Ethical and regulatory oversight of clinical research: The role of the Institutional Review Board

Abstract

The history of clinical research is, unfortunately, filled with examples of research studies that took advantage of and harmed research participants, to fulfill the research goals of scientists. Over time, we have created a system of ethical codes, principles, and regulations that are designed to prevent these abuses and to ensure that the rights and welfare of research participants are protected and honored. This review article will provide a brief history of clinical research ethics and ethical codes, outlining how those codes developed into the current regulatory requirements for the ethical oversight of clinical research. Understanding the current human subject protection systems will allow researchers to use best practices for planning and conducting rigorous, scientifically valid and ethical clinical studies. Understanding the history, principles, and foundations of the development of this system will equip researchers to understand what resources are available to them and how to make the best decisions when confronted with unique ethical situations in the conduct of their research.

Impact Statement

When conducting clinical research with human participants, attention to the ethical principles that underlie the research regulations is critical; multiple oversight bodies may be involved but ultimately, protection of the rights and welfare of the participants is up to the researcher and study teams. Therefore, it is essential that researchers understand the history, foundations, and goals of human subject protection.

Introduction

Clinical research with human research participants is irreplaceable in the development and advancement of knowledge about drugs, biologics, medical devices, diagnostic testing, and therapeutic procedures. The privilege of conducting clinical research, and of earning and maintaining the trust of those who agree to participate in that research, comes with responsibilities as well. The scientific and medical community must ensure that clinical research is conducted to the highest standards of human research ethics. In this article, we will review the rationale for the ethical oversight of clinical research, the history which led to the current system of oversight, US federal regulations and the requirements for independent research review by Institutional Review Boards (IRBs), and best practices for preparing research proposals for the IRB review process.

Why do we need ethical and regulatory oversight of research?

There was, for many years, an attitude and belief in the medical community that bad and unethical research was conducted by bad and unethical people; respected, well-trained physicians who were acting for the good of humanity performed only good, ethically appropriate research. This belief was shaken in 1966 after the publication of an article by Dr Henry Beecher in the New England Journal of Medicine. ¹ In the article, which he had struggled for years to get published, Dr Beecher laid out 22 examples of unethical research behaviors including research without participant consent, research with unacceptable risks to participants, and poorly designed research studies – in all cases, research performed by highly regarded physicians, at famous academic institutions, and published in major medical journals. With this publication, it was no longer possible for the medical community to credibly argue that unethical research was only conducted by a few “bad apples.”

Over many decades, there have unfortunately been many examples of clinical research that was not conducted in accordance with ethical principles. Examples such as the Willowbrook School’s hepatitis studies, ² the Jewish Chronic Disease Hospital’s studies, ³ and Dr. Stanley Milgram’s experiments in obedience ⁴ are commonly cited as examples of unethical research practices.

The best known and most frequently discussed example in the history of research ethics – and, arguably, the study which had the most impact on the future conduct and oversight of research – is the US Public Health Service Tuskegee Syphilis Study. Started in 1932 by the US Public Health Service, this observational study was initiated to document the detrimental health effects of untreated syphilis over time in about 600 Black men. Some reports indicate that the study was initiated in response to the defunding of syphilis treatment programs (treatments available included arsenic and bismuth) in order to justify the continuation of the treatment programs, and there was considerable disagreement at the time around whether goals of treatment should be to cure the infection or just to reduce transmission. ⁵ Regardless of the original intention of the study, there are also questions around the adequacy of informed consent, which stated or strongly implied to the men enrolling that they were entering a treatment program for “bad blood,” a lay-language term used to describe a variety of conditions. Even if it could be argued that a natural history study was well-intentioned when there were no effective therapies, penicillin had been discovered and was both widely available and an effective treatment for syphilis by 1947. In order to continue the study of the natural history of untreated disease, the study leaders intentionally withheld antibiotic treatment from participants, even preventing them from enrolling in the military where they would be tested and treated. As a result, over the next 30 years that the study continued, many participants developed advanced syphilis, some dying from the disease, and many passed it to their partners and through them, to their children.

