DHHS Eagle graphic
ASL Header
Mission Nav Button Division Nav Button Grants Nav Button Testimony Nav Button Other Links Nav Button ASL Home Nav Button
US Capitol Building
HHS Home
Contact Us
dot graphic Testimony bar

This is an archive page. The links are no longer being updated.

Testimony on Medical Record Privacy by Gary B. Ellis, Ph.D.
Office for Protection from Research Risks, Office of Extramural Research,
Office of the Director, National Institutes of Health,
U.S. Department of Health and Human Services

Before the Senate Committee on Health, Education, Labor, and Pension
February 24, 1999

Mr. Chairman and Members of the Committee:

I am Gary Ellis, Director of the Office for Protection from Research Risks (OPRR), Office of Extramural Research, Office of the Director, National Institutes of Health. I also chair the interagency Committee on protecting human research subjects, known formally as the Subcommittee on Human Subjects Research, Committee on Science, National Science and Technology Council.

With the General Accounting Office (GAO) delivering its report, Medical Records Privacy: Access Needed for Health Research But Oversight of Privacy Protections Is Limited, at this morning's hearing, we are reminded that various medical records (including, for example, occupationally collected medical records) and the sensitive information they contain, if inappropriately released, can do serious social harm to individuals. Social harms which can result from a breach of confidentiality include such harms as embarrassment (e.g., sexual dysfunction), disruption of family life (e.g., venereal disease), loss of employment (e.g., drug treatment information), and loss of insurance coverage (e.g., HIV status). These harms are real harms. They can cause pain and suffering, as with physical injury. They can ruin people's lives. In conducting research using identifiable medical records, social harms must be given as much consideration as physical harms.

I am pleased to appear before the Committee to describe the federal system of protection of human research subjects referenced in the GAO report.

This year marks the 25th anniversary of the formal promulgation in 1974 of the Department of Health and Human Services (DHHS) regulations for Protection of Human Subjects in research (Title 45, Code of Federal Regulations, Part 46; May 30, 1974) and the enactment of the National Research Act (Public Law 93-348; July 12, 1974). At their core (Subpart A), the DHHS regulations contain requirements for assuring that research institutions protect human subjects of research; requirements for researchers' obtaining and documenting informed consent; and requirements for Institutional Review Board (IRB) membership, functions, operations, review of research, and record keeping. The DHHS regulations also contain additional protections for certain vulnerable research subjects--pregnant women (Subpart B), prisoners (Subpart C), and children (Subpart D).

The "Common Rule"

In 1991, the core DHHS regulations (45 CFR Part 46, Subpart A) were formally adopted by more than a dozen other Departments and Agencies that conduct or fund research involving human subjects as the Federal Policy for the Protection of Human Subjects. The Federal Policy for the Protection of Human Subjects is often referred to as the "Common Rule." Today, the 1991 Federal Policy is shared by 17 Departments and Agencies, representing most, but not all, of the federal Departments and Agencies sponsoring human-subjects research. The federal research portfolio includes a wide array of research (e.g., biomedical research; behavioral research; education research; workplace health studies).

In addition, certain federally sponsored and much privately sponsored research is subject to the regulations of the Food and Drug Administration (FDA) at 21 CFR Parts 50 and 56. FDA regulations confer protections on human subjects in research when a drug, device, biologic, food additive, color additive, electronic product, or other test article subject to FDA regulation is involved. FDA regulations and the provisions of the Common Rule are largely congruent, although some significant differences exist.

The Common Rule defines "research" as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge." Activities which meet this definition constitute research for purposes of the Common Rule, whether or not they are conducted or supported under a program which is considered research for other purposes. Some demonstration and service programs, for example, may include research activities.

The Common Rule defines "human subject" as "a living individual about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information." Private information includes a medical record.

FDA regulations define "human subject" as "an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a patient." With this definition of "human subject," FDA does not regulate the category of research studies in which the principal risk is a breach of confidentiality.

