01 · The Question
Whose Rules Apply When You Conduct Research Somewhere Else?
Your university employs you, supervises your research, or has approved your project. But your participants are in a hospital, school, company, community organization, another university, or perhaps another country.
Who is responsible once the research leaves your own institution?
Usually, responsibility does not move wholesale from one institution to another. Your home institution may retain responsibilities connected with your employment, research governance, sponsorship, integrity, or data systems. The host organization may acquire responsibilities because research occurs through its site, staff, participants, records, or resources. You and your research team retain responsibilities for your own conduct.
The result is often overlapping but distinguishable responsibility.
03 · What You Need to Know
Your Home Institution and the Host Site Can Both Have Responsibilities
Your responsibilities as a researcher do not stop at your institution’s boundary
A researcher remains responsible for appropriate research conduct regardless of where an interview, survey, experiment, observation, or other activity physically occurs.
You should continue to follow the approved protocol, protect participants appropriately, manage data responsibly, comply with applicable requirements, maintain research records, report relevant problems, and fulfill the responsibilities assigned to your role.
The Australian Code for the Responsible Conduct of Research, for example, assigns responsibilities directly to researchers as well as institutions. Researchers are expected to comply with relevant laws, regulations, disciplinary standards, ethics requirements, institutional policies, and contractual obligations. Those responsibilities do not disappear simply because the research occurs at another organization.
Your home institution may retain substantial responsibility
If your university or research organization employs you, sponsors the research, provides research infrastructure, controls project data, or otherwise governs the project, those responsibilities can continue while you work elsewhere.
Your home institution might remain responsible for research-integrity processes, employment and supervision, sponsor oversight, institutional data systems, insurance or indemnity arrangements, contractual matters, or other functions assigned to it.
This follows the broader principle that research institutions have responsibilities of their own. Moving data collection off campus does not automatically switch those responsibilities off.
The host organization acquires responsibilities because the research occurs through it
The organization where research takes place may also have legitimate responsibilities.
The UK Policy Framework for Health and Social Care Research describes research sites as organizations with day-to-day responsibility for the places where research is carried out. Under that framework, sites are responsible for demonstrating their suitability, knowing what research is taking place through them, ensuring local roles and responsibilities are agreed and documented, and satisfying themselves that relevant approvals are in place where required.
A host organization's responsibilities can therefore arise from matters it actually controls: premises, local staff, facilities, records, systems, participant care, organizational resources, or institutional risk.
This is why obtaining approval from your own institution does not necessarily answer whether you have permission to conduct research at the host site.
Home institution and host institution responsibilities are not duplicates
| Issue |
Home Institution May Be Responsible For |
Host Institution May Be Responsible For |
| Researcher |
Employment, training, supervision support, research-integrity expectations |
Local credentialing, access, orientation, or site-specific requirements where applicable |
| Research governance |
Project-level governance or sponsorship where it holds those roles |
Local authorization and governance of activities under its control |
| Premises and resources |
Resources supplied by the home institution |
Permission to use host premises, systems, equipment, or staff resources |
| Participants |
Project-level participant-protection arrangements within its role |
Local responsibilities arising from participants, services, or activities under its control |
| Data |
Data systems, storage, analysis, or governance for which it is responsible |
Records or data controlled by the host and local data-access requirements |
| Problems |
Institutional, sponsor, integrity, or other response within its remit |
Local incident, safety, privacy, employment, or operational response within its remit |
The precise division varies. The purpose of the distinction is not to prescribe identical roles to every collaboration, but to prevent one institution from being treated as responsible merely because it is the researcher's home or the physical location of data collection.
Host authorization may be required before research begins
Another institution does not become available for research simply because your own institution approves the protocol.
In current UK health and social care guidance, research sites have explicit responsibilities for assessing their ability to participate. For relevant NHS organizations in England and Wales, local capacity and capability arrangements may need to be completed before research activity begins. Non-NHS organizations can require management permission or other local authorization.
Exactly what is required depends on the research system and organization. A hospital may use a formal research office. A school may have a district-level process. A company may require authorization from management, legal, privacy, or another office.
Do not assume that a supportive local collaborator has authority to provide every permission the organization requires.
The host institution does not automatically become responsible for the entire project
The reverse assumption is equally problematic.