The study was not conducted in secret; updates of the study progress and study data were published periodically in medical journals. But it was effectively unnoticed by the public until 1972, when journalist Jean Heller published an article about it in the Washington Star and The New York Times (https://www.nytimes.com/1972/07/26/archives/syphilis-victims-in-us-study-went-untreated-for-40-years-syphilis.html), calling out the ethical issues. The response was rapid and significant, and led to the 1974 National Research Act (https://www.congress.gov/93/statute/STATUTE-88/STATUTE-88-Pg342.pdf), which created the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. This National Commission was charged with establishing a code of research ethics, which is discussed the next section.

Since that time, there has been much discussion of what safeguards and oversight are necessary to make clinical research ethical. In a 2000 paper, Drs Emanuel, Wendler, and Grady of the National Institutes of Health (NIH) Bioethics division defined some fundamental considerations for ensuring that research is conducted ethically. ⁶ One of these points is that the independent review of research is essential; researchers themselves are too close to their work, and too invested in their goals, to be able to provide this kind of impartial assessment. The medical community has frequently chafed against this requirement; even Dr Beecher argued that the unethical research he exposed was simply the result of carelessness and inattention, and that physicians needed more rigorous self-scrutiny and professional standards, rather than regulation or oversight by any other body or committee. ⁷

Codes of research ethics

To understand the development and basis of the current system of the regulatory oversight of research, it is necessary to look at the codes and treatises which have been created over time to guide the conduct of clinical studies.

The Nuremberg Code is generally considered the first code of modern research ethics. ⁸ Written in 1947 by the American judges overseeing the trials of the doctors who performed “experiments” on prisoners in Nazi Germany, the Code was intended to briefly define the fundamental points necessary for the conduct of research to be ethical. The first of the 10 points is that the voluntary consent of the research participant is essential; the remaining points address the requirements for the research to be based on good science, carried out by qualified persons, and expected to yield useful information – the importance of which does not outweigh the risk to the research subjects.

The next significant code of research ethics, the Declaration of Helsinki, was first drafted and adopted by the World Medical Association (WMA) in 1964, and was written specifically as an ethical guide for physicians. ⁹ Based largely on the Nuremberg Code, the Declaration restated many of the same ethical basics but clarified some points of the Code that had been considered confusing in practice, such as the statement that participants should be allowed to end experiments if they considered further participation “impossible” and instead stated that the physician should discontinue research when harm to the participant was likely, in addition to the participant’s ability to withdraw consent at any time. The Declaration also added the ability for legal guardians to provide consent for research if the potential participant was decisionally impaired and unable to provide consent themselves. Unlike the other codes of research ethics, the Declaration has been revised several times, resulting in 10 final versions since the original. While retaining most of the fundamental points, the Declaration has been restructured, has updated gender-specific language (referring to physicians as “medical men”), and has added content that addresses newer ethical issues such as post-trial access to experimental medications, and the need for public registration of research and disclosure of research results. Some of these versions have generated considerable controversy, specifically the 2000 revision which basically stated that placebo-controlled clinical trials were unethical if effective treatments for the condition were available. ¹⁰ There was significant push-back from the medical and bioethics communities, pointing out several situations in which placebo trials could not only be ethical but appropriate even when treatments for a condition existed, and the US Food and Drug Administration (FDA) declined to recognize or to require compliance with the new version, referring instead to the outdated 1989 version of the document. After this controversy, the WMA added a note of clarification in 2002 that softened the stance on placebo-controlled studies, but the FDA has continued to decline to recognize subsequent versions.

In the United States, the publication and public outrage over the Tuskegee Syphilis Study, mentioned earlier, became the significant driver in the development of the fundamental code of research ethics. The 1972 publication about the study resulted in the 1974 National Research Act, which created the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. This National Commission was charged with establishing a code of research ethics. In 1979, the National Commission published the 10-page Belmont Report, which was named after the conference center where the initial Commission meetings were held. The Belmont Report establishes three key fundamental principles of research ethics:

1. Respect for persons – manifested in the concept of informed consent, having respect for all persons ensures that they have the right to make autonomous decisions about research.

2. Justice – maintains that both the burdens and benefits of research participation should be distributed fairly, with non-exploitative research practices.

3. Beneficence – over and above the idea of non-maleficence, or “do no harm,” research should seek to maximize benefits for society as well as for individual research participants, while minimizing participant risks.

