Ethics Review for Federated Multi-Site Studies
Ethics review for a federated multi-site study means obtaining research ethics approval for a study in which the analysis travels to each participating site and the individual-level data stays where it is held. In most jurisdictions the study still needs a favorable opinion from a research ethics committee or institutional review board (IRB), but a federated design simplifies the review: there is no transfer of identifiable records to describe, fewer data-sharing risks to mitigate, and a clearer case for single or streamlined review across sites. The key is to write the protocol so reviewers can see exactly what runs where and what leaves each site.
Why ethics review for multi-site studies is changing
Multi-site research used to mean multiplying the paperwork. Each participating institution ran its own review, raised its own questions, and approved its own version of the protocol. Studies lost months to that duplication, and small differences between local approvals created inconsistencies in what each site was allowed to do.
Regulators have pushed back on that model. In the United States, the revised Common Rule requires most federally funded cooperative research to use a single IRB, a requirement codified at 45 CFR 46.114 and in effect since January 2020. In the United Kingdom, the Health Research Authority (HRA) coordinates a single ethics opinion from one research ethics committee that covers all participating sites, combined with HRA approval. In the European Union, the Clinical Trials Regulation (EU) No 536/2014 created a single submission route for interventional trials across member states, though observational research is still reviewed under national rules.
At the same time, the way data is analyzed has changed. The May 2026 UK Biobank incident showed that approved researchers could move data out of a centralized platform through its normal workflow. Ethics committees now pay closer attention to where data actually goes during a study, not only to who is allowed to see it. A federated design gives them a much simpler answer.
What ethics committees look for in a federated study
Clarity about what moves
The first question a committee asks about any multi-site study is what happens to participants’ data. In a conventional design the answer includes extraction, transfer to a central team, storage, analysis, and eventual destruction. In a federated design, the answer is shorter: approved code is sent to each site, runs inside that site’s secure environment, and returns only aggregate results that have been checked for disclosure risk. Because data never leaves the source, the committee is reviewing one well-defined output channel rather than a chain of transfers.
The protocol should make that explicit. Describe the analysis environment at each site, the types of output that can leave (counts, model coefficients, summary statistics), the minimum cell sizes or other disclosure rules applied, and who approves releases.
Consent and its limits
Federation does not replace consent. Committees still ask whether participants agreed to research use of their data, whether the proposed use falls within that consent, and, if consent is not being sought, whether a waiver or alternative legal basis is justified. In the US, the Common Rule allows IRBs to waive consent under defined conditions at 45 CFR 46.116(f). In Europe, GDPR Article 89 governs the safeguards that allow research to rely on certain derogations; our guide to the GDPR Article 89 research exemption explains how it interacts with consent.
A federated design strengthens the argument for proportionality. When a committee weighs the burden of seeking fresh consent from thousands of historical patients against the privacy risk of the research, a design that never exports identifiable records sits at the low-risk end of that balance.
Local context still matters
Single review does not mean local considerations disappear. Sites may have institutional policies, community agreements, or national laws that go beyond the central opinion. Indigenous data governance principles, such as the CARE Principles for Indigenous Data Governance, can require community-level approval that no central committee can grant. The protocol should identify these local requirements and explain how each site’s governance process connects to the central ethics opinion.
Centralized vs federated designs: what changes for ethics review
| Review question | Centralized multi-site study | Federated multi-site study |
|---|---|---|
| Where individual-level data is processed | At a central coordinating center after transfer | At each site, inside its own secure environment |
| Data transfer agreements | Needed between every site and the central team | Usually limited to agreements covering code deployment and aggregate outputs |
| Cross-border transfer questions | Must be justified for each country pair | Largely avoided, because individual-level records are not transferred |
| Re-identification risk | Concentrated in the central dataset and any linked copies | Managed through output checking on each release |
| Retention and destruction | Central copies must be tracked and destroyed | Source data stays under existing custodian retention policies |
| Case for consent waiver | Harder, because identifiable data leaves the site | Stronger, because the privacy intrusion is smaller |
| Local review burden | Often duplicated across sites | Can focus on local context and site readiness |
A practical framework for the application
Teams that get federated studies through ethics review quickly tend to follow the same sequence.
- Choose the review route first. Identify whether single IRB, HRA single opinion, or national lead-committee review applies, and confirm which sites will rely on it. In the US, reliance agreements such as those coordinated through the SMART IRB platform formalize that arrangement.