Institutional Review Boards

The cornerstone of our federally regulated, yet decentralized, system of protection of human research subjects is the Institutional Review Board at the local research site. The IRB is, by federal regulation, to consist of a minimum of five people, including at least one scientist, one nonscientist, and one person not otherwise affiliated with that institution. The nonscientist must be present to achieve a quorum. The members must have varying backgrounds to promote complete and adequate review of research activities commonly conducted by the institution.

The IRB must be sufficiently qualified through the experience, expertise, and diversity of its members to promote respect for its advice and counsel in safeguarding the rights and welfare of human subjects. In addition to possessing the professional competence necessary to review specific research activities, the IRB must be able to ascertain the acceptability of proposed research in terms of institutional commitments and regulations, applicable law, and standards of professional conduct and practice. The IRB must therefore include persons knowledgeable in these areas.

Under the Common Rule, no human-subjects research may be initiated, and no ongoing research may continue, in the absence of an IRB approval. By regulation, 17 federal Departments and Agencies cannot provide funds for human subjects research unless an IRB approves the protocols for such studies.

Let me turn briefly to the specific responsibilities of the Institutional Review Board. IRB review assures that:

  • risks to subjects are minimized;
  • risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result;
  • selection of subjects is equitable;
  • there is proper informed consent and documentation thereof;
  • when appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects;
  • when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data; and
  • additional safeguards have been included in the study to protect the rights and welfare of any subjects likely to be vulnerable to coercion or undue influence.

Once research is initiated, IRBs have continuing responsibilities. These include:

  • The conduct of continuing review at intervals appropriate to the degree of risk, and in any event, not less than once per year.
  • Authority to observe or have a third party observe the consent process and the research.
  • Receipt of prompt reports from investigators of any unanticipated problems involving risks to subjects or others, or any serious or continuing noncompliance with the IRB's requirements or determination, or with the regulations.
  • Authority to suspend or terminate IRB approval of research that is not being conducted in accord with the IRB's requirements or that has been associated with unexpected serious harm to subjects.

Informed Consent

I want to emphasize how integral--how crucial--the process of informed consent is. Many people have a general picture of informed consent, and it is useful to add higher resolution to that picture. Federal regulations specify 14 elements of informed consent, 8 of which are always required:

    (1) A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's participation, a description of the procedures to be followed, and identification of any procedures which are experimental.

    (2) A description of any reasonably foreseeable risks or discomforts to the subject.

    (3) A description of any benefits to the subject or to others which may reasonably be expected from the research.

    (4) A disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous to the subject.

    (5) A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.

    (6) For research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained.

    (7) An explanation of whom to contact for answers to pertinent questions about the research and research subjects' rights, and whom to contact in the event of a research-related injury to the subject.

    (8) A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.

A researcher who seeks to recruit an individual for research without conveying these elements of information in language understandable to the potential subject is not obtaining informed consent.

Alteration or Waiver of Informed Consent

The Common Rule provides for alteration or waiver of informed consent in two types of circumstances.

In one circumstance, an IRB may approve a consent procedure which does not include, or which alters, some or all of the required elements of informed consent, or waive the requirement to obtain informed consent provided the IRB finds and documents that:

    (1) the research or demonstration project is to be conducted by or subject to the approval of state or local government officials and is designed to study, evaluate, or otherwise examine: (i) public benefit or service programs; (ii) procedures for obtaining benefits or services under those programs; (iii) possible changes in or alternatives to those programs or procedures; or (iv) possible changes in methods or levels of payment for benefits or services under those programs; and

    (2) the research could not practicably be carried out without the waiver or alteration.

In another circumstance, an IRB may approve a consent procedure which does not include, or which alters, some or all of the required elements of informed consent, or waive the requirements to obtain informed consent provided the IRB finds and documents that:

    (1) the research involves no more than minimal risk to the subjects;

    (2) the waiver or alteration will not adversely affect the rights and welfare of the subjects;

    (3) the research could not practicably be carried out without the waiver or alteration; and (4) whenever appropriate, the subjects will be provided with additional pertinent information after participation.