The Report also discussed the application of these principles to research practices, describing three key elements necessary for true informed consent (information, comprehension, and voluntariness), systematic assessment of study risks and benefits, and best practices in the selection of research subjects. While the conduct of modern clinical research certainly involves issues and challenges that the National Commission could not have predicted, ¹¹ the Belmont Report has held up extremely well over time, and has remained the primary code underlying the conduct of ethical clinical research in the United States.

Translation of codes into human subject protection regulations and requirements for IRB review

Since the 1970s, the regulations for research that was funded by a US federal government agency (including the NIH and the National Cancer Institute) have required review by an IRB, but the specifics of the review process and the criteria for the review of research were largely undefined at first. After the publication of the Belmont Report, the regulations were revised to more specifically define the requirements for the membership of an IRB, the processes that should be followed for the review of research, and the specific criteria against which the IRB should review the proposed research to determine whether it was approvable. These regulations, which are discussed in more detail in the next section, went into effect in 1981.

The requirements for the IRB oversight of Health and Human Services (HHS) federally funded research are known as the Common Rule, because multiple federal agencies agreed to follow these regulations for all research funded by that agency. The Common Rule (Title 45 CFR 46, Subpart A) also includes Subparts B, C, and D, which include specific guidance for the review of research involving populations of patients who are considered to be particularly vulnerable (pregnant women and fetuses, prisoners, and children) adding additional considerations and protections. The HHS division that oversees these regulations is the Office of Human Research Protection (OHRP).

The FDA also created a requirement for the IRB review of all research that was being conducted in order to support a marketing application for a drug, biologic product, or medical device, and this requirement also went into effect in 1981 (Title 21 CFR 56). The requirements were largely similar to the requirements for federally funded research; although since these regulations were designed primarily for clinical trials, there were some differences around allowances in minimal risk research and in other specific areas. Over time, most of the differences between the Common Rule and FDA regulations have been harmonized in updates to the regulations, the issuing of additional guidance to support regulatory interpretations, or through the use of “enforcement discretion” meaning that certain actions will be allowed even though the regulations do not technically permit them.

With a requirement for the IRB review of most federally funded research, and all research that will be submitted to FDA (including the vast majority of research conducted by biopharma and medical device companies), the requirement for IRB therefore exists for the majority of biomedical clinical research conducted in the United States – but not for all of it. Research that was privately funded (by biopharma or device manufacturers, by private foundations or advocacy groups, or even by individuals) and that would not be submitted to the FDA did not fall under the existing requirements. Over time, several other parties have added extra-regulatory requirements for IRB review that covers most of the research that would have potentially fallen through these cracks. These additional requirements may be from institutions which require IRB review of any research their faculty is participating in, or from the funding sources themselves. The International Committee of Journal Medical Editors also requires documentation of review and approval by an appropriate IRB or Ethics Committee as part of the submission for a manuscript for review for possible publication (http://www.icmje.org/recommendations/browse/roles-and-responsibilities/protection-of-research-participants.html). While there is still some clinical research that technically does not fall under IRB review requirements now, the various nets in place provide the assurance of independent oversight for almost all biomedical clinical studies; non-biomedical human subjects research (social, behavioral, educational, etc.) may still have pathways through which it can be conducted without a requirement for IRB oversight.

IRBs

What are “local,” “central,” “independent,” and “commercial” IRBs?

The name “Institutional Review Board” reflects the fact that when these regulations were established, virtually all clinical research was conducted within medical institutions, and almost all research projects were single-site research studies within individual academic medical centers. Within these medical centers, an IRB would be designed specifically to review research conducted at that center and conducted by the medical staff of that institution. Clearly, the design and conduct of research studies have changed significantly over the last few decades, with a significant proportion of studies being conducted at multiple coordinated research sites (i.e. multicenter research) and with clinical research occurring in private medical practices, purpose-built clinical research centers, or in other locations. As research moved out of academic medical centers in the 1990s, the clinical research ecosystem saw an increase in the number of independent IRBs. These IRBs, which were not affiliated with a specific organization, could review and oversee research performed in any location, in contrast to the “local” institution-specific IRBs.

