OHRP Home | About OHRP | Search OHRP | Contact OHRP | OHRP News

Office for Human Research Protections (OHRP)

Compliance Oversight

NOTE: THIS GUIDANCE REPLACES OHRP's DECEMBER 4, 2000 GUIDANCE ENTITLED "COMPLIANCE OVERSIGHT PROCEDURES" CLICK HERE

Office for Human Research Protections (OHRP) Department of Health and Human Services (HHS)

OHRP's Compliance Oversight Procedures for Evaluating Institutions

Date: October 19, 2005

Scope: This document summarizes the procedures used by OHRP in performing evaluations of institutions that are engaged in human subjects research conducted or supported by the Department of Health and Human Services (HHS). In particular, OHRP offers guidance on the following topics:

How OHRP conducts for-cause compliance oversight evaluations
How OHRP conducts not-for-cause compliance oversight evaluations
Possible outcomes of OHRP compliance oversight evaluations
Public and governmental access to OHRP compliance oversight evaluation records
Privacy Act not applicable to OHRP compliance oversight evaluation records

Target Audience: Institutions and investigators that conduct human subjects research, institutional review boards (IRBs), HHS agencies that fund human subjects research, and members of the public.

Legal Authority:

Section 289 of the Public Health Service Act authorizes OHRP to, on behalf of HHS, establish a compliance oversight process regarding violations of the rights of human subjects of research conducted or supported by HHS. Pursuant to this authority, OHRP may receive reports of such violations and take appropriate action.

OHRP also derives compliance authority from the HHS regulations for the protection of human research subjects (HHS regulations) at 45 CFR part 46. Section 45 CFR 46.103(a) of the HHS regulations requires each institution engaged in non-exempt human subjects research that is conducted or supported by HHS to provide written assurance that it will comply with the requirements of the HHS regulations. On behalf of HHS, OHRP reviews and approves these written agreements to comply with the HHS regulations, called assurances of compliance (assurances). An assurance approved by OHRP (such as the Federalwide assurance) commits the entire institution (including institutional officials, IRBs designated in the assurance, research investigators, and all other employees or agents) to full compliance with the HHS regulations, or for institutions located outside the United States, comparable international standards, whenever the institution is engaged in HHS-conducted or -supported human subjects research.

How OHRP Conducts For-Cause Compliance Oversight Evaluations:

For-cause evaluations occur in response to OHRP's receipt of substantive written allegations or indications of non-compliance with the HHS regulations. Sources of such allegations or indications of noncompliance include, but are not limited to, research subjects and their family members, individuals involved in the conduct of research such as investigators and study coordinators, institutional officials, and research publications. Complainants may submit allegations of noncompliance by mail, e-mail, or fax to OHRP's Director of the Division of Compliance Oversight, 1101 Wootton Parkway, Suite 200, Rockville, MD, 20852 (email ohrp@osophs.dhhs.gov ; fax (240) 453-6909). OHRP accepts complaints submitted anonymously, and asks complainants who identify themselves to OHRP whether OHRP may reveal their identity to the institution where the alleged noncompliance may have occurred.

When OHRP receives an allegation or indication of noncompliance, it proceeds as follows:

(1) OHRP determines whether it has jurisdiction to evaluate the allegations or indications of noncompliance at the relevant institution(s), based on whether the possible noncompliance involves non-exempt human subjects research that is HHS-conducted or -supported, or covered by an applicable OHRP-approved assurance. If an institution's assurance voluntarily extends the HHS regulations to all research regardless of support, OHRP has the authority to evaluate allegations or indications of noncompliance pertaining to all research to which the assurance applies, including research that is not federally conducted or supported. If OHRP receives an allegation or indication of noncompliance related to human subjects research that is covered by an OHRP-approved assurance and is conducted or supported solely by a federal department or agency other than HHS, OHRP will refer the matter to the other department or agency for review and action as appropriate.

(2) OHRP notifies any complainant who provides contact information as to whether OHRP will open a compliance oversight evaluation of the allegations raised.

(3) If OHRP has jurisdiction to evaluate the possible noncompliance, it sends officials at the institution(s) engaged in the research an initial inquiry letter informing them that OHRP is evaluating human subjects research protections at their institution(s). The initial inquiry letter:

(a) describes the allegations or indications of noncompliance, and potential regulatory violations;

(b) asks the institution to conduct an investigation of the potential noncompliance;

(c) asks for a written response to the allegations or indications of noncompliance, and for submission of supporting documentation (including relevant IRB and research records) by a specified date;

(d) asks the institution to develop and submit a corrective action plan if the investigation conducted by the institution reveals any noncompliance; and

(e) provides an explanation of OHRP's compliance oversight evaluation procedures.

OHRP does not take any action against an institution without first affording the institution an opportunity to offer information that might refute the allegations or indications of noncompliance, except in very rare circumstances where serious concerns about subject safety require an immediate suspension of research activities.

