The specific U.S. Department of Health and Human Services regulations that apply to research

This chapter presents a brief summary of the federal regulations governing the protection of human subjects in research, with particular attention to how the concepts of the regulations fit with the methodology of health services research (HSR). It provides background for the chapters on the practices of organizations involved in human subjects research, since one of the primary goals of this project is to help understand how institutional review boards (IRBs) implement these regulations for HSR.

IRBs AND HUMAN SUBJECTS PROTECTION

The cornerstones of U.S. regulations on the protection of human subjects are review by institutional review boards and informed consent from participants in research.

Background of Federal Regulations

The Belmont Report (Belmont, 1979) articulated three principles for research on human subjects: respect for persons, beneficence, and justice. “Respect for persons,” in the analysis of the report, includes the notions that each human individual should be treated as an autonomous agent and that those whose capacities preclude autonomy either temporarily or throughout life are owed special protection. The main practical expression of the principle of respect for persons is the requirement that the researcher first obtain the informed consent of the subject(s). “Beneficence,” or doing good, requires that the risks of research be reasonable in relation to the possible benefits and that any risks subjects may incur be minimized.1 “Justice” requires that benefits and harms of research be shared fairly. Applying the justice principle, the IRB should ensure that the selection of subjects or potential subject populations is equitable. Of course it is one thing to enunciate general principles and quite another to ensure their consistent and correct application in particular cases. There are many difficult borderline issues in the ethics of human subjects research. Difficulties in applying the principles underlying regulations on the protection of human subjects in HSR differ from those in clinical research (Iezzoni, 1999 and Lo, 1999). These difficulties stem, in large part, from the history of the documents articulating human subjects protection and the nature and methodology of HSR federal regulations assume that clinical research is the paradigmatic use of human subjects and therefore are directed primarily toward avoiding physical harm to the individual subject. HSR studies, however, are generally more removed from the human subjects, because they employ methodologies for sorting, linking, and otherwise manipulating previously collected data. This aspect of HSR raises a variety of questions about application of the ethical principles underlying our beliefs about the proper treatment of human subjects. The question of whether a particular project is research can have substantial ramifications in the ethical, scientific, legal, and procedural requirements attached to it (Lo, 1999).

IRB Review

In the United States, federally supported and regulated human subjects research is covered by regulations adopted specifically by 16 federal agencies that conduct, support, or regulate research with human subjects. This shared body of regulation, which is the “Common Rule,” appears at 45 CFR 46 Subpart A for the Department of Health and Human Services. The Food and Drug Administration has adopted similar regulations at 21 CFR 50 and 56.

IRB review ensures that the proposed research protocol will be reviewed by people who are knowledgeable and not directly involved in the research. The IRB's membership and function are defined in the regulations to ensure that it has sufficient expertise and diversity to provide appropriate review. Diversity should include gender, race, culture, and profession. In addition to scientists, the IRB must include at least one person who is not otherwise connected with the institution and at least one non-scientist.

Many factors must be considered in evaluating the risks and benefits of a research project, including its scientific merit and policy relevance, its relevance to the local community, community values and standards of care, the specific research setting, the populations targeted for recruitment, the nature of the research questions and measures, and the cultural diversity of the target populations. For these reasons, a good IRB needs to have experts both with local and with national knowledge.

What Research Is Subject to Federal Regulations?

Federal regulations apply to all research involving human subjects that is supported by federal funds, with certain exceptions. In addition, the FDA has a policy of not reviewing any research submitted with a new product application unless that research was conducted according to the regulations, regardless of funding (21 CFR 56.103(a) and (b); see also, for example regarding contents of applications to investigate or market new drugs, 21 CFR 312.66 and 314.50(d)(3)(i)).

Many organizations that conduct a great deal of federally funded or regulated research involving human subjects have multiple project assurances (MPAs) through the Office of Human Research Protections (OHRP, formerly Office for Protection from Research Risks or OPRR) in which they have agreed to comply with federal regulations for any human subjects research, even those projects that are funded by some non-federal source and would not otherwise to covered by the regulations. An “assurance” is an agreement or contract between an institution and the OHRP, on behalf of the Secretary of Health and Human Services. The assurance stipulates the methods by which the institution will protect the rights and welfare of research subjects in accordance with the regulations. An MPA can be approved for up to five-year intervals.2

What Establishes a Project as Research?