Since independent IRBs were not financially supported by the indirect overhead fees incorporated into institutional research budgets as the local IRBs were, the independent IRBs charged a fee for research reviews. The independent IRBs were created only for the goal of research review, and their financial models generally meant that they had more resources available than the local institutional committees (which often have a few dedicated staff but primarily rely on medical faculty members to perform the research review), so the independent IRBs could generally review research much more quickly and efficiently than local IRBs. Biopharma sponsors found the review fees to be a very reasonable trade-off for the saving of time in the study start-up process. Because of the review fees, independent IRBs were frequently referred to as “commercial” IRBs and criticized by research ethicists and by local IRBs for having an interest only in reviewing research as fast as possible and making money. Over time, however, these criticisms have largely faded; independent IRBs were among the first to undergo the processes for the accreditation of human research protection programs when that program was instituted (Association for the Accreditation of Human Research Protection Programs, www.aahrpp.org), regulatory agencies have found very few examples of accredited independent IRBs failing to follow regulatory standards when audited, and most local IRBs – recognizing that sponsors were willing to pay for IRB review – now also charge review fees for any research sponsored outside their institution.

The independent IRBs, since they were not limited to the review of research within a specific institution, also facilitated the conduct of multicenter research studies by allowing one IRB to oversee the conduct of the same clinical protocol across multiple sites rather than having to go through review and approval by multiple local IRBs, thus lowering the administrative burdens of the research study. For this reason, independent IRBs are often referred to as “central IRBs.” Biopharma research sponsors, who were conducting the majority of multicenter studies, were very supportive of this model and over time, began to increasingly place clinical studies at clinical sites that were outside major academic centers which could rely on the independent IRB, and which generally had much easier and faster processes for study site contract and budget negotiation, and lower overhead fees. As they realized that biopharma sponsors were not placing research studies at their institutions and that they were losing the income associated with these research budgets, major research centers then began to develop collaborations with independent IRBs that would allow them to rely on the independent IRB for research review, taking advantage of the centralized process and making them more attractive to the research sponsors. Over time, it became increasingly evident that having one clinical study reviewed by multiple local IRBs added administrative burden, time and study costs but did not increase the protection of the research participants. For this reason, other research funders also began to support and then to require single-IRB review for multicenter research; in 2018, the NIH began to require that multicenter research that they funded be reviewed by a single IRB (https://grants.nih.gov/policy/humansubjects/single-irb-policy-multi-site-research.htm). With this new requirement, local IRBs at institutions with significant amounts of NIH-sponsored research began to create the infrastructures to allow them to rely on each other and to act as central IRBs.

Regulatory requirements for IRBs

Regardless of whether they are independent or are affiliated with a single institution, all IRBs must follow the same set of regulations and requirements (Title 45 CFR 46 and Title 21 CFR 56). In addition to the regulatory requirements, IRBs should follow their own internal policies and Standard Operating Procedures (SOPs), and these policies and SOPs may add some IRB-specific extra-regulatory requirements.

IRBs must include at least five members. Of those five members, at least one must be a scientist and at least one must be a non-scientist, and at least one member must be unaffiliated with the IRB’s institution. The non-scientist requirement and the unaffiliated member requirement are sometimes met by one person who is often referred to as a “community” member. IRBs must also include members (or have consultants available) with the necessary expertise to review the kind of research and therapeutic areas of the research that is submitted to that Board, and many IRBs have many more members than the minimum required to encompass expertise in all the areas of research they review.

Research protocols must be submitted to the IRB for review and approval before any research activities start. Depending on the research project, the submission may also include informed consent documents and a description of the informed consent process, any participant-facing communications including recruitment advertising, the Investigator’s Brochure describing the current information known about the investigational product, documentation of FDA correspondence and allowances, evidence of the qualifications of the research staff, and/or other documents.

Although the IRB process is frequently thought of as a black box where protocols are reviewed and a decision is somehow made as to whether they are “good” and can move forward, the IRBs have very specific regulatory criteria to consider when evaluating research proposals. These criteria directly trace back to one or more of the fundamental elements of ethical research, as described earlier in the Belmont Report (justice, respect for persons, and beneficence).

The criteria for the approval of research (paraphrased here from the full regulatory language in 21 CFR 46.111) are as follows:

1. That risks to subjects are minimized by using procedures that are consistent with sound research design and that do not unnecessarily expose subjects to risk, and whenever appropriate, by using procedures already being performed on the subjects for diagnostic or treatment purposes (respect for persons, beneficence).