(4) OHRP sends copies of the initial inquiry letter to the principal investigator(s) of the specific research project(s) at issue.

(5) OHRP evaluates the documentation submitted by the institution in response to OHRP's initial inquiry letter to determine whether additional information is needed for OHRP to determine whether there is evidence of noncompliance with the HHS regulations.

(6) If OHRP has specific additional questions or concerns that can be addressed by the institution in writing, it will send a follow-up letter to the institution. If OHRP feels that discussion of pertinent issues with institutional employees, IRB members, research investigators, or others would assist OHRP's decision making, it may conduct telephone interviews or an on-site visit of the institution's human subject protection program. On-site visits also are conducted when IRB record review, or evaluation of institutional facilities, is relevant to OHRP's determinations, or if OHRP has serious concerns about an institution's system for protecting human subjects.

(7) Based on the institution's responses and any relevant information received from the complainant or other sources, OHRP issues a letter to the institution containing OHRP's findings, concerns, and recommendations pertaining to (a) the specific allegations or indications of noncompliance with the HHS regulations and (b) the institution's program for protecting human subjects, including IRB operating procedures and policies. In addition, if OHRP makes findings of noncompliance, it will describe in its letter any relevant corrective actions proposed or implemented by the institution and the extent to which these corrective actions adequately address the noncompliance. If the institution has not proposed an adequate corrective action plan to address one or more of OHRP's findings of noncompliance, OHRP's letter will require the institution to develop and submit in writing an appropriate corrective action plan by a specified date. OHRP expects institutions to tailor their corrective actions both to the specific facts under evaluation and to OHRP's conclusions regarding the strength of the institution's program for protecting human subjects. OHRP evaluates all corrective action plans proposed in response to OHRP findings of noncompliance, and assesses how institutions have progressed with implementation of the corrective action plans, before deciding whether to conclude its evaluation.

(8) If OHRP makes no findings of noncompliance, or if OHRP makes findings of noncompliance but determines that they have been adequately addressed through corrective action, OHRP concludes its evaluation and informs the institution of this final outcome in writing.

(9) If OHRP's compliance oversight evaluation was initiated by a complainant who provided contact information, OHRP informs the complainant in writing of OHRP's findings and any corrective actions taken by the institution upon completion of the evaluation.

(10) An institution may request that the Director of OHRP review any findings resulting from a for-cause compliance oversight evaluation.

How OHRP Conducts Not-For-Cause Compliance Oversight Evaluations:

Not-for-cause compliance oversight evaluations are conducted in the absence of substantive allegations or indications of non-compliance. Institutions are selected for not-for-cause evaluation based on a range of considerations, including: (a) volume of HHS- supported research, (b) relatively low level of reporting under the requirements of HHS regulations at 45 CFR 46.103(b)(5); (c) lingering concerns following a previous for-cause compliance oversight evaluation, (d) complaints about a human subject protection program that indicate dysfunction without clearly implicating particular regulatory requirements, (e) geographic location, (f) status of accreditation by professionally recognized human subject protection program accreditation groups, and (g) status of recent human subject protection evaluation or audit by other regulatory agencies (such as the Food and Drug Administration) or recent participation in quality improvement programs (such as OHRP's Quality Improvement program).

When OHRP decides to undertake a not-for-cause compliance oversight evaluation, it proceeds as follows:

(1) OHRP advises institutional officials in writing that it intends to conduct an evaluation of human subject protections at the institution. OHRP's notice requests that the institution provide to OHRP by a specified date relevant information concerning the institution's human subject protection program, including:

(a) IRB policies and procedures;

(b) minutes from recent IRB meetings; and

OHRP's initial written notice also indicates whether the evaluation will include telephone interviews with institutional officials, IRB members, and research investigators, and whether OHRP intends to conduct an on-site evaluation of human subject protections at the institution.

(2) OHRP may decide as a not-for-cause evaluation progresses that additional information is needed to determine whether there is evidence of noncompliance with the HHS regulations. Hence, not-for-cause compliance oversight evaluations initially based on telephone interviews or mailed documents may subsequently expand to include an on-site evaluation.

(3) Following its evaluation, OHRP issues a letter to the institution containing OHRP's findings, concerns and recommendations regarding the institution's compliance with the HHS regulations with respect to its human subject protection program, including its IRB operating policies and procedures. In addition, if OHRP makes findings of noncompliance, it will describe in its letter any relevant corrective actions proposed or implemented by the institution and the extent to which these corrective actions adequately address the noncompliance. If the institution has not proposed an adequate corrective action plan to address one or more of OHRP's findings of noncompliance, OHRP's letter will require the institution to develop and submit in writing an appropriate corrective action plan by a specified date. OHRP expects institutions to tailor their corrective actions both to the specific facts under evaluation and to OHRP's conclusions regarding the strength of the institution's program for protecting human subjects. OHRP evaluates all corrective action plans proposed in response to OHRP findings of noncompliance, and assesses how institutions have progressed with implementation of the corrective action plans before deciding whether to conclude its evaluation.

