Loyola University Chicago

Institutional Review Board

Online Survey Research

Loyola University Chicago Policy for Online Survey Research Involving Human Participants


Computer- and internet-based methods of collecting, storing, utilizing, and transmitting data in research involving human participants are developing at a rapid rate. As these new methods become more widespread in research in the social sciences, they present new opportunities for potential enhancement of the dissemination of surveys to subjects while also affording new compliance challenges to the protection of research participants. The Loyola University Chicago (LUC) Institutional Review Board (IRB) believes that computer- and internet-based research protocols must address fundamentally the same risks (e.g., violation of privacy, legal risks, and psychosocial stress) and provide the same level of protection as the more traditional non-electronic methods of research involving human participants. All studies, including those using computer and internet technologies, must:

  • ensure that the procedures fulfill the principles of voluntary participation and informed consent
  • maintain the confidentiality of information obtained from or about human participants
  • adequately address possible risks to participants including psychosocial stress and related risks

The purpose of this guidance is to help researchers plan, develop, and implement computer- and internet-based research protocols that provide the same level of protection of human participants as more traditional research methodologies. The guidelines are comprised of requirements and recommendations that are consistent with the basic IRB principles applied to all research involving human participants.

Please also see the IRB's Online Survey Software Checklist


  • Computer- and internet-based procedures are increasingly being used by investigators for advertising and recruitment of study participants. The text of the recruitment script, the context in which the recruitment takes place (e.g. posting a message on a newsgroup, mass emailing, and websites created for recruitment of participants) must be reviewed and approved by the IRB.
  • LUC does not allow unsolicited group e-mailing by researchers to its faculty, staff, and/or students. If researchers wish to recruit LUC faculty, staff or students as participants in a study, permission to send emails to these groups must be approved by the Office of Research Services, and is regulated so that our students and faculty do not receive more than four such requests to participate in studies per calendar year. Students and faculty should call the Assistant Director for Research Compliance if they have any questions regarding subject recruitment emails sent out by investigators.
  • Investigators are advised that authentication - that is, proper qualification and/or identification of respondents - is a major challenge in computer- and internet-based research and one that threatens the integrity of research samples and the validity of research results. If the respondent population is not the population that is originally targeted by the research, the resulting data may not reflect what the research was originally intending to assess. Researchers are advised to take steps to authenticate respondents. For example, investigators can provide each study participant (in person or by U.S. Postal Service mail) with a Personal Identification Number (PIN) to be used for authentication in subsequent computer- and internet- based data collection.


The Office of Research Services (ORS) and Information Technology Services (ITS) have configured Qualtrics Survey Software to meet all of the following requirements. The use of any software used to conduct human subjects research must be approved by the IRB before implementation.

  • The LUC IRB requires that any identifiable data collected from human participants over computer networks be transmitted in encrypted format. This helps ensure that any data intercepted during transmission cannot be decoded and that individual responses cannot be traced back to an individual respondent. The IRB recommends using the highest level of data encryption available.
  • Researchers are cautioned that encryption standards vary from country to country and that there are legal restrictions regarding the export of certain encryption software outside US boundaries.

SERVER ADMINISTRATION: The server used for individually identifiable data storage must meet the following criteria:

  • The server is administered by a professionally trained person with expertise in computer and internet security.
  • Access to the server is limited to key project personnel.
  • The server is subject to the periodic vulnerability assessments to determine that the server is patched according to industry best practices.


  • If a server is used for data storage, personal identifying information should be kept separate from the data, and data should be stored in encrypted format.
  • It is recommended that data backups be stored in a safe location, such as a secure data room that is environmentally controlled and has limited access. It is also recommended that competent data destruction services be used to ensure that no data can be recovered from obsolete electronic media. Loyola researchers can provide hard drives and other electronic media to the Information Security group within Information Technology Services to ensure secure deletion. Depending on the type of media (such as CD-Rom or backup tapes), ITS may be forced to destroy the media to ensure deletion. Please contact the University Information Security Office by email at datasecurity@luc.edu for assistance.


The IRB will review proposed online surveys and designate them as either minimal risk or greater than minimal risk. The requirements for these two designations of surveys differ in the types of software allowed by LUC, but both types of surveys administered as part of non-exempt human subjects research projects must be approved by the IRB before any research activities involving the participants can be commenced.

