Compliance Oversight Procedures for Evaluating Institutions (2009)

NOTE: THIS GUIDANCE REPLACES OHRP'S OCTOBER 19, 2005 GUIDANCE ENTITLED "COMPLIANCE OVERSIGHT PROCEDURES FOR EVALUATING INSTITUTIONS"

Office for Human Research Protections (OHRP) Department of Health and Human Services (HHS)

OHRP's Compliance Oversight Procedures for Evaluating Institutions

Date: October 14, 2009

Scope: This document summarizes the procedures used by OHRP in performing compliance oversight evaluations of institutions and human subjects research that are under OHRP's jurisdiction. In particular, OHRP offers guidance on the following topics:

How OHRP conducts for-cause compliance oversight evaluations;
How OHRP conducts not-for-cause compliance oversight evaluations;
Possible outcomes of OHRP compliance oversight evaluations;
Public and governmental access to OHRP compliance oversight evaluation records; and
The Privacy Act is not applicable to OHRP compliance oversight evaluation records.

Target Audience: Institutions and investigators that conduct human subjects research, institutional review boards (IRBs), HHS agencies that fund human subjects research, and members of the public.

Legal Authority:

Section 289 of the Public Health Service Act authorizes OHRP to, on behalf of HHS, establish a compliance oversight process regarding violations of the rights of human subjects of research conducted or supported by HHS. Pursuant to this authority, OHRP may receive reports of such violations and take appropriate action.

OHRP also derives compliance authority from the HHS regulations for the protection of human research subjects at 45 CFR part 46 (hereinafter referred to as "the HHS regulations"). HHS regulations at 45 CFR 46.103(a) require each institution engaged in non-exempt human subjects research that is conducted or supported by HHS to provide written assurance that it will comply with the requirements of the HHS regulations. On behalf of HHS, OHRP reviews and approves these written agreements, called assurances of compliance (Federalwide assurances or FWAs). An FWA approved by OHRP commits the entire institution (including institutional officials, IRBs designated in the FWA, research investigators, and all other employees or agents) to full compliance with the HHS regulations whenever the institution is engaged in HHS-conducted or

-supported human subjects research.

How OHRP Conducts For-Cause Compliance Oversight Evaluations:

For-cause evaluations occur, at OHRP's discretion, in response to OHRP's receipt of substantive written allegations or indications of non-compliance with the HHS regulations. Sources of such allegations or indications of noncompliance include, but are not limited to, research subjects and their family members, individuals involved in the conduct of research such as investigators and study coordinators, institutional officials, and research publications. OHRP may choose to use other mechanisms to address allegations or indications of noncompliance rather than conducting a for-cause evaluation. Complainants may submit allegations of noncompliance by mail, e-mail, or fax to OHRP's Director of the Division of Compliance Oversight, 1101 Wootton Parkway, Suite 200, Rockville, MD, 20852 (email ohrp@hhs.gov; fax (240) 453-6909). OHRP accepts complaints submitted anonymously, and asks complainants who identify themselves to OHRP whether OHRP may reveal their identity to the institution where the alleged noncompliance may have occurred.

When OHRP receives an allegation or indication of noncompliance, OHRP proceeds as follows:

(1) OHRP determines whether our office has jurisdiction to evaluate the allegations or indications of noncompliance at the relevant institution(s), based on whether the possible noncompliance involves non-exempt human subjects research that is HHS-conducted or -supported, or covered by an applicable OHRP-approved FWA. If an institution through its FWA voluntarily applies the HHS regulations to all research regardless of support, OHRP has the authority to evaluate allegations or indications of noncompliance pertaining to all research to which the FWA applies, including research that is not Federally conducted or supported. Where OHRP and another agency both have jurisdiction, OHRP and the other agency will confer as to what arrangement to utilize in responding to the allegation in the particular case. If OHRP receives an allegation or indication of noncompliance related to human subjects research that is covered by an OHRP-approved FWA and is conducted or supported solely by a Federal department or agency other than HHS, OHRP will refer the matter to the other department or agency for review and action as appropriate.

(2) OHRP notifies any complainant who provides contact information as to whether OHRP will open a compliance oversight evaluation of the allegations raised.

