controverted issues and their resolution;
  • Records of continuing review activities;
  • Statements of significant new findings provided to subjects;
  • Copies of all correspondence between the IRB and investigators;
  • A list of IRB members; and
  • SOPs.

These records must be retained for at least three (3) years. All records must be accessible for inspection and copying by authorized representatives of the University, relevant sponsors, and government authorities with jurisdiction (such as OHRP, FDA, and NIH) at reasonable times and in a reasonable manner.

G. State Professional Licensing Laws and Institutional Credentialing Policies

Articles 15 (MCL 333.16101-333.18838) and 17 (MCL 333.201010-333.22260) of the Michigan Public Health Code articulate the state’s professional licensing requirements. These laws limit who may practice in the various health professions, define the scope of practice of various types of licensees (e.g., doctors, nurses, dentists, psychologists, social workers, etc.), and describe whether and to what extent licensed professionals may delegate their functions to unlicensed individuals. They also often describe specific standards of practice for designated procedures or therapies. Similarly, institutional credentialing and privileging policies and determinations restrict who may practice at individual institutions and the specific procedures or treatments they are authorized to perform.

Generally, investigators and research staff may not perform functions for clinical trials that they are not otherwise eligible to perform for non-research purposes. Specific state licensing laws should be consulted if there is any question as to the appropriateness of an individual's functions in the context of a research study. For research conducted at Michigan performance sites, the following laws and regulations apply:

H. Clinical Trials Disclosure Requirements

The Food and Drug Administration Modernization Act (FDAMA), the Food and Drug Administration Amendments Act (FDAAA), and NIH policy mandate public registration of certain types of clinical trials. Failure to comply with these legal requirements may result in administrative sanctions and civil penalties and, when applicable, withholding or even possible repayment of NIH funding. 

Researchers involved in clinical trials must consider who the responsible party is for the purposes of registration and results reporting. When an Investigational New Drug Application (IND) or Investigational Device Exemption (IDE) is involved, the IND-holder is the Responsible Party. In other cases, it is generally the initiator of the trial who controls the protocol.

FDAAA requires Responsible Parties to register clinical trials information on (an NIH/National Library of Medicine databank) within 21 days of first participant enrollment for all Phase II through IV trials of all FDA-regulated drugs, biologics, and devices, whether FDA-approved or not. Consent forms for all of these “applicable clinical trials” (ACTs) must contain the following statement:  “A description of the clinical trial will be available on, as required by U.S Law. This website will not include information that can identify you. At most, the website will include a summary of the results. You can search this website at any time.” (21 CFR 50.25(c)). This statement is built into the IRBMED Informed Consent standard template.

In addition, certain pediatric post-marketing trials, required by FDA, must be registered, as well as Phase I trials of drugs, biologics or devices being tested to treat a serious or life-threatening disease or condition. Life-threatening conditions are defined to include diseases or conditions where the likelihood of death is high unless the course of the disease is interrupted; and diseases or conditions with potentially fatal outcomes, where the endpoint of clinical trial analysis is survival. 

Supplemental information (e.g., significant amendments, clinical holds) must be submitted within 30 days of any applicable changes and annual review of records and updating of information is required throughout the life of the trial.

Results reporting in is required for all ACTs of all drugs, devices, or biologics, or within 12 months of primary completion date, or 30 days of FDA approval (for any purpose, any population), whichever comes later.  

In addition, journals increasingly refuse to publish results of trials that were not adequately registered in a comparable registry prior to enrollment of the first participant. The International Committee of Medical Journal Editors (ICMJE), for instance, generally requires registration of research projects that prospectively assign human subjects to intervention and comparison groups to study the cause-and-effect relationship between a medical intervention (e.g., drug, surgical procedure, device, behavioral treatment, process-of-care change) and a health outcome (broadly defined, including pharmacokinetics).

Additional information about clinical trials registration requirements is available at, on the FDA web site, at the International Committee of Medical Journal Editors, and on the U-M Medical School’s Regulatory Affairs intranet, or by contacting the UMMS Office of Regulatory Affairs by email at or by phone at 647-1576.

III. Access to Legal Counsel

Members and staff of IRBs and other review units, have access to legal advice concerning application of the laws and regulations that affect human research through the U-M’s Office of the Vice President and General Counsel.