Mr. Chairman and Members of the Committee:
I am Gary Ellis, Director of the Office for Protection from Research Risks (OPRR), Office of
Extramural Research, Office of the Director, National Institutes of Health. I also chair the
interagency Committee on protecting human research subjects, known formally as the
Subcommittee on Human Subjects Research, Committee on Science, National Science and
Technology Council.
With the General Accounting Office (GAO) delivering its report, Medical Records Privacy:
Access Needed for Health Research But Oversight of Privacy Protections Is Limited, at this
morning's hearing, we are reminded that various medical records (including, for example,
occupationally collected medical records) and the sensitive information they contain, if
inappropriately released, can do serious social harm to individuals. Social harms which can
result from a breach of confidentiality include such harms as embarrassment (e.g., sexual
dysfunction), disruption of family life (e.g., venereal disease), loss of employment (e.g., drug
treatment information), and loss of insurance coverage (e.g., HIV status). These harms are real
harms. They can cause pain and suffering, as with physical injury. They can ruin people's lives.
In conducting research using identifiable medical records, social harms must be given as much
consideration as physical harms.
I am pleased to appear before the Committee to describe the federal system of protection of
human research subjects referenced in the GAO report.
This year marks the 25th anniversary of the formal promulgation in 1974 of the Department of
Health and Human Services (DHHS) regulations for Protection of Human Subjects in research
(Title 45, Code of Federal Regulations, Part 46; May 30, 1974) and the enactment of the National
Research Act (Public Law 93-348; July 12, 1974). At their core (Subpart A), the DHHS
regulations contain requirements for assuring that research institutions protect human subjects of
research; requirements for researchers' obtaining and documenting informed consent; and
requirements for Institutional Review Board (IRB) membership, functions, operations, review of
research, and record keeping. The DHHS regulations also contain additional protections for
certain vulnerable research subjects--pregnant women (Subpart B), prisoners (Subpart C), and
children (Subpart D).
The "Common Rule"
In 1991, the core DHHS regulations (45 CFR Part 46, Subpart A) were formally adopted by more
than a dozen other Departments and Agencies that conduct or fund research involving human
subjects as the Federal Policy for the Protection of Human Subjects. The Federal Policy for the
Protection of Human Subjects is often referred to as the "Common Rule." Today, the 1991
Federal Policy is shared by 17 Departments and Agencies, representing most, but not all, of the
federal Departments and Agencies sponsoring human-subjects research. The federal research
portfolio includes a wide array of research (e.g., biomedical research; behavioral research;
education research; workplace health studies).
In addition, certain federally sponsored and much privately sponsored research is subject to the
regulations of the Food and Drug Administration (FDA) at 21 CFR Parts 50 and 56. FDA
regulations confer protections on human subjects in research when a drug, device, biologic, food
additive, color additive, electronic product, or other test article subject to FDA regulation is
involved. FDA regulations and the provisions of the Common Rule are largely congruent,
although some significant differences exist.
The Common Rule defines "research" as "a systematic investigation, including research
development, testing, and evaluation, designed to develop or contribute to generalizable
knowledge." Activities which meet this definition constitute research for purposes of the
Common Rule, whether or not they are conducted or supported under a program which is
considered research for other purposes. Some demonstration and service programs, for example,
may include research activities.
The Common Rule defines "human subject" as "a living individual about whom an investigator
(whether professional or student) conducting research obtains (1) data through intervention or
interaction with the individual, or (2) identifiable private information." Private information
includes a medical record.
FDA regulations define "human subject" as "an individual who is or becomes a participant in
research, either as a recipient of the test article or as a control. A subject may be either a healthy
human or a patient." With this definition of "human subject," FDA does not regulate the
category of research studies in which the principal risk is a breach of confidentiality.
Institutional Review Boards
The cornerstone of our federally regulated, yet decentralized, system of protection of human
research subjects is the Institutional Review Board at the local research site. The IRB is, by
federal regulation, to consist of a minimum of five people, including at least one scientist, one
nonscientist, and one person not otherwise affiliated with that institution. The nonscientist must
be present to achieve a quorum. The members must have varying backgrounds to promote
complete and adequate review of research activities commonly conducted by the institution.
