INTRODUCTION AND BACKGROUND
The ethics of human-subjects research has captured scientific and regulatory attention for half a century. Honoring the Belmont Report’s principles—respect for persons, beneficence, and justice—ought to mean keeping abreast of the universe of changes that factor into the ethical conduct of research today. The U.S. Department of Health and Human Services (HHS) took a giant step in this direction with the publication of an Advance Notice of Proposed Rulemaking (ANPRM) in July 2011, a plan for the first general overhaul of 45 C.F.R. § 46 since it was first promulgated in 1981, followed by issuing Subpart A as the Common Rule in 1991. The committee applauds and supports the issuance of the ANPRM. This committee’s review—concerning how updated human subjects protections regulations can effectively respond to current research contexts and methods—counts the ANPRM as a major stimulus.
COMMITTEE CHARGE AND SCOPE
To respond to the need for additional clarification regarding human subjects protection and the promotion of research in the social and behavioral sciences, the Division of Behavioral and Social Sciences and Education of the National Research Council (NRC) carried out a two-phase project. In the first phase, now completed, a workshop was held to gather information about proposed revisions to the federal regulations and alternative ways of
implementing the new regulations. The summary of that workshop is now published.
In the second, current phase, the NRC-appointed committee that designed and led the workshop used the workshop proceedings, previous NRC reports, and the empirical literature to prepare a consensus report with recommendations to inform the issuance, interpretation, and implementation of the new regulations. The committee’s charge was to inform the current efforts of the federal government to update the Common Rule (45 C.F.R. § 46), last revised in 1991. Specifically it was tasked with the following objectives:
• Identify issues raised in the proposed rulemaking which the panel identifies as critical and feasible for the federal government to address for the protection of participants and for the advancement of the social and behavioral sciences.
• For each issue, provide guidance for institutional review boards (IRBs) as needed to include techniques for addressing issues, specific examples, and best practice models to illustrate how the techniques would be applied to different behavioral and social sciences research procedures.
• Identify topics for research emerging from the proposed rulemaking that will assist in developing best practices for implementing the new human research protections and assessing the effectiveness of the rules and their implementation by IRBs and researchers.
Consistent with prior NRC reports, the committee includes as disciplines in social and behavioral sciences the following: anthropology, cognitive science, communication and information sciences, economics, education research, demography, geography, health services research, history, political science, psychology, social work, sociology, statistics, and related fields.
Through review of prior NRC reports on the topic of human subjects protections, reports of federal advisory bodies on human subjects protections, papers of professional associations that responded to the ANPRM, and the evidence from the empirical literature, and using the committee’s deliberations and expertise in these areas, the report provides, and supports, the rationale for committee recommendations in the following areas.
RATIONALES, DEFINITIONS, AND PROCEDURES RELATED TO RESEARCH NOT INVOLVING HUMAN SUBJECTS AND THE PROPOSED NEW CATEGORY OF EXCUSED RESEARCH
The committee considers the definition of human-subjects research and the risk-based regulatory framework proposed in the ANPRM, then turns to research that the ANPRM defines as “excused” from IRB review, a proposed new regulatory category. Determining what types of research require what levels of IRB oversight is a complex issue deeply affected by 21st century transformations in social and behavioral science research and the accompanying challenges to the ethical, efficient, and effective conduct of research. Some of these changes reflect concomitant changes in the risks of everyday life that humans face. The following committee recommendations were made to
• redefine “human-subjects research,” to provide criteria for what types of research should be considered as not human-subjects research, and to provide examples of social and behavioral science that could be considered as not human-subjects research;
• endorse the adoption of a new category of “excused” research, to provide criteria for what types of research should be considered “excused,” and to provide examples of social and behavioral sciences that could be considered in this excused category; and
• operationalize procedures for implementing the new category of excused research.
Recommendation 2.1: HHS should revise the Federal Regulations so as to combine explicitly the definition of “research” (45 C.F.R. § 46.102(d)) and the definition of “human subject” (45 C.F.R. § 46.102(f)). “Human-subjects research” is systematic investigation designed to develop or contribute to generalizable knowledge by obtaining data about a living individual directly through interaction or intervention or by obtaining identifiable private information about an individual. HHS should revise the Common Rule to clarify that only “human-subjects research” falls within the scope of this regulation.
Recommendation 2.2: HHS should revise the Federal Regulations to clarify that many forms of scholarship that are widely labeled “research” should be considered as not human-subjects research because they are not covered by the intent or spirit of the term “human-subjects research.”