The definition of research in the regulations specifies “a systematic investigation . . . designed to develop or contribute to generalizable knowledge” (45 CFR 46.102(d)). As discussed in the committee's workshop (see appendix B), the interpretation of the key phrase “generalizable knowledge” is difficult and can be controversial.3 Some IRBs interpret this phrase to cover only projects in which the investigator intends to publish the results, whereas others interpret the phrase as covering projects whose results are disseminated beyond the department or unit conducting the study, for example, dissemination through oral presentations at scientific or other professional meetings. The difficulty is especially acute in defining the boundaries of HSR since, as discussed in the previous chapter, many projects could reasonably be categorized either as research “designed to contribute to generalizable knowledge” or as “as internal quality assurance.”

What Establishes a Research Study as Involving Human Subjects?

The regulations define a human subject as “a living individual about whom an investigator conducting research obtains data through intervention or interaction with the individual, or identifiable private information (45 CFR 46.102(f)). The former is not applicable in studies analyzing previously collected data. Private information, in this context, is defined as “information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (e.g., a medical record) (45 CFR 46.102(f)). The definition stipulates that the information must be individually identifiable, that is, the identity of the individual can readily be ascertained or associated with the information. In short, the open question for a project in HSR is whether the information is identifiable.

What HSR May Be Exempt from IRB Review?

The regulations allow an IRB to exempt from further review research on existing data and records, that is, for data and records that have been collected previously and could be reanalyzed (see Box 2-1 for definitions, see also 45 CFR46.101(b)(4)):

BOX 2-1

Terms for Less than Full IRB Review. The Common Rule codified in 45 CFR 46.101 (a) states that except for those exemptions described in section (b), the policy applies to all research involving human subjects subject to federal regulation. The term “waiver” (more...)

Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

Of course there are difficulties here too, in addition to those already discussed, such as the meaning of “recorded by the investigator.” Some interpretations apply this exemption as long as no identifiers will be made public; others, if the investigator will not have the identifiers (although an assistant might); and others, only if no identifiers will be recorded by anyone. The OHRP has clarified that information should be considered identifiable regardless of who holds the code that can link information to individuals, and the holder may be the researcher, the data provider organization, or some third party. A particular problem in HSR that the regulations do not directly address is the possibility of identifying in databases individuals who have an unusual constellation of characteristics. Such indirect inferences can be made by using computer analyses and linking several databases. In addition, when the study participants are known to the investigators in other contexts, such as clinical care or community ties, the identity of individuals with rare characteristics can be inferred.

As the committee heard in the workshop, some institutions have an explicit policy requiring that all protocols be screened by the IRB, so that investigators are never placed in the position of deciding themselves whether their projects should be exempt from IRB review. The IRB or IRB office can ensure that the protocol meets the criteria for exemption from IRB review. Under this interpretation, the term “exempt” does not mean “exempt from any IRB oversight.” Although the IRB may determine the protocol to be exempt from certain requirements, it may require others, such as periodic status reports. Often, the IRB chair and members who do the initial screening of potentially exempt protocols also carry out expedited review.

Some committee members suggested that the very term “exempt,” although formally codified in the regulations, may be misleading. In particular, the regulations might mislead investigators to exempt their own research, when in fact the protocol may not meet regulatory criteria for exemption. In addition, some committee members remarked that the regulatory term expedited may be unfortunate, since surely both investigators and IRB members would wish all IRB reviews to be completed promptly. Finally, one possible solution might be to discard both terms in favor of “administrative review” since so many of these studies do receive quick turnaround review from the IRB chair and/or administrator.

What HSR May Qualify for Expedited Review?

