DNP IRB Proposal Help — Navigating Ethics Review for Your Capstone Project

Does Your DNP Capstone Project Need IRB Approval?

The federal definition of human subjects research under 45 CFR 46.102 determines whether a project requires IRB review: human subjects research is "systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge." The operative phrase is "generalizable knowledge." A project designed to improve care at a specific clinical site — using routinely collected data, implementing a locally validated practice change, with no intention of publishing the findings as generalizable research claims — typically does NOT constitute human subjects research under this definition.

Most DNP capstone quality improvement projects meet the non-research criteria: they use data routinely collected for quality surveillance (NHSN infection rates, NDNQI quality indicators, EHR audit reports), their primary purpose is to improve care at the specific site (not to test a hypothesis or contribute to nursing science), and their findings are intended for local use rather than external publication without a separate IRB submission. These projects qualify for a QI non-research determination — a formal letter from the IRB or designated reviewer confirming that the project does not constitute human subjects research and does not require IRB oversight.

A QI determination request is not the same as an IRB application. It is a shorter document — typically 2 to 5 pages — that describes the project and documents why it meets the 45 CFR 46 non-research criteria. Most institutions process QI determinations in 1 to 2 weeks, compared to 4 to 12 weeks for an IRB review of the same project incorrectly submitted as human subjects research. The common student error is automatically filing for Exempt IRB review when the project qualifies for a QI determination — this is faster to correct early in the proposal process than after the committee has approved a methodology built around an IRB approval that is not required.

QI vs Human Subjects Research: How IRBs Classify DNP Capstone Projects

The QI versus research classification is made by the IRB or a designated IRB representative — not by the student. The student documents the rationale and requests a formal determination; the IRB makes the official classification. The key questions the IRB considers:

Does the project use routinely collected data? Pre-existing EHR quality metrics, infection control surveillance data, administrative records, and quality dashboard reports are all routinely collected — no new data collection from patients or staff. If the answer is yes, the project is more likely to qualify as QI non-research.

Is the primary purpose to improve care at this specific site? If the project aims to fix a local quality problem — not to test a hypothesis that would be published as primary research — it is more likely to qualify as QI non-research.

Are the findings intended for generalisation beyond this site? QI projects are intended for local improvement. If the student plans to publish the results as a research article claiming generalisable findings, the project may require IRB review even if it otherwise qualifies as QI. Disseminating QI findings via a conference poster or internal presentation does not constitute generalisation in the IRB sense.

Projects that typically qualify as QI non-research: CAUTI bundle compliance improvement using NHSN data; fall prevention protocol using existing incident reports; medication reconciliation process change using pharmacy and EHR records; staff education program with pre-post competency assessment (when the assessment is for educational purposes, not research data collection).

Projects that typically require at least exempt or expedited IRB review: Prospective patient satisfaction surveys administered specifically for the project; new screening tool tested for validity and reliability in the clinical setting; intervention with any element of randomisation; qualitative interviews with patients or staff conducted specifically to collect data for the project; projects involving any Protected Health Information accessed beyond routine quality surveillance channels.

Gray area projects: Program evaluation capstones that include prospective surveys of program participants may require expedited review. EBP implementation projects that collect patient-reported outcomes using validated instruments prospectively may require expedited review. The IRB determination process resolves the classification — when in doubt, submit a determination request and let the IRB classify the project rather than self-determining.

Exempt, Expedited, or Full Board Review: Criteria and DNP Examples

Exempt Review (Categories 1 to 6 under 45 CFR 46.104): Exempt research involves human subjects but poses minimal risk and falls into one of six defined categories. The designation "exempt" means the research is exempt from ongoing IRB oversight — but it still requires an IRB determination that it qualifies for exemption. A student cannot self-designate a project as exempt. Category 2 (research involving educational tests, surveys, interviews, or observation of public behaviour with appropriate privacy protections) and Category 4 (secondary research using existing data, documents, or records that are publicly available or recorded so subjects cannot be identified) are the categories most frequently applicable to DNP capstone projects that go beyond QI non-research. Exempt review typically takes 1 to 4 weeks after submission of a complete application.