- Describe the architecture in plain language. Include one diagram showing what runs at each site and what comes back. Avoid vendor jargon. Committees include lay members, and they need to understand the design.
- Specify the outputs. List every type of result that will leave a site and the disclosure rules applied to it. Our explainer on output checking and statistical disclosure control covers the common rules.
- Address consent directly. State the consent basis at each site. Where consent differs between sites, explain how the analysis respects the narrowest applicable terms.
- Name local requirements. List any site-level approvals, community agreements, or national rules, and who at each site is responsible for them.
- Plan amendments. Explain how new sites, new analyses, or new data types will be added, and which changes will trigger a substantial amendment.
It helps to align the ethics application with the Data Protection Impact Assessment and the data access committee submission. All three ask about purpose, data flows, risks, and safeguards. Writing one consistent description of the federated architecture and reusing it across the three saves time and removes contradictions that reviewers are quick to spot.
The federation angle
A federated Trusted Research Environment (TRE) turns the ethics narrative from promises into system properties. In Lifebit’s federated TRE, each data custodian hosts its own environment, researchers submit analyses that run where the data sits, and every output passes an automated airlock that applies disclosure control rules before anything is released. Audit logs record who ran what and what left. Those are the details committees want to see, and they can be demonstrated rather than simply asserted.
Harmonization matters for ethics too. When every site maps its data to a common model such as the OMOP Common Data Model, one analysis package runs unchanged at every site. That makes the protocol easier to review, because the committee approves one analysis rather than a family of site-specific variants. It also reduces the risk of protocol deviations at individual sites.
Real-world practice
Federated network studies are now routine in observational research. The Observational Health Data Sciences and Informatics (OHDSI) community has run many multi-country studies in which each partner executes a standardized package against its own OMOP-mapped data and shares only aggregate results, with each partner handling its local governance requirements. In the UK, TREs built around the Five Safes framework give committees a familiar structure for assessing safe projects, people, settings, data, and outputs.
Lifebit supports custodians including Genomics England and CanPath with federated infrastructure in which the data stays under the custodian’s control and approved research comes to it. For a closer look at how multi-site observational designs run on that pattern, see running multi-site observational studies without moving data.
Common pitfalls
Assuming federation removes the need for review
It does not. A federated study still involves human participants’ data and still needs an ethics opinion where the law or institutional policy requires one. Federation lowers the risk profile; it does not exempt the study.
Vague output descriptions
Saying “only aggregate results will be shared” is not enough. Committees know that small aggregates can reveal individuals. Specify the rules and who enforces them.
Inconsistent consent across sites
If one site’s consent covers commercial research and another’s does not, the study must respect that difference. Build the restriction into the analysis plan rather than leaving it to each site to catch.
Treating amendments as an afterthought
Federated networks grow. Without a clear amendment plan, every new site becomes a fresh negotiation with the committee.
What to do next
Before drafting the application, write a one-page description of your study’s data flow that a lay committee member could follow. If that page includes transfers of identifiable records between institutions, ask whether a federated design could remove them. The shorter the data flow, the shorter the review. For background on the environment that makes this possible, read Lifebit’s guide to the federated Trusted Research Environment.
Frequently asked questions
Does a federated study still need ethics approval?
Yes, in most cases. A federated design reduces privacy risk because individual-level data stays at each site, but research using human participants’ data still needs a favorable ethics opinion wherever the law or institutional policy requires one.
Can one ethics committee approve a federated study across all sites?
Often, yes. The US requires a single IRB for most federally funded cooperative research, and the UK issues one ethics opinion covering all participating sites. Sites may still apply local governance checks, and some international studies need approval in each country.
Does federation help with getting a consent waiver?
It can. Committees weigh the privacy intrusion of the research against the burden of seeking consent. When identifiable data never leaves the site and only checked aggregates are released, the privacy intrusion is smaller, which strengthens the case for a waiver where the legal conditions are met.
What should the protocol say about outputs?
It should list every type of output that can leave a site, the disclosure rules applied to each, such as minimum cell sizes, and who reviews or approves releases. Vague statements about “aggregate data only” usually draw questions.
How do local requirements fit with single review?
The central opinion covers the ethics of the protocol. Sites still apply their own institutional policies, national laws, and any community agreements. The protocol should name those requirements and the person responsible for each at every site.
Is ethics review the same as a DPIA?
No. Ethics review assesses whether the research is ethically acceptable, while a Data Protection Impact Assessment assesses risks to personal data under data protection law. They overlap heavily, so it is efficient to prepare them from the same description of the study.