OHRP’s Compliance Oversight Assessments (2024)

OHRP compliance assessments include both compliance investigations and evaluations.

Investigations are for-cause compliance assessments conducted in response to substantiated allegations or indications of noncompliance with the HHS regulations (sometimes referred to as “for-cause investigations”).

Evaluations are not-for-cause compliance assessments conducted in the absence of substantiated complaints or indications of noncompliance with the HHS regulations (sometimes referred to as “not-for-cause evaluations”).

OHRP generally initiates an investigation when it receives a written substantiated complaint or becomes aware of potential noncompliance with HHS regulations through other sources. A complaint is a notification to OHRP of an observation or concern about human subjects research and is considered substantiated when there is sufficient evidence to support a statement that the substance of the complaint would constitute noncompliance with the HHS regulations.

Sources of complaints, allegations or indications of noncompliance include, but are not limited to, research subjects and their family members, individuals involved in the conduct of research such as investigators and study coordinators, institutional officials, and research publications. OHRP may choose to use other mechanisms to address allegations or indications of noncompliance rather than conducting an investigation. In general, OHRP does not issue or post on its website formal correspondence about the resolution of questions about noncompliance.

Individuals may visit OHRP’s web site for more information on how to submit complaints to OHRP about observations or concerns about human subjects research. OHRP will accept complaints submitted anonymously. If a complainant identifies themself to OHRP but requests to remain anonymous, OHRP will not reveal their identity to the IRB or institution where the noncompliance is alleged to have occurred.

When OHRP receives a complaint or other information indicating possible noncompliance, OHRP generally proceeds as follows:

(1)    OHRP determines whether it has jurisdiction over the complaint or other indication of noncompliance at the relevant IRB(s) or institution(s), based on whether the possible noncompliance involves nonexempt human subjects research that is HHS-conducted or –supported, or otherwise covered through the institution’s choice to extend their FWA to all research regardless of funding, or in the case of possible noncompliance by an IRB, whether the IRB reviews HHS-supported human subjects research. Where OHRP and another agency (e.g., Food and Drug Administration (FDA), Department of Defense (DoD), Department of Veterans Affairs (VA)) both have jurisdiction, OHRP will confer with the other agency on the best approach to address the alleged noncompliance, or OHRP may refer the complaint to another agency.

(2)    If OHRP becomes aware of possible noncompliance through a complaint, and the complainant provides their contact information, OHRP will notify the complainant as to whether OHRP will open an investigation in response to the complaint.

(3)    If OHRP determines an investigation is warranted, OHRP sends officials at the IRB(s) or institution(s) an initial inquiry letter informing them of OHRP’s intent to investigate the complaint or indicated noncompliance. Institutions are given an opportunity to offer information that might refute the allegations or indications of noncompliance. In rare cases where allegations suggest that subject safety is at risk, OHRP may require an immediate suspension of research activities.

    The initial inquiry letter will generally include the following:

a)  a description of the complaint or indications of noncompliance, and potential regulatory violations;

b)  a request for the IRB or institution to conduct an investigation of the potential noncompliance;

c)  a request for a written response to the allegations or indications of noncompliance, and for submission of supporting documentation (including relevant IRB and research records) by a specified date;

d)  if the investigation conducted by the institution reveals any noncompliance, a request for the IRB or institution to submit a corrective and preventative action (CAPA) outlining the action(s) an institution’s HRPP or IRB proposes to take to address areas of noncompliance or potential noncompliance with HHS regulations; and

e)  a description of OHRP’s compliance assessment procedures.

(4)    OHRP evaluates the documentation submitted in response to OHRP’s initial inquiry letter and decides whether additional information is needed to determine whether there is evidence of noncompliance with the HHS regulations.

(5)    OHRP engages expert consultants and auditors to assist in investigations, as needed.

(6)    OHRP may conduct interviews with institutional employees, IRB members, research investigators, or others to assist OHRP’s decision-making, as needed. Interviews may be conducted via telephone, videoconference, or in-person during an on-site investigation.

(7)    If OHRP has additional questions or concerns that can be addressed by the IRB or institution in writing, OHRP will provide these questions and concerns in written correspondence. A written response to the questions or concerns will be required by a specified date. This iterative process continues until OHRP has sufficient information to make determination(s) regarding the complaint or other indication of noncompliance and to evaluate whether the corrective actions are appropriate.

(8)    OHRP issues a letter to the IRB or institution containing OHRP’s determinations pertaining to the complaint or other indication of noncompliance with the HHS regulations.

If OHRP makes determinations of noncompliance, OHRP’s letter will describe these determinations along with any relevant CAPAs provided by the institution or IRB.

(9)    OHRP evaluates all CAPAs proposed in response to OHRP’s determinations of noncompliance before deciding whether to conclude the investigation. OHRP is available for assistance in developing CAPAs.

