Human Subjects Protection Training – Certification / Recertification

Boston University Medical Center requires that all researchers involved in human subjects research must receive formal training in the protection of human subjects. Further, we require that researchers be recertified every two years.

Who must be certified/recertified: The training requirement applies to all faculty, staff, students, visitors or any other individuals who work with human subjects in research or their data. Some examples include: individuals who obtain informed consent, administer study interventions such as surveys, or collect/analyze private or personal information from individuals. This policy applies to all individuals working with human subjects under the auspices of BUMC, whether here at BUMC or at another location, and regardless of their institutional affiliation or source of funding.

Research Certification

How to obtain your initial certification: Two types of certification are required for anyone who wants to do human research here at BUMC: 1) a certificate of completion of human subjects protection training from CITI; and 2) a certificate of completion of the BUMC HIPAA Module. Each researcher named on an IRB application must have certificates for both human subjects protection training and the HIPAA Module on file in the IRB office.


All new initial human subjects protection training must be done through CITI.

  • BUMC no longer offers on-site training for human subjects protection training certification.
  • BUMC no longer accepts the NIH/NCI on-line training to meet the requirements of human subjects protection training.
  • BUMC still accepts some certificates from other institutions for human subjects protection training (see “From Another Institution” below).


From CITI: All BUMC investigators who currently do not have human subjects protection training certificates, should use the CITI program to get one. Instructions for registering yourself in the CITI program can be found here. During registration, be sure to select “Boston University Medical Center” as your institutional affiliation (do not pick the “Boston University” option). Also, be sure to list your “” email address (if you have one) as the preferred email address. After entering other information about yourself, you will be presented with several curriculum options. As part of initial certification, you should select either the curriculum for Medical Campus Biomedical researchers or Medical Campus Social-Behavioral researchers, whichever is better aligned with your usual research (see image).

Biomed-SBER curriculum-cropped

After you complete the modules in whichever curriculum you selected, CITI automatically notifies the IRB office that you have been successfully certified.

From Another Institution: We will only accept CITI training from other institutions. If investigators are from other institutions and they only have NIH training, then they must do the BUMC CITI training. For investigators from other institutions and BUMC investigators who already have CITI Human Subjects Protection Training certificates from other institutions (this includes certificates from VA facilities), their CITI certificates from other institutions are accepted as documentation of human subjects protection training certification. These certificates should be emailed to or faxed to the IRB office (617-638-7234) with a cover letter requesting that this training be accepted as initial certification. **Please do NOT attach training certificates to INSPIR applications.


Initial certification also requires completion of the BUMC HIPAA module. This is done through CITI. Whether your Human Subjects Protection Training certificate is from BUMC CITI or from another institution (including the VA), everyone must complete the CITI BUMC HIPAA Module before they can be approved to perform human research at BUMC.

Go to the CITI website (as described here). From the list of available courses (see image below), select “BUMC HIPAA Module.” When you have completed the module, CITI automatically sends a notice of completion to the BUMC IRB office.


Research Recertification

 All BUMC human researchers must be recertified every two years. The next deadline for recertification is June 30, 2015. (See text box below if you should have gotten recertified before June 30, 2013 but missed that deadline.)


What to do if you should have gotten recertified before the June 30, 2013 deadline but didn’t:

You cannot be named as a researcher on any new protocol until you have been recertified.

To get recertified, you need to complete the two components of the June 30, 2013 recertification requirements:

General Component: To get credit for this component of the curriculum, you must correctly answer at least 36 of the multiple choice quiz questions from the Clinical Research Times monthly Feature Articles dating from September 2011 through February 2013 (Clinical Research Times).

HIPAA/Privacy Component: The March 2013 issue of the Clinical Research Times had a special Feature Article on the HIPAA and data privacy requirements for human researchers. There are 10 multiple choice quiz questions that correspond to that article. To get credit for this component of the curriculum, you must correctly answer at least 7 of these 10 questions correctly.

Note: Some investigators only need to complete the HIPAA/Privacy Component to meet the June 30, 2013 recertification requirements:

    1. Researchers who received their initial research certification after July 1, 2012
    2. Researchers who became BUMC/BMC employees after July 1, 2012 whose research certification had been obtained at their previous institution and accepted by our IRB.
    3. BUMC faculty, staff, and trainees who are primarily based at a VA facility and have met the VA’s recertification requirements. BUMC will accept this VA recertification. (However, these investigators must email a copy of their less-than-two-years-old CITI VA recertification form to or fax it to the IRB office (617-638-7234) with an explanatory cover letter.

      If you fall into one of these three groups, you only need to complete the HIPAA/Privacy Component to meet the June 30, 2013 recertification requirement.

      Primary teaching affiliate
      of BU School of Medicine