Expedited Review (Categories 1 to 9 under 45 CFR 46.110): Expedited review applies to research that presents no more than minimal risk and falls into one of nine defined categories. It is conducted by the IRB chair or a designated experienced IRB member — a full committee meeting is not required. Expedited review is appropriate for: prospective collection of data from adults using non-invasive instruments, including surveys and questionnaires; chart reviews with access to identifiable protected health information; voice or digital recordings for research purposes; and research using existing data for purposes for which it was not originally collected. PMHNP capstones involving mental health populations, even when conducted as QI, may require expedited review because mental health patients are classified as potentially vulnerable under 45 CFR 46.111. Expedited review typically takes 4 to 8 weeks.

Full Board Review: Required when research involves greater than minimal risk to participants or involves categories of participants requiring additional protections under federal regulations — children (Subpart D), prisoners (Subpart C), pregnant women (Subpart B), or participants who may have impaired consent capacity. Full board review requires a convened IRB meeting. DNP capstone projects rarely require full board review unless they involve a novel intervention with potential risk, a vulnerable population in a research context, or deception. Full board review timelines are institution-specific but typically run 6 to 12 weeks from submission. If a capstone is classified for full board review, the IRB timeline must be built into the Gantt chart from the beginning — a full board review requirement discovered after proposal approval will delay implementation by an entire semester.

Writing the IRB Protocol for a DNP Capstone: Section by Section

Whether the submission is a QI determination request, an exempt application, or an expedited protocol, the written document follows a standard structure. Each section must be complete and accurate — IRB reviewers return incomplete applications for revision, resetting the review clock to zero.

Project Title: Must exactly match the capstone proposal title. Inconsistencies between the proposal title, IRB title, and institutional site agreement title create administrative problems that delay implementation.

Principal Investigator (PI) and Research Team: The DNP student is listed as PI. The faculty advisor is listed as Faculty Supervisor or Co-Investigator. The clinical site supervisor or manager may be listed as Site Co-Investigator. All listed team members must have current CITI training certifications on file — CITI Human Subjects Research (Group 1 or Group 2 depending on institutional requirements), and GCP (Good Clinical Practice) if any FDA-regulated element is involved. CITI certifications expire after 3 years at most institutions; verify currency before submission.

Purpose and Significance: A concise statement (one to two paragraphs) of what the project will do and why it matters — drawn from the Chapter 1 significance section of the proposal. The IRB reviewer needs enough clinical context to understand the project but does not need the full Chapter 1 background.

Study Design and Methods: The design (QI, EBP implementation, program evaluation, mixed methods) and the methodology (pre-post, retrospective chart review, prospective survey). For QI determination requests: emphasis on the routinely collected data source and the local improvement intent. For exempt or expedited applications: full description of what data will be collected, from whom, using what instruments, at what frequency.

Participant Identification and Recruitment: How eligible participants are identified (clinical census, patient list, staff roster, quality database) and whether any direct participant contact occurs (for QI non-research using existing data: typically no direct participant contact). If surveys or interviews are involved: recruitment script, eligibility verification process, and voluntary participation statement.

Inclusion and Exclusion Criteria: Must match the PICOT P element exactly. Documented for the IRB record regardless of whether a formal informed consent process is required.

Data Collection Procedures: What data is collected (specific variables or fields), where it comes from (NHSN database, EHR audit report, validated survey instrument), who collects it (the DNP student, a designated unit staff member, automated report), when it is collected (baseline period dates, post-implementation dates), and how it is stored (encrypted institutional server, password-protected institutional laptop, secure cloud storage).

Risks and Benefits: For QI non-research and most exempt/expedited DNP projects: minimal to no direct risk to participants. State this clearly. Document the anticipated benefit — improved quality of care delivery for patients in the setting, demonstrated evidence-based practice implementation for the clinical unit, and generation of local quality improvement data for ongoing monitoring. Do not overstate benefits or risks — IRB reviewers recognise inflation in both directions.