(4) If OHRP makes no findings of noncompliance, or if OHRP makes findings of noncompliance but determines that they have been adequately addressed through corrective action, OHRP concludes its evaluation and informs the institution in writing of this final outcome.

(5) An institution may request that the Director of OHRP review any findings resulting from a not-for-cause compliance oversight evaluation.

Possible Outcomes of OHRP Compliance Oversight Evaluations:

OHRP for-cause and not-for-cause compliance oversight evaluations will result in one or more of the following outcomes, in accordance with OHRP's authority under 45 CFR 46.103(e):

(1) OHRP does not identify any areas of noncompliance with the HHS regulations.

(2) OHRP does not identify any areas of noncompliance with the HHS regulations, but recommends improvements to the institution's human subject protection policies and procedures, such as better documentation of actions or communications in IRB protocol records, or clearer description of operational details in IRB written procedures.

(3) OHRP determines that the institution's policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the HHS regulations and, as a result, requires that the institution develop and implement corrective actions. Examples of corrective actions that institutions have undertaken to address OHRP findings include:

(a) re-review by the IRB of research for which IRB determinations required for approval were not previously made;

(b) implementing a new IRB database management strategy to ensure timely continuing review or review of amendments; and

(4) OHRP determines that the institution's policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the HHS regulations and, as a result, restricts or attaches conditions to its approval of the institution's assurance based on the nature and scope of the institution's noncompliance. Despite such restrictions, OHRP allows affected research projects to continue if the institution satisfies the terms of the restriction or conditions placed upon research activities, and if the continuation of those activities is consistent with the best interests of the research subjects. Examples of such restrictions include, but are not limited to:

(a) requiring special reporting (such as quarterly reports) to OHRP;

(b) requiring that IRB members, institutional officials, investigators, or others receive appropriate education and training regarding human subjects research protections;

(d) suspending all research currently conducted under the assurance until specified protections or corrective actions have been implemented.

(5) OHRP determines that the institution's policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the HHS regulations and, as a result, withdraws its approval of an institution's assurance. The institution's research projects cannot be supported by any HHS component until OHRP approval of the assurance is reinstated.

(6) OHRP determines that the institution's policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the HHS regulations and, as a result, recommends to appropriate HHS officials:

(a) that an institution or an investigator be temporarily suspended or permanently removed from participation in specific projects, or

(b) that HHS scientific peer review groups be notified of an institution's or an investigator's past noncompliance prior to review of new projects.

(7) OHRP determines that the institution's policies and procedures for protecting human subjects under an institution's assurance, either for specific research or for all research in general, are NOT in compliance with the HHS regulations and, as a result, recommends to appropriate HHS officials or Public Health Service agency heads, that institutions or investigators be debarred in accordance with the procedures specified at 45 CFR part 76. Debarment is a government-wide sanction.

Public and Governmental Access to Compliance Oversight Evaluation Documents:

Under HHS regulations at 45 CFR part 5, documents related to OHRP compliance oversight evaluations may be subject to the provisions of the Freedom of Information Act (FOIA). In most cases, such documents are exempt from the disclosure provisions of the FOIA while the evaluation is in progress, and OHRP treats them confidentially. However, determination letters are available for release under FOIA at the time they are provided to the institution. Each determination letter will be made accessible on the OHRP website once a request for the letter under FOIA is received or ten working days after the letter is issued to the institution, whichever occurs first. However, sections that discuss unresolved concerns, questions, or allegations related to an ongoing compliance oversight evaluation will be redacted from the posted letters. In addition, most other documents and nonredacted determination letters become publicly available once the compliance oversight evaluation is closed.

OHRP routinely advises appropriate HHS agencies and officials (for example, from NIH, FDA, CDC, etc.) concerning the status of its evaluations and may share compliance documents with other federal agencies as appropriate. Additionally, OHRP may be required to inform members of Congress about its compliance evaluations, and to provide Congress some or all of the information or documents in its files.

Privacy Act Not Applicable to OHRP Compliance Oversight Evaluation Records:

Under HHS regulations at 45 CFR part 5b, records that are retrieved by an individual's name or other personal identifier are subject to the provisions of the Federal Privacy Act of 1974. OHRP maintains compliance oversight evaluation information in a system of records identifying the institution under evaluation. Records can be retrieved by an institution's name or assurance number, but not by any individual's name. Therefore, the Privacy Act does not apply to information OHRP obtains in the course of a compliance oversight evaluation.

Questions:

For questions about compliance oversight procedures, please contact OHRP at (240) 453-6900 or 1-866-447-4777 (toll free within the U.S.) , or by email at ohrp@osophs.dhhs.gov.

The White House | USA.gov | Helping America's Youth | HHS Archive