Congress enacts a statute, the Federal Deposit Insurance Corporation (an administrative agency) issues rules, the Southeast Financial Institutions Association (a private organization) issues instructions, South Valley Bank posts a memo with orders for its employees, and Tina tells her co-worker about a recent news story. Sources of law include:
a. the instructions issued by private associations.
b. the orders posted by employers.
c. the rules issued by federal administrative agencies.
d. the stories released by news agencies.

Aresearcher conducting behavioral research collects individually identifiable sensitive information about illicit drug use and other illegal behaviors by surveying college students. the data are stored on a laptop computer without encryption, and the laptop computer is stolen from the researcher’s car on the way home from work. this is an unanticipated problem that must be reported because the incident was (a) unexpected (i.e., the researchers did not anticipate the theft); (b) related to participation in the research; and (c) placed the subjects at a greater risk of psychological and social harm from the breach in confidentiality of the study data than was previously known or recognized. according to ohrp, this unanticipated problem must be reported to the irb in which timeframe? promptlywithin 48 hourswithin 24 hourswithin two weeks