Recommendation 2.3: HHS should revise the Federal Regulations to make clear that investigator use of only publicly available information, information in the public domain, or information that can be observed in public contexts is not human-subjects research and thus is outside of 45 C.F.R. § 46, whether or not the information is identifiable, as long as individuals whose information is obtained have no reasonable expectation of privacy. New forms of large-scale data should be included as not human-subjects research if all information is publicly available to anyone (including for purchase), if persons providing or producing the information have no reasonable belief that their private behaviors or interactions are revealed by the data, and if investigators have no interaction or intervention with individuals. Investigators must observe the ethical standards for handling such information that guide research in their fields and in the particular research context.
Recommendation 2.4: HHS should revise the Federal Regulations to classify as not human-subjects research public-use data files that have been extracted from research data as long as the data files have been de-identified and certified as protected against disclosure.
Recommendation 2.5: HHS should expand the Federal Regulations to include a new category of human-subjects research termed “excused” that would (a) not be reviewed by an IRB or any other form of human-subjects research review, except in the limited oversight function to be specified in the revised regulation, and (b) require the investigator to register the study with an IRB. Research should qualify as excused if the only risks of harm to participants posed by the study procedures themselves are informational (that is, the only plausible harm posed by the study procedures themselves involve the possible disclosure of personally identifiable information) and such risks are not at a greater than minimal level (defined as risks of disclosure of personal information not exceeding those encountered in daily life).
Recommendation 2.6: HHS should specify in the revised Federal Regulations that excused research covers studies where the research procedures involve informational risk that is no more than minimal (when appropriate data security and information protection plans are in place). The revised regulations should explicitly state that the excused category includes use of pre-existing research and non-research data that contain private information; or benign interactions or interventions that involve methodologies or activities that are very familiar to people in everyday life and in which verbal, behavioral, or physiological responses would
be the research data collected, such as educational tests, surveys, focus groups, interviews, and similar procedures.
Recommendation 2.7: HHS should make clear in the revised Federal Regulations that excused research includes research that has no more than minimal risk, even if the information being gathered addresses questions about human subjects’ physical or psychological well-being.
Recommendation 2.8: HHS should explicitly address in the revised Federal Regulations the relationship between the consent of human subjects and excused research, with consent required in all excused research that directly involves human subjects through interaction or intervention.
Recommendation 2.9: HHS should revise the Federal Regulations to include the procedures under which research is excused from IRB review. The revised regulations should stipulate that research can begin 1 week after registering a form that briefly describes the purpose of the research, the activities to be engaged in by research subjects, the subject population, consent procedures, and a data protection plan. During (and only during) that in 1-week period, IRBs may review a small proportion of registrations to determine whether investigators have properly classified their study as excused or should instead have submitted it for an expedited or full board review. Finally, each year, a random audit of a small proportion of registrations should be performed by a designated institutional office to ensure that investigators meet the standards for research that should properly be excused. Investigators should be informed when their research is part of an examination or audit sample and, if issues are identified, they should be granted an appropriate period of time to make adjustments or submit a protocol for IRB review.
DETERMINING MINIMAL RISK IN SOCIAL AND BEHAVIORAL RESEARCH
The committee examines two core issues bearing on IRB decision making: minimal risk determinations and their role in expedited review. Recommendations are offered on how best to ensure
• that the definition of “minimal risk” is appropriate for the full range of current social and behavioral research;
• that IRBs and investigators have adequate guidance for avoiding under- and overestimations of minimal risk; and
• that types of research that may be reviewed by IRBs through expedited review appropriately reflect the conditions needing expedited review, based on the characteristics of the research procedures and of the subject population (i.e., in contrast to studies that may be excused from IRB review, or that require full IRB review).
The committee also recommends guidance that should be issued by the HHS Office for Human Research Protections (OHRP) to assist in operationalizing the definition of minimal risk and to assist in distinguishing between vulnerabilities in participants’ lives and their vulnerability to research risks. The committee also offers elements of OHRP guidance statements that would help investigators and IRBs distinguish among research that would be excused from IRB review, research requiring expedited review, and research requiring full review.
The committee made the following recommendations for HHS to consider in revising aspects of the Common Rule that deal with minimal risk and expedited and full IRB review.
Recommendation 3.1: HHS should adopt the following definition of minimal risk under the Common Rule: “Minimal risk means that the probability and magnitude of physical or psychological harm does not exceed that which is ordinarily encountered in daily life or in the routine medical, psychological, or educational examinations, tests, or procedures of the general population.”
Recommendation 3.2: To ensure just distribution of research benefits and risks across diverse populations and to avoid subjective overestimations of potential research harms, HHS should eliminate current regulatory language at 45 C.F.R. § 46.111(b) identifying certain populations as “vulnerable to coercion and undue influence” and requiring additional but unspecified human subjects protections.
Recommendation 3.3: HHS should harmonize regulations such that decisions regarding the level of potential informational, physical, and psychological research harms must take into account whether reasonable and appropriate protections will be implemented to reduce the probability and magnitude of harm or discomfort to no more than minimal.