The regulations also provide for expedited review of protocols in certain cases. An expedited review is carried out by the IRB chair or by one or more experienced IRB members. The DHHS publishes a list of categories of research that may be eligible for expedited review, including records research, which follows (63 FR 60364–60367, November 9, 1998):

“(5) Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for nonresearch purposes (such as medical treatment or diagnosis).”

To qualify for expedited review, research must involve no more than minimal risk. The concept of “minimal risk” therefore plays a prominent role in determining whether a study qualifies for expedited review. Studies may not, however, qualify for expedited review if (63 FR 60364–60367, November 9, 1998)

“[I]dentification of the subjects and/or their responses would reasonably place them at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, insurability, reputations, or be stigmatizing, unless reasonable and appropriate protections will be implemented so that risks related to invasions of privacy and breach of confidentiality are not greater than minimal.”

If the reviewers do not approve the study for expedited review, it must receive a full IRB review.

May Informed Consent Be Waived?

For a project that is research involving human subjects and is not exempt, the IRB must ensure that the subjects have given free and informed consent to participate unless the informed consent requirement may be waived. In general, the IRB must ensure that the subjects receive adequate information about the research protocol, and its possible benefits and risks, in a form that is understandable to them; and that their consent was not coerced (45 CFR 46116(a)); and finally, that their consent was documented (45 CFR 46.117).

The requirement of informed consent may, however, be waived by the IRB if the research involves no more than minimal risk, the waiver will not harm the rights or welfare of the subjects, the research could not otherwise be practicably carried out, and when appropriate, the subjects will be provided with additional information after participating (45 CFR 46 116(d)). The concept of “minimal risk” is therefore a key element in determining whether informed consent can be waived.

What Is Minimal Risk?

Minimal risk, as defined in the regulations, “means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves that those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests” (45 CFR 46 102(i)). Like the terms discussed above, “minimal risk” can raise difficulties. For instance, it is not clear whether the terms “daily life” and “routine tests” refer to healthy people or to sick patients. In a clinical trial, the risk of side effects may be much greater in sick patients than in healthy volunteers. Other difficulties arise particularly in the case of HSR. On the one hand, in HSR projects that involve only analyses of previously collected data, there is no risk of physical harms such as an adverse reaction to an investigational drug or device. On the other hand, if a subject believes it reasonable to expect that medical records will not be disclosed for other purposes and the subject is later identified, he or she may well consider the risk to have been greater than ordinarily encountered and may feel wronged by a waiver of informed consent.

PREVIOUS STUDIES OF IRBs

Several recent studies have examined IRB function and procedures. The DHHS' National Institutes of Health (NIH) commissioned a large-scale study of IRBs that was released in May 1998 (Bell et al., 1998). This study concluded that the IRB system was functioning according to the regulations and was providing an adequate level of protection for human subjects although improvements were certainly possible. Many respondents to this study expressed concern about the large and rapidly expanding workload of IRBs. The following month, the DHHS Office of the Inspector General (OIG) released a study that highlighted several challenges to the IRB system (Brown (OIG), 1998b). This report noted that IRBs are facing greatly expanded workloads including new types of research. Furthermore, IRBs do not always have access to either the expert personnel or the training they would need in order to deal effectively with some of this research. The need for improved IRB training and access to expert consultants also arose in the present IOM study.

In February 1999, the U.S. General Accounting Office (GAO) released a report on IRB function in the specific context of medical records privacy (GAO, 1999). The GAO study observed that IRB review currently may not ensure the confidentiality of medical records when used in research. If the research is to be conducted at another institution, the IRB may rely on the confidentiality policies and procedures in place at that institution rather than carrying out its own assessment of the confidentiality of the data. Furthermore, the IRB may never even consider the issue of confidentiality if the study itself is eligible for exemption or expedited review according to the provisions of the federal regulations. Several of the respondents to the GAO study, however, detailed the information they require of investigators. These requirements, including statements of who will have access to the data and what provisions will protect the confidentiality of the data, were similar to some practices that were presented to the committee, which are highlighted in Chapter 3.