2. That risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result (respect for persons, beneficence).

3. That the selection of subjects is equitable (justice).

4. Informed consent will be sought from each prospective subject or the subject’s legally authorized representative (respect for persons).

5. Informed consent will be appropriately documented or appropriately waived (respect for persons).

6. When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects (respect for persons, beneficence).

7. When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data (respect for persons, beneficence).

8. When some or all of the subjects are likely to be vulnerable to coercion or undue influence, such as children, prisoners, individuals with impaired decision-making capacity, or economically or educationally disadvantaged persons, additional safeguards have been included in the study to protect the rights and welfare of these subjects (respect for persons, beneficence, justice).

As outlined above, the IRB must consider not just the “ethics” of the proposed research project, but must also to some degree consider the scientific rationale and scientific design of the proposed research (or must rely on a scientific review from an associated review committee), particularly to ensure that the risks of the research are reasonable in relation to the anticipated benefits of the knowledge expected to result. Poorly designed research – research with an unclear study question, vague or unmeasurable endpoints, or underpowered to find a clinically relevant outcome – becomes difficult or impossible for the IRB to approve, because the risk to participants cannot be balanced against the potential benefits of the scientific knowledge from the study.

When reviewing the proposed research, the IRB can take four possible actions. The decision regarding the action will be based on whether the IRB can determine that all of the criteria for approval of the research have been met to their satisfaction. The IRB can

1. Approve the research, if the Board believes that all the criteria for approval are met;

2. Conditionally approve the research, if it seems that all or most of the criteria are met, but there are some outstanding questions for the researcher to confirm, or some changes are required to the informed consent document or process. (Some IRBs have specific policies about what can be considered a “condition” – for example, they may conditionally approve if the outstanding questions are simple enough that the researcher can answer them with a yes/no response. It is important to note that conditional approval is NOT approval of the research, until the conditions have been met to the IRB’s satisfaction and full approval is confirmed in writing).

3. Defer the review of the research, if the research submission does not include enough information to determine that the criteria for approval are met. If the research is deferred, the IRB will provide several questions or requirements to the researcher, and the research will have to be re-submitted with the additional information and requested changes and re-reviewed by the IRB.

4. Disapprove the research. Disapproval occurs when the research that is proposed does not meet the criteria for approval, and the IRB is unable to suggest modifications that make the research approvable (or the researcher is unwilling to make the proposed modifications). Disapproval of research usually occurs only after one or more rounds of prior submission, comments, and discussion of the proposal to determine whether it can be revised to becomes approvable. Disapproval is a final determination (unlike deferral, where re-submission with changes is expected), although the regulations do require that there be a process for the researcher to appeal the IRB’s decision.

Navigating the submission and review processes

Submission of a research protocol and proposal for IRB review can be intimidating for new researchers, or for scientists who only occasionally work in clinical research. There are many resources available to help. Understanding the criteria, as detailed above, that the IRB will be looking at to assess the research project provides a guide for ensuring that all the necessary information is included in the protocol and the submission. IRBs often provide informational resources to be used when preparing submissions including protocol templates, informed consent templates, and guides for researchers to answer frequently asked questions and to detail requirements, and IRB staff are generally happy to answer questions while submissions are being prepared. Resources such as template documents are generally easy to find online as well, and reviewing protocols from already-approved studies with a similar research question can be very helpful in understanding, for example, the level of detail that should be included in the protocol regarding such things as eligibility criteria and study procedures. A good rule of thumb when deciding how much information to include in a protocol or as part of a submission is to “show your work” – if there is an element of the project that may raise ethical questions, or that was debated during the process of study design, explaining the issues raised and why the study team came to the conclusion they did can help to avoid questions from the IRB which may otherwise assume that the ethical issues have not been recognized.

Conclusions

Conducting clinical research with human participants is a privilege, and it is essential that researchers know and understand the ethical history of human research so that they fully recognize the structures that exist to oversee the ethical and regulatory conduct of research studies, and how those structures came to be. Even with that structure, though, researchers must be prepared to protect the rights and welfare of research participants themselves, as they are the final and most direct contact to ensure that research is conducted at appropriate ethical standards.