Recommendation 3.4: HHS should clarify in regulations the conditions under which research methods that might otherwise be classified under the new excused category are appropriate for expedited review because the specific nature of the research procedures and/or the characteristics
of the subject population require consideration of human subjects protections beyond those normally applied for excused research, in order to ensure that harm or discomfort created solely by the research procedures are not greater than minimal risk.
Recommendation 3.5: To streamline expedited and full board review and procedures, HHS should eliminate the requirement for continuing review for expedited research.
The committee also pointed to corresponding research that is needed to
• build a stronger evidence base for identifying the probability and magnitude of risks in daily life and the nature of age-indexed routine medical, psychological, or educational examinations, tests, or procedures of the general population;
• develop and assess appropriate algorithms for calculating risk from both the probability and magnitude of harm and determining when this calculated risk meets minimal risk criteria;
• encourage and provide empirical evidence for effective procedures for minimizing potential physical and psychological research harms to no more than minimal risk levels; and
• study the effects of social and behavioral research on research participants so that evidence-based assessments of “known and foreseeable” risk are more feasible. In particular, research is needed to properly address nonphysical risks of research and the methods that create them.
The committee also considers another core issue—that of informed consent practices, including questions of flexibility and efficiency in the process of gaining consent, waivers of consent, informing participants about risks of participation, informed consent in the context of special populations such as adolescents and subjects with impaired decisional capability, and informed consent in extended research contexts. The committee recommends several best practices that would streamline human subjects protection, including best practices relating to full IRB review.
The committee also recommends that OHRP issue guidance to encourage IRBs to emphasize the consent process over documentation, assess the realistic magnitude and probability of risks and benefits of research described for potential participants, facilitate the use of waiver of guardian permission for minimal risk research with adolescents, and facilitate the consent process for children’s participation in research.
The committee made the following recommendations for HHS to consider in revising the regulations concerning informed consent in the Common Rule.
Recommendation 4.1: HHS should eliminate regulatory language that suggests certain formats or elements are a default in all situations and focus instead on tailoring consent to be appropriate to the situation and population. This revision should include eliminating ambiguous language currently in 45 C.F.R. § 46.116(d) that has caused IRBs to include consent information that may be irrelevant to adequate human subjects protection.
Recommendation 4.2: HHS should eliminate language in the regulations suggesting that written informed consent disclosures and written documentation that consent has been obtained are the preferred norm and include language permitting informed consent by nonwritten means when appropriate, without requiring action by the IRB to grant a waiver of documentation.
Recommendation 4.3: HHS should revise regulations to require that statements relating only to institutional or sponsor liability be clearly separated from the informed consent information directly related to the research participation.
Recommendation 4.4: The committee does not endorse the ANPRM restriction to “competent adults” for the proposed new excused classification. Instead, the committee recommends that the OHRP provide guidance for investigators and for the final mechanism of oversight for this category, with the aim of fitting the information required for obtaining consent for the new excused category to the population characteristics and specific research context.
Recommendation 4.5:1 HHS should not introduce a requirement for re-consent for future use of pre-existing, de-identified non-research or research data. When investigators wish to link pre-existing identifiable data to the collection of new data from human subjects, consent should be obtained for the new data collection and linking to the archival identifiable dataset.
1This recommendation was made by the committee in response to an ANPRM-proposed revision to the current regulations, page 44,519. Recommendation 4.5 in the prepublication copy erroneously implied that the recommendation was being made to change current regulations.
INFORMATIONAL RISK IN THE SOCIAL AND BEHAVIORAL SCIENCES
Crosscutting issues related to protecting human-subjects research data in the information age are examined by the committee, as well as questions posed by the ANPRM related to methods that would work best for the social and behavioral sciences. The committee pays special attention to new privacy concerns in the context of informational risk and public information used for research. The following recommendations are made for HHS and investigators concerning data protection plans and approaches for providing IRBs and researchers with information technology expertise.
Recommendation 5.1: HHS should not mandate HIPAA as the standard for data security and information protection.
In recommending that HIPAA not be mandated as the data protection and security standard, the committee is not suggesting that another particular set of standards be mandated for social and behavioral sciences, but rather that there be an array of data protection approaches that best fit the data protection needs. These can include
• planning data protection with the concept of a portfolio approach considering safe people, safe projects, safe data, safe settings, and safe outputs;
• utilizing a wide range of statistical methods to reduce risk of disclosure;
• consulting resources and data protection models to help researchers and IRBs such as university research data management service groups, individual IT/protection experts, and specialized institutions such as the Inter-university Consortium for Political and Social Research at the University of Michigan, Ann Arbor, and NORC at the University of Chicago;
• existing standards for data protection promulgated by the National Institute of Standards and Technology; and
• developing a future national center to define and certify the levels of informational risk of different types of studies and corresponding data protection plans to ensure risks are minimized.
