It's a bit tricky to understand the details, but I think I've got some of it figured out. There's "research" and there's "research subject to regulation." The

It's a bit tricky to understand the details, but I think I've got some of it figured out. There's "research" and there's "research subject to regulation." The federal law says that all research by or directed by federal departments is subject to this law. It also says that everyone, including you and I, who are doing research subject to regulation (which includes drug development) are also subject to the law. That is, even without MD 917, all research in MD which is subject to regulation would have been subject to the law. However, this leads to a gap. Anyone doing research, but not research that is subject to regulation, and not research which is funded or directed by a federal department or agency, is not subject to these ethical requirements. The MD law (see http://www.oag.state.md.us/Healthpol/hb917letter.pdf http://www.oag.state.md.us/Healthpol/hb917letter.pdf) is meant to close the gap, and include research which is not subject to regulation by a federal department. The "minimal risk" section you pointed out is for expedited review. That is, the research still needs an IRB, but the IRB can use the expedited review process instead. OkCupid didn't have an IRB, so the minimal risk section doesn't apply.