The IRB must be sufficiently qualified through the experience, expertise, and diversity of its
members to promote respect for its advice and counsel in safeguarding the rights and welfare of
human subjects. In addition to possessing the professional competence necessary to review
specific research activities, the IRB must be able to ascertain the acceptability of proposed
research in terms of institutional commitments and regulations, applicable law, and standards of
professional conduct and practice. The IRB must therefore include persons knowledgeable in
these areas.
Under the Common Rule, no human-subjects research may be initiated, and no ongoing research
may continue, in the absence of an IRB approval. By regulation, 17 federal Departments and
Agencies cannot provide funds for human subjects research unless an IRB approves the protocols
for such studies.
Let me turn briefly to the specific responsibilities of the Institutional Review Board. IRB review
assures that:
- risks to subjects are minimized;
- risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and
the importance of the knowledge that may reasonably be expected to result;
- selection of subjects is equitable;
- there is proper informed consent and documentation thereof;
- when appropriate, the research plan makes adequate provision for monitoring the data
collected to ensure the safety of subjects;
- when appropriate, there are adequate provisions to protect the privacy of subjects and to
maintain the confidentiality of data; and
- additional safeguards have been included in the study to protect the rights and welfare of
any subjects likely to be vulnerable to coercion or undue influence.
Once research is initiated, IRBs have continuing responsibilities. These include:
- The conduct of continuing review at intervals appropriate to the degree of risk, and in any
event, not less than once per year.
- Authority to observe or have a third party observe the consent process and the research.
- Receipt of prompt reports from investigators of any unanticipated problems involving
risks to subjects or others, or any serious or continuing noncompliance with the IRB's
requirements or determination, or with the regulations.
- Authority to suspend or terminate IRB approval of research that is not being conducted in
accord with the IRB's requirements or that has been associated with unexpected serious
harm to subjects.
Informed Consent
I want to emphasize how integral--how crucial--the process of informed consent is. Many people
have a general picture of informed consent, and it is useful to add higher resolution to that
picture. Federal regulations specify 14 elements of informed consent, 8 of which are always
required:
(1) A statement that the study involves research, an explanation of the purposes of the
research and the expected duration of the subject's participation, a description of the
procedures to be followed, and identification of any procedures which are experimental.
(2) A description of any reasonably foreseeable risks or discomforts to the subject.
(3) A description of any benefits to the subject or to others which may reasonably be
expected from the research.
(4) A disclosure of appropriate alternative procedures or courses of treatment, if any, that
might be advantageous to the subject.
(5) A statement describing the extent, if any, to which confidentiality of records identifying
the subject will be maintained.
(6) For research involving more than minimal risk, an explanation as to whether any
compensation and an explanation as to whether any medical treatments are available if
injury occurs and, if so, what they consist of, or where further information may be
obtained.
(7) An explanation of whom to contact for answers to pertinent questions about the research
and research subjects' rights, and whom to contact in the event of a research-related injury
to the subject.
(8) A statement that participation is voluntary, refusal to participate will involve no penalty
or loss of benefits to which the subject is otherwise entitled, and the subject may
discontinue participation at any time without penalty or loss of benefits to which the
subject is otherwise entitled.
A researcher who seeks to recruit an individual for research without conveying these elements of
information in language understandable to the potential subject is not obtaining informed
consent.
Alteration or Waiver of Informed Consent
The Common Rule provides for alteration or waiver of informed consent in two types of
circumstances.
In one circumstance, an IRB may approve a consent procedure which does not include, or which
alters, some or all of the required elements of informed consent, or waive the requirement to
obtain informed consent provided the IRB finds and documents that:
In another circumstance, an IRB may approve a consent procedure which does not include, or
which alters, some or all of the required elements of informed consent, or waive the requirements
to obtain informed consent provided the IRB finds and documents that:
(1) the research involves no more than minimal risk to the subjects;
(2) the waiver or alteration will not adversely affect the rights and welfare of the
subjects;
(3) the research could not practicably be carried out without the waiver or alteration; and
(4) whenever appropriate, the subjects will be provided with additional pertinent
information after participation.