Recommendation 5.2: In light of rapid changes in data of scientific value and in technologies that can be harnessed to reduce or increase informational risk, HHS should consider developing an institutional or organizational entity such as a national center to define and certify the
levels of information risk of different types of studies and corresponding data protection plans to ensure risks are minimized.
Recommendation 5.3: As a condition of undertaking secondary research on public-use or restricted-access data, investigators have the responsibility to protect the confidentiality of the data and honor the data protection plan and other agreements with the data provider, whether the data provider is the primary researchers involved in the study, an agency or institution, or a data distribution organization. The revised regulations and OHRP guidance on data use should make clear that secondary users must honor confidentiality agreements but that no further consent from human subjects is needed to use such data. The revised regulations should also make clear that data providers may share data without consent of human subjects as long as users adhere to the original confidentiality agreements and other conditions of use.
Recommendation 5.4: If investigators collected data from human subjects (i.e., primary data collection), their additional consent is not necessary to subsequently link to other pre-existing data, except under circumstances where human subjects are being asked to participate further in the research or if their original consent prohibited future data linkage. The fact that additional consent is not required to link data does not reduce the responsibility of investigators to modify and register their data protection plans.
Recommendation 5.5: Investigators using non-research private information (e.g., student school or health records) need to adhere to the conditions for use set forth by the information provider and prepare a data protection plan consonant with these conditions, calibrated to the level of risk, and sufficient to reduce risk through disclosure. Further consent is not required from individuals as long as investigators pledge to adhere to confidentiality agreements.
The committee concludes that, in the rapidly changing environment of information and information technology, an ongoing research program is needed to ensure that regulation of informational risk is adequate and appropriate. In particular research is needed on topics such as
• innovations in the data use of non-research information and records,
• new ways of collecting and linking data, and
• new methods for measuring and quantifying informational risk and risk reduction techniques.
Since it is increasingly unknowable whether existing disclosure limitation mechanisms sufficiently balance disclosure risks and the utility inherent in social and behavioral research datasets, the committee recommends that (a) disclosure limitation mechanisms be tested against actual datasets to determine which methods are appropriate to develop best practices, and (b) federal science and statistical agencies sponsor the development of disclosure risk assessment and risk mitigation strategies that are consistent with the needs of “big data” used in the social and behavioral sciences.
IMPROVEMENT IN IRB PROCESSES
All of the report incorporates committee suggestions on how IRB procedures might be improved. Where possible the committee also provides examples on how these improvements might be made. In the final chapter, the committee presents broader procedural issues not covered in prior chapters and provides guidance on improving the IRB process through the efforts of IRB staff, members, and institutional officials. Recommendations are made in areas related to ANPRM proposals to expand the scope of the Common Rule and to establish a single IRB of record for multisite studies. The committee also offers recommendations for establishing appeals processes for IRB decisions.
Recommendation 6.1: In revising the Common Rule, HHS should keep the scope of coverage by the Common Rule within the present boundaries: “all research involving human subjects conducted, supported or otherwise subject to regulation by any federal department or agency which takes appropriate administrative action to make the policy applicable to such research” (45 C.F.R. § 46.101(a)).
Recommendation 6.2: HHS should adopt the proposal set forth in the ANPRM to establish single IRBs of record for multisite studies, with some conditions. These conditions might include the following:
(a) The establishment of single IRBs of record should be voluntary rather than mandatory.
(b) Any requirement to use a single IRB of record for multisite studies should be phased in gradually so that individual IRBs and human research protection programs will have time to make necessary changes to adapt to this new system.
(c) The charge to the single IRB of record should be limited to making determinations and meeting the responsibilities set forth in the Common Rule. There are other locally specific functions commonly carried out by IRBs such as specifying (i) who should be contacted
in case a participant believes his or her rights have been violated and (ii) where and when to go to participate in various components of the research. Such matters should remain the responsibility of the local institution’s human research protection program.
(d) Approval by the single IRB of record should suffice to inform the sponsor that the proposal has been approved.
(e) However, participating institutions should not be allowed to begin their research activities until they have met their local responsibilities; such delays in local participation should not be imposed on those other participating institutions that have already met their own local responsibilities.
Recommendation 6.3: In each institution in which research involving human participants is carried out, a system should be developed for the appeal of IRB decisions.
Finally in order to assist in developing best practices for implementing the new human research protections and assessing the effectiveness of the rules and their implementation, the committee recommends that research be conducted on the costs and benefits for institutions, IRBs, investigators, and sponsors of regulating social and behavioral research on human subjects.