A hospital allowing a university researcher to conduct interviews does not necessarily become responsible for the researcher's entire project. A school permitting access to teachers does not automatically become responsible for analysis performed at the researcher's university. A collaborating university providing a laboratory does not necessarily become the sponsor.
The host institution should be responsible for the functions it controls or has formally accepted, not everything associated with the study.
Your home ethics approval may not settle the host institution’s requirements
Ethics review can sometimes be centralized or recognized across institutions. That can substantially reduce unnecessary duplication.
But an ethical decision and host authorization are different things. A host institution may still need to consider local resources, data access, contracts, safety, staffing, feasibility, or other governance matters.
Current HRA arrangements illustrate this distinction. HRA and HCRW Approval can combine study-wide governance and legal assessment with an independent ethical opinion through a single application, while participating organizations retain responsibilities for their capacity and capability to deliver relevant research activities.
This becomes particularly important in multisite studies involving several participating institutions.
Research teams need to know which institution’s policies apply to which activity
Collaborative research can expose researchers to several institutional policies simultaneously.
Your university may specify how research data must be stored. The hospital may regulate access to its patient records. The sponsor may impose reporting requirements. A funder may require data sharing. Applicable law may add requirements that none of the institutions can waive.
The Australian guidance supporting its Code specifically recommends establishing agreements for collaborative research and requires researchers to comply with relevant multi-institutional agreements and institutional policies.
The correct response is not necessarily to choose whichever requirement is easiest. Determine which body has legitimate authority over the activity and whether several requirements must be satisfied simultaneously.
Data moving between institutions need explicit governance
External-site research frequently involves data crossing organizational boundaries.
A hospital might identify eligible participants, a university researcher might collect interviews, the home university might store recordings, and a collaborating institution might analyze de-identified transcripts.
The project should establish who may access which data, what may be transferred, how transfers occur, where information is stored, who responds to incidents, how long records are retained, and what happens when the collaboration ends.
These questions should be resolved through applicable law, ethics requirements, institutional policies, data agreements, and other governance arrangements rather than inferred from physical possession of a file.
Problems may require notification to more than one institution
A serious protocol deviation, participant complaint, data breach, safety problem, or research-integrity concern can fall within several organizations' responsibilities.
For example, a data breach occurring at a host hospital might need to be reported locally because the hospital's systems were involved, to the researcher's home institution because it governs the project, and to the sponsor or ethics body under applicable reporting requirements.
Multiple notifications do not necessarily mean governance has failed. They may reflect genuinely different responsibilities.
International research adds another layer
Research conducted in another country can involve the researcher's home requirements alongside local law, local ethics or regulatory requirements, host-institution policies, cultural considerations, and contractual arrangements.
Approval from a home institution should not be assumed to override requirements in the jurisdiction where research occurs. Conversely, local permission does not necessarily satisfy responsibilities retained by the home institution or sponsor.
Researchers planning international work should establish these requirements early, particularly where participant protection, privacy, biological materials, data transfer, or regulated activities are involved.
Watch Out
Do not assume that research becomes the host institution's responsibility simply because data collection occurs there, or that your home institution's approval gives you authority everywhere. Responsibility follows roles, authority, agreements, and applicable requirements rather than physical location alone.
04 · A Practical Example
A University Researcher Conducting Interviews at a Hospital
Hypothetical Example
One project across two institutions
A university researcher plans to interview nurses at an independent hospital. The university employs the researcher, provides the secure research-data platform, and sponsors the project under the applicable governance framework. The hospital will provide access to eligible nurses and interview rooms.
University responsibilities
The university maintains its project-level governance, sponsorship, research-integrity, employment, and data responsibilities.
Hospital responsibilities
The hospital assesses whether it can participate, authorizes the local research activities, controls access to its staff and premises, and establishes any local requirements.
Researcher responsibilities
The researcher follows the approved protocol, recruitment and consent arrangements, data-management plan, and requirements applying at both institutions.
Data transfer
Interview data are transferred to the university using the approved process, with responsibilities for storage, access, and incident reporting established in advance.
If a problem occurs
The responsible parties follow the agreed reporting pathway rather than assuming that whichever institution first discovers the problem must manage every aspect of it.
The research is neither exclusively "the university's study" nor exclusively "the hospital's responsibility." Each institution has responsibilities arising from what it contributes, controls, and has agreed to undertake.