If OHRP determines that the CAPAs do not adequately address one or more of OHRP’s determinations of noncompliance, OHRP may require additional actions be taken by the IRB or institution. Once OHRP determines that the CAPAs adequately address OHRP’s determinations of noncompliance, OHRP will close the investigation.

(10)    OHRP may make recommendations for specific improvements; the IRB or institution may implement these recommendations at their discretion, so long as they comply with the HHS regulations.

(11)    If OHRP makes no determinations of noncompliance, or if OHRP makes determinations of noncompliance but also determines that they have been adequately addressed through CAPAs, OHRP concludes the investigation and informs the IRB or institution of this outcome in writing.

(12)    If OHRP’s compliance oversight investigation was initiated by a complainant who provided an email address, OHRP will notify them of the outcome of the investigation and the link to any determination letter(s) on OHRP’s website. (See section VIII.)

(13)    An IRB, institution, or complainant may request that the Director of OHRP reconsider any determinations resulting from an investigation.

OHRP may choose to use other mechanisms to address alleged noncompliance rather than conducting an investigation. These mechanisms generally include communications with an IRB or institution to address minor infractions for which OHRP can facilitate an expeditious resolution (e.g., a subject who raises concerns about inconsistent payment for participation) and do not warrant opening an investigation. A determination letter is generally not issued when such mechanisms are employed.

Another mechanism OHRP may choose to use, instead of conducting an investigation, involves a collaborative approach with research sponsors (e.g., NIH), investigators, IRBs, and institutions. OHRP may use this collaborative approach to address complaints or other indications of noncompliance about ongoing research studies because it can result in more expeditious actions to address concerns about the safety or welfare of research subjects. These situations may also involve complicated research protocols, such as multisite clinical trials designed by the sponsor, for which OHRP believes its evaluation of the allegations would benefit from more in-depth communications with entities beyond the engaged institution or the reviewing IRB. For such research, this approach offers the most informative communications and may lead to revisions in the trial that ensure the protection of enrolled research subjects. When this mechanism is used, OHRP generally posts a resolution letter on its website describing the research and OHRP’s conclusion.

Evaluations of IRBs or institutions are conducted in the absence of substantive allegations or indications of noncompliance. IRBs or institutions are selected for evaluations based on a variety of considerations, such as:

1)    the volume of HHS-conducted or -supported research that an institution is engaged in or that an IRB oversees;

2)    the history and nature of incidents reported to OHRP under the requirements of the HHS regulations under which the research is being conducted;

3)    follow-ups which may occur to determine if CAPAs have been implemented appropriately;

4)    geographic location;

5)    accreditation of the IRB or institution’s HRPP by a professionally recognized HRPP accreditation group; and

6)    the status of recent human subject protection evaluations or audits by other regulatory agencies (such as the Food and Drug Administration).

When OHRP undertakes an evaluation, OHRP generally proceeds as follows:

(1)    OHRP notifies the head official of the IRB or the institutional official in writing of OHRP’s intention to conduct an evaluation of the IRB or HRPP. OHRP will request institutional and IRB documents from the institution being evaluated as well as documents from IRBs that review research for the institution. Examples of information OHRP may request are as follows:

(a) structural and background information about the IRB or institution;

(b) IRB written policies and procedures;

(c) IRB membership roster(s);

(d) IRB meeting agendas and minutes from recent IRB meetings;

(e) a list of active HHS-supported research protocols or other Common Rule-supported or conducted research protocols;

(f) study records; and

(g) IRB Authorization/Reliance Agreements (if applicable).

OHRP’s initial written notice also indicates whether the evaluation will include interviews with institutional officials, senior/head officials of the IRB, IRB members, and research investigators, observation of IRB meetings, and whether OHRP intends to conduct a virtual, on-site, or hybrid evaluation.

(2)    OHRP may decide during an evaluation that additional information is needed to determine whether there is evidence of noncompliance with the HHS regulations. Hence, evaluations initially conducted virtually may subsequently expand to include an on-site evaluation, or an on-site evaluation may be expanded to include additional virtual activities.

(3)    OHRP engages expert consultants and auditors to assist in evaluations, as needed.

(4)    OHRP’s site visit team holds an exit meeting with institutional officials to review OHRP’s initial evaluation of the institution’s HRPP or IRB’s oversight process. (Note: Exit meetings are conducted for onsite, virtual or hybrid site visits, but not for document-only based evaluations).

(5)    Following the evaluation, OHRP generally issues a questions and concerns letter. This letter gives the institution or IRB an opportunity to provide clarifications on any observations made by OHRP prior to OHRP issuing a determination letter. Ultimately OHRP will issue a determination letter regarding compliance with the HHS regulations. (See section VIII.)