FDA regulations have no provisions for altering or waiving the requirement for informed consent under these conditions, because the types of studies which would qualify for such waivers are either not regulated by FDA or are covered by emergency research regulations.

The Common Rule also provides authority to federal Department or Agency heads to waive the applicability of some or all of the provisions of the Common Rule to specific research activities or classes of research activities otherwise covered by the regulations. This authority has been used sparingly since 1991.

Assurance of Compliance

Within DHHS, OPRR oversees implementation of the human-subject regulations in all DHHS facilities as well as domestic and foreign institutions or sites receiving DHHS funds. In keeping with the provisions of the Common Rule, OPRR requires that each DHHS agency and extramural research institution that conducts research involving human subjects sets forth the procedures it will use to protect human subjects in a policy statement called an "Assurance" of compliance. Under the Common Rule, OPRR has authority to approve an Assurance at DHHS-funded institutions for federal-wide use.

An Assurance with OPRR is a formal, written commitment to implement: (1) widely held ethical principles; (2) the DHHS Regulations for Protection of Human Subjects; and (3) institutional procedures adequate to safeguard the rights and welfare of human subjects. The terms of the institution's Assurance are negotiated with OPRR. The detailed, written Assurance statement becomes the instrument that OPRR uses to gauge an institution's compliance with human subject protections if there is a problem.

At OPRR's discretion, institutions with a large volume of research and demonstrated expertise in human subjects protection may be granted a Multiple Project Assurance. A Multiple Project Assurance, as the term implies, is an institution's pledge of full human subject protections for multiple projects at the institution.

At present, OPRR holds some 430 Multiple Project Assurances that cover some 730 research institutions in the United States and Canada. Most of these Multiple Project Assurances, at the voluntary election of the research institution, commit all activities at the institution--irrespective of funding source--to the DHHS regulations for Protection of Human Subjects. OPRR appreciates the willingness of many institutions to choose this voluntary option.

Beyond the Protections of the Common Rule

What human-subjects research lies beyond the sometimes-overlapping umbrellas of protection of the Common Rule and FDA regulations? There can be no definitive answer, as the bounds of this domain are unknown and there is no systematic collection of such data.

Through allegations reported to OPRR, the Office is aware of instances of human-subjects research beyond the existing federal protections. There are two types of activities: (i) research that is not safeguarded by the Common Rule or FDA regulations, and (ii) activities that investigators do not acknowledge to be research.

OPRR has identified human-subjects research conducted in the absence of federal protections at some colleges and universities not receiving federal research funds; some in vitro fertilization clinics; some weight-loss or diet clinics; some physician offices, some dentist offices, and some psychotherapist offices; some legal services clinics; some corporate and industrial health, safety, and fitness programs; some developers of genetic tests; and some World Wide Web sites. Once OPRR determines that it has no authority or jurisdiction, OPRR is unable to pursue such matters.


Our enduring and vigorous system of protection of human research subjects is designed to prevent physical injury, psychological injury, and harm to the dignity of research subjects, as biomedical and behavioral scientists pursue new knowledge for the common good. We are always interested in improving the system to make research as safe as it possibly can be.

In the final analysis, Mr. Chairman and Members of the Committee, research investigators, institutions, and we are stewards of a trust agreement with the people who are research subjects. For research subjects who are safeguarded by the Common Rule or FDA regulations, we have a system in place that (1) minimizes the potential for harm, (2) enables and protects individual, autonomous choice, and (3) promotes the pursuit of new knowledge. By doing so, we protect the rights and welfare of our fellow citizens who make a remarkable contribution to the common good by participating in research studies. We owe all subjects our best effort.

Thank you, Mr. Chairman. I am pleased to answer any questions about our system for safeguarding the rights and welfare of human research subjects.

Privacy Notice (www.hhs.gov/Privacy.html) | FOIA (www.hhs.gov/foia/) | What's New (www.hhs.gov/about/index.html#topiclist) | FAQs (answers.hhs.gov) | Reading Room (www.hhs.gov/read/) | Site Info (www.hhs.gov/SiteMap.html)