Initial Certification

How to obtain your initial certification: Two types of certification are required for anyone who wants to do human research here at BUMC/BMC: (1) a certificate of completion of human subjects protection training from the Collaborative Institutional Training Initiative (CITI); and (2) a certificate of completion of the BUMC HIPAA and Research Data Security course. Each researcher named on an IRB application must have certificates for both human subjects protection training and the BUMC HIPAA and Research Data Security course on file in the IRB office. (Note that the BUMC HIPAA and Research Data Security course appears in CITI in two places, as a separate module and within the human subjects protection training Basic courses. Take either one, and it will be reflected that you have completed this requirement.)

BUMC/BMC will accept CITI training that was completed at another institution. See below for instructions on how to transfer CITI certification to BUMC/BMC.


Individuals who are getting human subjects protection training certification through CITI for the first time

All BUMC/BMC investigators who currently do not have human subjects protection training certification, should use the CITI program to get one. Instructions for registering yourself in the CITI program can be found here. During registration, be sure to select “Boston University Medical Campus/Boston Medical Center” as your institutional affiliation (do not pick the “Boston University” option). Also, be sure to list your “” email address (if you have one) as the preferred email address.

After entering other information about yourself within CITI, you will be presented with several curriculum options. As part of initial certification, you should select in Question 1 either the curriculum for Medical Campus Biomedical researchers or Medical Campus Social-Behavioral researchers, whichever is better aligned with your usual research (see image).


After you complete the Basic CITI modules in whichever curriculum you selected, CITI automatically notifies the IRB office that you have been successfully certified.  There is no need to send your certificate to the IRB office.


Individuals who come to BUMC/BMC from other institutions

We will accept CITI training from other institutions. If investigators are from other institutions and they only have NIH training, then they must do the BUMC/BMC CITI training (see How to Obtain Your Initial Certification, above).

BUMC/BMC investigators who already have CITI Human Subjects Protection Training certificates from other institutions, need to affiliate themselves with “Boston University Medical Campus/Boston Medical Center” as their institutional affiliation in CITI (do not pick the “Boston University” option); this will transfer completed courses and individuals will then only be required to complete any additional courses exclusive for the BUMC/BMC institution. Instructions can be found here.

For VA investigators, their VA CITI certificates are accepted as documentation of human subjects protection training certification. These certificates should be emailed to or faxed to the IRB office (617-638-7234) with a cover letter requesting that this training be accepted as initial certification. **Please do NOT attach training certificates to INSPIR applications.

2)  BUMC HIPAA and Research Data Security:

Initial certification also requires completion of the BUMC HIPAA and Research Data Security course. This training and certification is done through CITI. Whether your Human Subjects Protection Training certificate is from BUMC/BMC CITI or from another institution (including the VA), everyone must complete the CITI BUMC HIPAA and Research Data Security course before they can be approved to perform human research at BUMC/BMC.

Go to the CITI website (as described here). From the list of available courses (see image below), select “BUMC HIPAA and Research Data Security.” When you have completed the module, CITI automatically sends a notice of completion to the BUMC IRB office.