For organizations that have institutional review boards (IRBs) and whose research is subject to federal regulation:

• The practices and recommendations highlight some practices already in place in some IRBs and suggest additional support for IRB activities.

For organizations that use or disclose data but do not have an IRB or whose work is not subject to federal regulation:

• The practices and recommendations emphasize that the protection of human subjects from risks, including nonphysical risks from use of data, are of concern to anyone who uses or discloses data.

Although not all organizations have IRBs, all human subjects should be treated with the same high standards. The committee urges organizations that do not have IRBs to adopt practices of reviewing proposed investigations to assure that data confidentiality will be maintained. The committee likewise urges organizations that have, as well as those that do not have, IRBs to adopt system-wide confidentiality procedures and policies to protect nonresearch and research data.