Privacy and Confidentiality Plan: For de-identified aggregate data (most QI projects): HIPAA not triggered — the 18 Safe Harbor de-identification criteria have been met by the aggregate nature of the data. For individually identifiable data: specify the de-identification method (Safe Harbor — removal of all 18 PHI identifiers; or Expert Determination — statistical expert certifies re-identification risk is very small). Describe data access restrictions (who can access the raw data, from where) and storage security.

Data Security Plan: Specific, not general. "Data will be stored securely" is insufficient. "De-identified aggregate CAUTI rate data will be stored in a password-protected folder on [institution name]'s encrypted SharePoint server, accessible only to the DNP student and faculty advisor. No individually identifiable patient data will be collected or retained. Data will be destroyed by secure deletion 3 years after project completion per [institution name] data retention policy" is specific and reviewable.

Informed Consent Procedures: For QI non-research using existing quality data: waiver of informed consent not required because no human subjects research is conducted. For research requiring consent: include the consent form or script. For waiver of consent: document the four criteria under 45 CFR 46.116(f) — no more than minimal risk, waiver will not adversely affect rights and welfare, research could not practically be carried out without waiver, and participants will be provided additional information where appropriate.

HIPAA Compliance in DNP Capstone Projects

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule governs the use and disclosure of Protected Health Information (PHI). PHI includes any information that can be used alone or in combination to identify an individual patient — the 18 Safe Harbor identifiers include name, date of birth, all geographic data below state level, admission and discharge dates, phone numbers, account numbers, medical record numbers, Social Security numbers, and photographs or other biometric identifiers.

For most DNP QI capstone projects that use de-identified aggregate quality metrics (CAUTI rates per 1,000 catheter days, 30-day readmission rates, hand hygiene compliance percentages) — no individual patient data is accessed, no PHI is collected, and HIPAA is not triggered. The IRB protocol should confirm this explicitly: "No individually identifiable patient information will be accessed, collected, or stored. All outcome data will be obtained from de-identified aggregate quality surveillance reports generated by the [facility name] infection control department using NHSN reporting methodology."

When the capstone requires access to individually identifiable patient records — for chart review, prospective data collection using validated patient-reported instruments, or program evaluation surveys — the HIPAA authorization, waiver of authorization, or Limited Data Set agreement must be addressed in the IRB protocol. The waiver of HIPAA authorization is granted when the IRB determines the four criteria under 45 CFR 164.512(i) are met: the use or disclosure involves no more than minimal privacy risk, the waiver will not adversely affect patient rights or welfare, the research could not practically be conducted without the waiver, and the patient's privacy is protected to the extent possible. Most academic medical centres have a standard HIPAA waiver form that the student completes alongside the IRB application — confirm the required forms with the facility's research compliance office.

Hospital IRB and University IRB: Navigating Dual Review

When the student's university and the clinical implementation site are different institutions — as is the case for most DNP students implementing projects in a community hospital, FQHC, or health system that is not affiliated with their university — both the university IRB and the hospital IRB may require separate review. This dual review adds 4 to 8 weeks to the IRB timeline and creates coordination complexity that must be planned for in the Gantt chart.

Before submitting any IRB application, the student must determine whether the clinical site has a reliance agreement (also called an authorisation agreement or single IRB agreement) with the university. Under a reliance agreement, one IRB — typically the university's — serves as the single IRB of record for both institutions, and the other institution agrees to rely on that review rather than conducting a separate independent review. Many hospital systems affiliated with academic medical centres have pre-negotiated reliance agreements with nearby universities. The student should verify the existence of a reliance agreement with both the university IRB office and the hospital's research compliance office before beginning any application.

If no reliance agreement exists: submit to the hospital IRB first (most hospital IRBs process faster than university IRBs for minimal-risk projects), then submit to the university IRB with a copy of the hospital IRB approval or determination letter. Some university IRBs will accept the hospital IRB determination via institutional reciprocity without conducting an independent review — again, confirm this possibility with the university IRB office directly.