FDA regulations have no provisions for altering or waiving the requirement for informed consent
under these conditions, because the types of studies which would qualify for such waivers are
either not regulated by FDA or are covered by emergency research regulations.
The Common Rule also provides authority to federal Department or Agency heads to waive the
applicability of some or all of the provisions of the Common Rule to specific research activities
or classes of research activities otherwise covered by the regulations. This authority has been
used sparingly since 1991.
Assurance of Compliance
Within DHHS, OPRR oversees implementation of the human-subject regulations in all DHHS
facilities as well as domestic and foreign institutions or sites receiving DHHS funds. In keeping
with the provisions of the Common Rule, OPRR requires that each DHHS agency and
extramural research institution that conducts research involving human subjects sets forth the
procedures it will use to protect human subjects in a policy statement called an "Assurance" of
compliance. Under the Common Rule, OPRR has authority to approve an Assurance at DHHS-funded institutions for federal-wide use.
An Assurance with OPRR is a formal, written commitment to implement: (1) widely held
ethical principles; (2) the DHHS Regulations for Protection of Human Subjects; and
(3) institutional procedures adequate to safeguard the rights and welfare of human subjects. The
terms of the institution's Assurance are negotiated with OPRR. The detailed, written Assurance
statement becomes the instrument that OPRR uses to gauge an institution's compliance with
human subject protections if there is a problem.
At OPRR's discretion, institutions with a large volume of research and demonstrated expertise in
human subjects protection may be granted a Multiple Project Assurance. A Multiple Project
Assurance, as the term implies, is an institution's pledge of full human subject protections for
multiple projects at the institution.
At present, OPRR holds some 430 Multiple Project Assurances that cover some 730 research
institutions in the United States
and Canada. Most of these Multiple Project Assurances, at the
voluntary election of the research institution, commit all activities at the institution--irrespective
of funding source--to the DHHS regulations for Protection of Human Subjects. OPRR
appreciates the willingness of many institutions to choose this voluntary option.
Beyond the Protections of the Common Rule
What human-subjects research lies beyond the sometimes-overlapping umbrellas of protection of
the Common Rule and FDA regulations? There can be no definitive answer, as the bounds of
this domain are unknown and there is no systematic collection of such data.
Through allegations reported to OPRR, the Office is aware of instances of human-subjects
research beyond the existing federal protections. There are two types of activities: (i) research
that is not safeguarded by the Common Rule or FDA regulations, and (ii) activities that
investigators do not acknowledge to be research.
OPRR has identified human-subjects research conducted in the absence of federal protections at
some colleges and universities not receiving federal research funds; some in vitro fertilization
clinics; some weight-loss or diet clinics; some physician offices, some dentist offices, and some
psychotherapist offices; some legal services clinics; some corporate and industrial health, safety,
and fitness programs; some developers of genetic tests; and some World Wide Web sites. Once
OPRR determines that it has no authority or jurisdiction, OPRR is unable to pursue such matters.
Conclusion
Our enduring and vigorous system of protection of human research subjects is designed to
prevent physical injury, psychological injury, and harm to the dignity of research subjects, as
biomedical and behavioral scientists pursue new knowledge for the common good. We are
always interested in improving the system to make research as safe as it possibly can be.
In the final analysis, Mr. Chairman and Members of the Committee, research investigators,
institutions, and we are stewards of a trust agreement with the people who are research subjects.
For research subjects who are safeguarded by the Common Rule or FDA regulations, we have a
system in place that (1) minimizes the potential for harm, (2) enables and protects individual,
autonomous choice, and (3) promotes the pursuit of new knowledge. By doing so, we protect the
rights and welfare of our fellow citizens who make a remarkable contribution to the common
good by participating in research studies. We owe all subjects our best effort.
Thank you, Mr. Chairman. I am pleased to answer any questions about our system for
safeguarding the rights and welfare of human research subjects.
