The HSR series from CITI Program is online human subjects research training for anyone involved in research with human participants, including IRB members and staff. This page gives you free practice sets by topic, worked answers to sample questions, a short study plan, and plain notes on fees, scoring and renewal taken from CITI's own pages.

HSR Exam at a Glance

What the HSR is and how it works

According to CITI Program, “Yes, the Biomed and SBE Comprehensive and Foundations courses fulfill the human subjects research training requirements. OHRP’s Human Research Protection Foundational Training also fulfills the requirement.”^[1]

HSR training is run by CITI Program. It is meant for anyone involved in research with human participants, or responsible for setting policies and procedures for that research, including Institutional Review Board (IRB) members and personnel. There are Biomed and SBE tracks, and each track has Foundations and Refresher courses among others.

Delivery is online and self-paced. Modules usually take about 15 to 45 minutes each, depending on the topic, so you can work through them in short sittings.

Scoring is not one fixed number. You must meet or exceed the minimum average quiz score set by your institution for that course, so check what your own institution requires. Quizzes can be retaken. Part 1 of the completion report is frozen once issued, while Part 2, the transcript report, reflects new scores if you retake quizzes later.

Cost depends on how you enrol. An independent learner pays $129 per person. Organizations can instead use a subscription, listed at $1,000 per year per site for government and non-profit organizations and $1,200 for for-profit ones.

Validity also varies. For independent learners, a completion report is valid for 1 year from the date of course completion. For organizational learners, your organization sets the expiration date. Most organizations choose a 3-year retraining cycle with a Refresher course. Confirm your own deadline with your institution or on the CITI Program site.

Worked examples: how to reason through HSR questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: What should be done if a data breach occurs during research?

1. Inform the affected participants and report the breach to the relevant authorities
2. Ignore the breach if it doesn't affect the research results
3. Continue the study as usual and inform participants after completion
4. Wait until the breach is investigated and decide later

Answer: A. Inform the affected participants and report the breach to the relevant authorities

Explanation:

The correct answer is to inform the affected participants and report the breach to the relevant authorities. A breach exposes people who trusted the study with their data, so they are owed prompt notice and the proper bodies need to know so harm can be limited and someone is held accountable.

Ignoring a breach because it does not change the results is wrong, because the duty is to participants, not to the data analysis. Continuing as usual and telling participants only after the study ends is wrong because the delay leaves them unable to protect themselves. Waiting until an investigation finishes and deciding later is wrong because reporting should not be put off.

Rule to remember: when participant data is exposed, act and disclose promptly, and do not wait for a convenient moment.

Example 2

Question: Under FDA IND safety reporting rules, how quickly must a sponsor report an unexpected fatal or life-threatening suspected adverse reaction to FDA?

1. Within 7 calendar days
2. Within 15 calendar days
3. Within 30 calendar days
4. In the annual report

Answer: A. Within 7 calendar days

Explanation:

The correct answer is within 7 calendar days. Under 21 CFR 312.32, an unexpected fatal or life-threatening suspected adverse reaction is the most urgent kind of IND safety report, so the sponsor has the shortest deadline.

Within 15 calendar days is wrong here because that longer window applies to serious and unexpected reactions that are not fatal or life-threatening. Within 30 calendar days is wrong because it is longer than either of those safety-report deadlines. In the annual report is wrong because a periodic summary is far too slow for an event this serious.

Rule to remember: the more severe and unexpected the event, the faster the report is due. Match the severity first, then the clock.

Example 3

Question: What quality assurance measure supports communication and documentation?

1. Quality checks are unnecessary for experienced professionals
2. Regular self-assessment, peer review, and adherence to established standards
3. Quality only matters for new practitioners
4. Annual review is sufficient

Answer: B. Regular self-assessment, peer review, and adherence to established standards

Explanation:

The correct answer is regular self-assessment, peer review, and adherence to established standards. Quality assurance in communication and documentation is an ongoing habit, because records and messages can drift from the standard without anyone noticing.

Saying quality checks are unnecessary for experienced professionals is wrong, because experience does not prevent errors or outdated habits. Saying quality only matters for new practitioners is wrong for the same reason, since everyone who documents work is accountable for it. Saying annual review is sufficient is wrong because a single yearly check lets problems build up unseen.

Rule to remember: quality assurance applies to everyone and runs continuously, through checking your own work, having others check it, and following agreed standards.

How to use these practice tests

Start with the official material. Check your institution's requirements first, including which course you must take and the minimum average quiz score it sets. Then read each CITI module before you practise it, since the practice sets here test understanding and are not a replacement for the course.

1. Take the HSR Core Concepts and Principles set as a baseline and note which questions you miss.
2. Work through Ethical Principles and Regulations, then Informed Consent and Participant Rights.
3. Move to IRB Processes and Confidentiality and Data Security.
4. Finish with Vulnerable Populations Protection and Safety and Compliance.

After each set, write down in your own words why each wrong option was wrong. Return to the weakest topic and repeat it a few days later. Because quizzes in the real course can be retaken, treat a miss as a signal to reread the module, not as a setback.

Sources & last verified

1. CITI Program — number of questions, renewal, delivery, eligibility (official source). “Yes, the Biomed and SBE Comprehensive and Foundations courses fulfill the human subjects research training requirements. OHRP’s Human Research Protection Foundational Training also fulfills the…” Verified Oct 22, 2026.
2. support.citiprogram.org — passing score, retake policy (official source). “In doing so, you must meet or exceed the required minimum average score set by your institution for that course.” Verified Oct 22, 2026.
3. CITI Program — exam fee (official source). “Independent Learner Price: $129 per person” Verified Oct 22, 2026.
4. CITI Program — exam fee (official source). “Included with Human Subjects Research series, available as part of an organizational subscription package or for $1,000 per year/per site for government and non-profit organizations;…” Verified Oct 22, 2026.
5. CITI Program — validity (official source). “Completion reports are valid for one year from the date of course completion.” Verified Oct 22, 2026.
6. support.citiprogram.org — validity (official source). “Each affiliated organization decides the expiration date of the courses they offer through the CITI Program.” Verified Oct 22, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.