LUC strongly recommends the use of the Qualtrics Survey Software as the university has determined that it meets the requirements outlined in the LUC checklist for survey software. The use of Qualtrics is required when researchers wish to do online surveys that are determined to be greater than minimal risk.

The Office of Research Services (ORS) and Information Technology Services (ITS) have worked together to modify the Qualtrics system securing both anonymity of the subjects being interviewed, and securing the data as it travels from the subject’s computer to the Qualtrics server, which is located inside the Loyola University perimeter firewall. This system is now secured in accordance with industry’s best practices.

Minimal Risk Surveys

When the IRB designates an online survey as minimal risk, researchers at LUC have the option of using various types of survey software provided they meet the requirements set forth in the LUC checklist for survey software (Click Here).

In order for researchers to use survey software to disseminate their surveys, the researcher must first submit their application for using human subjects in research to the IRB for review or confirmation of exemption. On the IRB application form, the researcher must designate whether they wish to disseminate their survey in paper or electronic form. The researcher must further designate whether Qualtrics or some other survey software will be used. If software other than Qualtrics is used, the researcher is responsible for verifying that the criteria on the LUC checklist for survey software are satisfied. The IRB will determine the risk classification of the survey and review the criteria from the LUC checklist. If the IRB designates the survey to be minimal risk, determines the survey software proposed satisfies the LUC checklist criteria, and approves the protocol, the use of that survey software will be permitted. After obtaining final IRB approval, a researcher who has a list of e-mail addresses can then send out the survey.

If the researcher conducting exempt work with human subjects decised to use Qualtrics software for their survey, the use of that software will be permitted. The IRB would still have to approve the protocol or confirm it is exempt before any research activities involving the participants begin. Upon approval of the application by the IRB, the researcher will be given a letter of approval, which can be taken to the Academic Technology Services office in ITS and request an appointment for setting up an Qualtrics account with which to begin survey construction (if it has not already begun, please refer to submission flowchart).

Greater than Minimal Risk Surveys

If a survey is determined to be greater than minimal risk by the IRB, the researcher will be required to use Qualtrics Software.  The researcher, upon approval of the protocol by the IRB, then, as mentioned above, sets up an account with ITS to construct the survey (if it has not already been done). Please consult with the IRB Application Process Flow Diagram for information on the various pathways of submission of applications to the IRB.

Additional Requirements for Online Surveys and Recruitment Emails Distributed to Loyola Participants

When researchers wish to survey LUC students, they must follow a priority system. The Office of the President has first priority for sending surveys to the student body, followed by Institutional Research and Academic Affairs. Other institutional surveys would be ranked 4th, followed by individual researcher surveys In order to minimize the number of surveys that any potential participant would be recruited for, the IRB will restrict researchers to the smallest sample size that will yield sufficient power. Any researcher wishing to have a sample of greater than the number of Loyola participants that the IRB deems as statistically appropriate, would need to seek permission from ORS and the IRB. Requests of this nature will be considered on a case-by-case basis.

Any potential Loyola participant should only receive a maximum of two original recruitment emails per year (maximum of 2 protocols per year) for online survey research. Researchers may send a maximum of 5 follow-up emails to participants per protocol. Requests for additional recruitment emails will be considered by the IRB on a case by case basis.

The above guidelines have been put into place as the IRB is concerned that student responses to surveys will be lowered because of excessive recruitment emails.


  • Internet consent documents should be written like a cover letter and should include all the elements of the regular signed consent, including the confidentiality disclaimer given below. The consent line should say, "By completing the survey you are agreeing to participate in the research". Other Internet-based surveys include "I agree" or "I do not agree" buttons on the website for participants to click their choice of whether or not they consent to participate.
  • The following statement is required to be listed on the consent form: “Confidentiality will be maintained to the degree permitted by the technology used. Your participation in this online survey involves risks similar to a person’s everyday use of the Internet.”
  • The consent must disclose that if a participant completes an anonymous survey and then submits it to the researcher, that the researcher will be unable to extract anonymous data from the database should the participant wish it withdrawn.
  • If the IRB approves research, which requires documented consent, and does not maintain the anonymity of participants, the researcher may email the consent form to participants who may then type their name and the date into the spaces provided on the consent form, and returns it to the researcher via email, if the IRB determines that documented consent is required.  Some survey programs allow a similar consent process to be built into the survey itself, which can also be permitted by the IRB.

IRB Main Page