In April 2000, the OIG released an update reporting on conditions since its 1998 recommendations. According to the OIG, the problem of resources continues to plague IRBs. The OIG summarized its previous recommendation on resources and its current assessment:

“Prior Recommendations: Require that IRBs have sufficient resources to adequately carry out their duties. Our recommendation was directed not only to staff and board member resources, but also to space, computers, and other essential elements. We urged OPRR (note: now OHRP) to hold institutions accountable for the resource commitments they made in their assurances.

Update: OPRR's enforcement efforts have brought attention to IRB resource shortages at individual institutions and have led to additional support for IRB function at a number of those institutions—and quite likely at others that have taken note of the OPRR efforts. However, no further action has been taken to develop indicators of adequate resource levels or enable greater investments to support IRB functions. One approach that warrants more attention, and that NIH reports is under consideration, would be to allow an additional increment of grant funds to institutions to be used to provide necessary resources for IRBs. Such an approach could help reinforce to institutions and investigators that a well-supported IRB is a necessary cost of doing business. (Brown (OIG), 2000, p. 15).”

The IRB is the central feature of our human subjects protection system, so it is not surprising that the functioning of IRBs continues to generate great interest both in the federal government and in the nation generally. Subsequent chapters of this report suggest approaches that some IRBs have used with good success, but implementing them requires resources.

HUMAN SUBJECTS PROTECTION IN HSR

Within HSR, application of the three principles of human subjects protection (respect for persons, beneficence, and justice) to the subjects of data in large data bases becomes quite problematic, especially for researchers who may have no means of knowing the identity of the individuals. The general question of seeking informed consent poses a number of challenges, for example:

• In cases where large, rich databases already exist, a requirement to contact subjects prior to reanalyzing the data effectively would make it impossible to use the data for research (Iezzoni, 1999). All of the data would then be wasted, and no good research, hence none of the benefits of research, would be available.

• Further, the act of contacting the people requires more information and invades their lives, so if the information used in and resulting from the research did remain truly anonymous, the investigator would have violated the privacy of the subjects anyway simply to tell them about an activity that might not be violating their privacy. Also, contacting individuals requires personal identifiers, so someone would have to know who was in the study, thereby raising the disclosure risk.

• Whatever the independent good of seeking informed consent in general, a requirement to seek it for HSR also could result in biased samples. The potential bias that would have to be considered could come about as described below.

  • Asking individually for consent to use data in a study lowers the participation rate. Asking people for permission to use their medical information in complex statistical models of health care systems may lead to increased confusion and unnecessary fear and anxiety. HSR can be difficult to explain to a nontechnical audience, and attempting to show why each variable is needed may give the audience the impression of being manipulated.

  • Because nonparticipants may differ from participants in significant ways, asking individually for consent will introduce bias that may not be possible to control.

  • As a result of bias from nonparticipation, the quality of the evidence resulting from the final analysis will be reduced.

  • Also as a result of bias from nonparticipation, the balance of benefit and risk in the study will be less favorable.

HSR investigators and their IRBs have concluded that individual informed consent, especially on a study-by-study basis, is one of the aspects of the clinical research model that is impossible to apply in research conducted by analyzing previously collected data. At the same time, the law presumably passed because a sizable number of citizens were concerned, which would be consistent with the results of a 1993 Harris Health Information Privacy Survey showing that 64 percent of respondents said their permission should be required before their records could be used in medical research, even if no personally identified information about them were published. In clinical research, specific informed consent is, as has been pointed out, the bedrock realization of the principle of respecting persons. In HSR, where the risks and the constraints are different, it is necessary to identify or develop alternative modes of respecting persons that will apply the principle in a feasible manner and address concerns about maintaining the confidentiality of the data.

PRINCIPLES AND PRACTICES

The application of the basic principles of human subjects protection in HSR raises specifically questions such as:

• how privacy ought to be protected,

• how confidentiality ought to be maintained, and

• how persons whose data are recorded ought to be respected.

