This article contains two frequently asked questions about institutional review board (IRB) approval for projects within the Researcher Workbench. One pertains to IRB review for the All of Us Program and another relates to local institutional IRBs.

Do I need my project reviewed by the All of Us IRB to access data using the Researcher Workbench?

No. As noted in the All of Us Responsible Conduct of Research training, the Researcher Workbench employs a data passport model, through which authorized users do not need IRB review for each research project. Most authorized users will not be conducting human subjects research with All of Us data for two reasons:​ (1) The research will not directly involve participants, only their data; and (2) the data available in the Researcher Workbench has been carefully checked and altered to remove identifying information while preserving its scientific utility. ​Nevertheless, we encourage anyone using All of Us data to apply the ethical principles of research with human participants to their work.

You can read more in the letter confirming the All of Us Institutional Review Board’s regulatory opinion.

Do I need IRB approval from my own institution to access data through the Researcher Workbench?

Researchers should always check with their local institutional review board to ensure compliance with local requirements for conduct of research. We have provided the template language below as a resource to use for local IRB applications.

“The Registered Tier and Controlled Tier data available on the Research Hub contains data from participants who have consented to be involved in the All of Us Research Program, including data from electronic health records (EHRs), surveys, and physical measurements. All data available to researchers has had direct identifiers removed and has been further modified to minimize re-identification risks. This includes removing all explicit identifiers in both EHRs and participant provided information, all free-text fields, geolocation data smaller than U.S. state level, living situations, race and ethnicity subcategories, active duty military status, cause of death, and diagnosis codes subject to public knowledge. Additionally, the following demographic fields are generalized: race and ethnicity, education, employment, and information regarding sex at birth, gender identity, and sexual orientation. Also, all dates are systematically shifted backwards by a random number between 1 and 365, and data from participants over the age of 89 are removed. The All of Us Research Program data will be accessed for research strictly using the Researcher Workbench (researchallofus.org). External data can be brought into this secure environment; however, researchers are restricted from importing any individually identifiable information and from row-level linkage of the external data. Data searches, cohort building, and analysis will solely take place on the Researcher Workbench, a secure cloud-based resource with statistical analysis software available for use with All of Us data. Researchers are granted access to the Researcher Workbench after their affiliated institution signs a Data Use and Registration Agreement, and they create an account, including setting up two-factor authentication, verify their identity using login.gov, complete the All of Us Responsible Conduct of Research training, and sign a Data User Code of Conduct, which prohibits any re-identification of All of Us participants. For more information, please visit researchallofus.org.”