Not all human subject research falls under Federal Policy, and there may be differences in the types of review required based on the potential risk to the subjects. However, only an IRB can determine if a given research project falls under Federal Policy, or which aspects of the policy apply. Under Federal Policy, an authorized IRB can decide on policy that is more restrictive than Federal Policy, though never more lenient.
The policies of Cal Poly’s IRB are fully described in the PDF document "Policies and Procedures of the Institutional Review Board (IRB) (aka Policies and Procedures for Human Research Protection)" as published on September 11, 2007. It will be updated periodically with a date notation in applicable sections. Hard copies are available upon request from the Office of Research Compliance Associate.
In some studies, medical records are part of the data collected. The regulations of the Health Insurance Portability and Accountability Act may then apply for privacy protections of the subjects. This is a list of the identifiers which must be evaluated in HIPAA-type research.