If OHRP makes determinations of noncompliance, OHRP will summarize in writing any relevant CAPAs proposed or implemented by the IRB or institution and the extent to which these CAPAs adequately address the noncompliance. If the IRB or institution has not proposed an adequate CAPA to address one or more of OHRP’s determinations of noncompliance, OHRP will require the IRB or institution to develop and submit in writing an appropriate CAPA by a specified date. The IRB or institution should tailor their CAPAs both to the specific facts under evaluation and to OHRP’s conclusions regarding the strength of the IRB or institution’s program for protecting human subjects.

(6)    OHRP evaluates all CAPAs proposed in response to OHRP’s determinations of noncompliance. OHRP assesses how IRBs or institutions have progressed with implementation of the CAPAs before deciding whether to conclude the evaluation. OHRP is available for assistance in developing CAPAs.

(7)    OHRP may make recommendations for specific improvements. The IRB or institution may implement these recommendations at their discretion, so long as they comply with the HHS regulations.

(8)    If OHRP makes no determinations of noncompliance, or if OHRP makes determinations of noncompliance but determines that they have been adequately addressed through corrective action, OHRP concludes the evaluation and informs the IRB or institution in writing of this outcome.

(9)    An institution may request that the Director of OHRP reconsider any determinations resulting from an evaluation.

The duration of OHRP’s investigations or evaluations vary widely, depending on a variety of factors such as the complexity of the research being investigated, the size of the HRPP, or the review portfolio of the IRB. All institutions and IRBs investigated or evaluated by OHRP are notified of OHRP’s determinations.

 The following lists the possible outcomes of compliance assessments:

If OHRP does not find noncompliance with the HHS regulations, possible outcomes include:

(1)    OHRP’s letter may indicate that OHRP is not taking any actions or making any recommendations;

(2)    OHRP may recommend improvements to the IRB’s or institution’s human subject protection policies and procedures. The IRB or institution has discretion to implement these recommendations or decline to do so, as long as the IRB or institution’s human subjects protection program is in compliance with the HHS regulations.  Examples of this include recommendations for better documentation of actions or communications in IRB records, or changes in the operational details of IRB written procedures.

If OHRP determines that there is noncompliance with the HHS regulations, possible outcomes include

(1)    OHRP may require that the institution develop and implement corrective actions to address noncompliance.

(2)    OHRP can restrict or attach conditions to an institution’s FWA. OHRP’s restriction or conditioning of an institution’s FWA could apply to some or all HHS-conducted or -supported human subjects research, or in rare circumstances, to some or all human subjects research supported by any other Federal department or agency that relies on the FWA, unless the other Federal department or agency issues its own assurance to cover such research.  OHRP’s restriction could, for example, require that all studies covered by the restriction be suspended until OHRP modifies the restriction to allow some or all of the studies to resume, except that research activities involving already enrolled subjects in such research could be permitted to continue if the investigator, IRB, institutional official, and the sponsor determines it is in the best interests of the subjects to do so.  OHRP may also attach conditions to the resumption of studies, such as the addition of a monitoring or oversight mechanism. For example, OHRP’s restriction of an institution’s FWA could require the suspension of all HHS-supported human subjects research, until conditions stipulated by OHRP are satisfied, and OHRP modifies the restriction to allow some or all of the studies to resume.

(3)    OHRP may recommend to appropriate HHS officials that an institution or an investigator be temporarily suspended or permanently removed from participation in specific projects.

(4)    OHRP may recommend to appropriate HHS officials that an institution or investigator be debarred from receiving federal funding in accordance with the procedures specified at 2 CFR Part 376. Debarment is a government-wide sanction.

(5)    OHRP may refer the matter to a Federal department or agency that supports or oversees the research for further review and action, if appropriate.

Under HHS regulations at 45 CFR part 5, documents related to OHRP compliance assessments may be subject to the provisions of the Freedom of Information Act (FOIA). In most cases, such documents are exempt from the disclosure provisions of the FOIA while the investigation or evaluation is in progress, and OHRP treats them confidentially. However, compliance and determination letters are available for release under FOIA once compliance evaluations or investigations are completed and closed. These letters are posted on OHRP’s website after the letter is issued to the IRB or institution. Letters or sections of letters that discuss unresolved concerns, questions, or allegations related to an ongoing compliance oversight evaluation are redacted from letters posted on OHRP’s website.

OHRP routinely advises appropriate HHS agencies and officials concerning the status of its assessments and may share compliance documents with other Federal agencies as appropriate. For example, OHRP routinely shares information about its compliance assessments with FDA when the assessment relates to research that is regulated by FDA. OHRP also routinely shares information about its compliance assessments with the HHS divisions and agencies (e.g., NIH, CDC) that are supporting or conducting the research that is the focus of OHRP’s compliance assessment. Additionally, OHRP may be required to inform members of Congress about its compliance assessments, and to provide Congress some or all of the information or documents in its files.