Many responsible professional groups and expert individuals have developed sets of guiding principles for the treatment of health information.4

The objective of this study was to collect practices. Good practices should apply the principles of ethical human subjects research but also provide more specific guidance to investigators and IRBs than abstract principles can provide. In addition, good practices are flexible, taking into account the type of research and type of organization in question. That is to say, if we agree that we want to support HSR and obtain the benefits it has to offer, then we must identify and implement practices that adequately protect the subjects of HSR, while allowing worthwhile HSR to proceed. The committee hopes that the practices highlighted in the following chapters will facilitate HSR with appropriate and feasible mechanisms for the protection of human subjects, and will stimulate the development and dissemination of more advanced practices in the future.

The scope of this study, highlighting the empirical collection of practices, recognized that good normative principles are already codified in the federal regulations, but that no amount of codification can provide adequate direction for the day-by-day, study-by-study, work of an IRB. In short, regulations are important to provide norms, but they must still be implemented with the judgment and practical experience of individuals closest to the situation. This is what the local IRB system is designed to do. As apparent in Chapter 3 and Chapter 4, the sense of the committee is that the local IRB system is strong and the committee strongly supports HSR using it.

Any local IRB that reviews HSR will, however, have to understand the special problems of HSR and how to apply the federal regulations. The aim of sharing best practices is to support the local IRB with the good ideas already developed by other IRBs. One real challenge will be to find the best means of disseminating these good ideas (Chapter 5).

1

It is important to realize that this requirement is not redundant. The first part considers the relative benefits and risks of a protocol, and acknowledges that increased scientific understanding is desirable but is completely without cost. At the same time, the second part mandates that an overall benefit–risk calculation ought not be made without simultaneously considering the cost to the individual. That is, making the benefit–risk calculation in part 1 of the requirement treats the subject as a means to realizing a benefit. The part 2 provides a check on part 1, ensuring that the subject is not treated as a means only. The lack of the part 2 check is why there has been controversy about using the results of certain Nazi experiments, notably the series on hypothermia: the data may be sound, but even if the information gained would benefit society, the cost to the subjects was unacceptable, so many regard the data as tainted beyond redemption (Ivy, 1947, in Reiser et al., 1977).

MPA is defined in the OPRR Guidebook Chapter 2, Section A(iii). There are several thousand IRBs in operation, though estimates of the exact number vary between 3,000 and 5,000 (OIG, 2000, p. 20). Approximately 750 of these IRBs are located in approximately 430 organizations (some have several IRBs) that have entered into MPAs with the OHRP. The great majority (more than 98 percent) of these MPAs cover all human subjects research in the organization, although a few organizations have limited their MPAs to cover only federally funded studies (Gary Ellis, formerly of OPRR, and Jon Merz, University of Pennsylvania, personal communications).

Some authors have turned more attention to the phrase “designed to” and concentrated on the initial intention of the investigators (see Amdur, in press). In HSR, however this criterion, while helpful, may still be ambiguous, since intentions may change as the project develops. As noted, projects that start as QA or QI may turn out to be publishable and then require IRB approval.

Because different groups are developing principles to address different problems, or at least to address problems in different contexts, the sets of principles do not directly overlap in many instances—in particular, not mentioning a principle is not evidence that an organization would oppose it. These different perspectives make for difficult comparison (but see Buckovich et al., 1999). For example, several recommend removing personal identifiers as early, as and to the greatest extent, possible (GHPP, ISPE, Lowrance) or with some reservations (AAMC), many urge the proactive development of procedural and technical safeguards to protect privacy (GHPP, ISPE, JHITA, AAMC, Lowrance) and call for imposing penalties for breaches of confidentiality (GHPP, AAMC, JHITA, ISPE, PhRMA, Lowrance); some include specific protection for data access for research (AAMC, PhRMA); and several support the idea that individuals should be able to review their own records (GHPP, JHITA, ISPE, Lowrance).

What was the first federal regulations for human subjects research began in 1981?

What is covered in 45 CFR 46 Subpart A or the Common Rule?

Which entity has regulatory authority for the protection of human subjects for PHS funded research?

What is the Federal Policy for the Protection of human subjects?