(3) If OHRP has jurisdiction to evaluate the possible noncompliance, and chooses to conduct a for-cause evaluation, OHRP sends officials at the institution(s) engaged in the research an initial inquiry letter informing them that our office is evaluating human subjects research protections at their institution(s). The initial inquiry letter:

(a) describes the allegations or indications of noncompliance, and potential regulatory violations;

(b) asks the institution to conduct an investigation of the potential noncompliance;

(c) asks for a written response to the allegations or indications of noncompliance, and for submission of supporting documentation (including relevant IRB and research records) by a specified date;

(d) asks the institution to develop and submit a corrective action plan if the investigation conducted by the institution reveals any noncompliance; and

(e) provides an explanation of OHRP's compliance oversight evaluation procedures.

OHRP does not take any action against an institution without first affording the institution an opportunity to offer information that might refute the allegations or indications of noncompliance, except in very rare circumstances where serious concerns about subject safety require an immediate suspension of research activities.

(4) OHRP sends copies of the initial inquiry letter to the principal investigator(s) of the specific research project(s) at issue.

(5) OHRP evaluates the documentation submitted by the institution in response to OHRP's initial inquiry letter to determine whether additional information is needed for OHRP to determine whether there is evidence of noncompliance with the HHS regulations.

(6) OHRP engages external expert consultants to assist in for-cause compliance oversight evaluations as needed.

(7) If OHRP has specific additional questions or concerns that can be addressed by the institution in writing, OHRP will present these questions and concerns in additional written correspondence to the institution. If additional questions and concerns are raised by the previous institutional response, there may be multiple letters sent to the institution by OHRP and thus more than one institutional response. In general, all questions and concerns are to be resolved before the case is closed. If OHRP feels that discussion of pertinent issues with institutional employees, IRB members, research investigators, or others would assist OHRP's decision making, OHRP staff may conduct interviews via telephone or videoconference or an on-site visit of the institution's human subject protection program. On-site visits also are conducted when IRB record review, or evaluation of institutional facilities, is relevant to OHRP's determinations, or if OHRP has serious concerns about an institution's system for protecting human subjects.

(8) Based on the institution's responses and any relevant information received from the complainant or other sources, OHRP issues one or more letters to the institution containing OHRP's determinations (determination letter) pertaining to (a) the complainant's specific allegations or indications of noncompliance with the HHS regulations and (b) the institution's program for protecting human subjects, including IRB operating procedures and policies. If OHRP makes determinations of noncompliance, OHRP will describe in such letters any relevant corrective actions proposed or implemented by the institution and the extent to which these corrective actions adequately address the noncompliance. If the institution has not proposed an adequate corrective action plan to address one or more of OHRP's findings of noncompliance, OHRP will require the institution to develop and submit in writing an appropriate corrective action plan by a specified date. OHRP expects institutions to tailor their corrective actions both to the specific facts under evaluation and to OHRP's conclusions regarding the strength of the institution's program for protecting human subjects. OHRP evaluates all corrective action plans proposed in response to OHRP's determinations of noncompliance, and assesses how institutions have progressed with implementation of the corrective action plans, before deciding whether to conclude the compliance oversight evaluation. OHRP is available for assistance in developing a corrective action plan. OHRP may also make recommendations to an institution for specific improvements to its human subjects protections system; the institution is free to implement these recommendations or not.

(8) If OHRP makes no determinations of noncompliance, or if OHRP makes determinations of noncompliance but also determines that they have been adequately addressed through corrective action, OHRP concludes the evaluation and informs the institution of this final outcome in writing.

(9) If OHRP's compliance oversight evaluation was initiated by a complainant who provided contact information, OHRP informs the complainant in writing of OHRP's determinations and any corrective actions taken by the institution upon completion of the evaluation.

(10) An institution or complainant may request that the Director of OHRP reconsider any determinations resulting from a for-cause compliance oversight evaluation.

How OHRP Conducts Not-For-Cause Compliance Oversight Evaluations:

Not-for-cause compliance oversight evaluations are conducted in the absence of substantive allegations or indications of noncompliance. Institutions are selected for not-for-cause evaluation based on a range of considerations, including: (a) the volume of HHS-conducted or -supported research in which they are engaged; (b) whether they have a history of a relatively low level of reporting to OHRP under the requirements of HHS regulations at 45 CFR 46.103(b)(5); (c) the need to evaluate implementation of corrective actions following a previous for-cause compliance oversight evaluation; (d) geographic location; (e) status of accreditation by professionally recognized human subject protection program accreditation groups; and (f) status of recent human subject protection evaluations or audits by other regulatory agencies (such as the Food and Drug Administration) or recent participation in quality improvement programs (such as OHRP's Quality Improvement program).

When OHRP decides to undertake a not-for-cause compliance oversight evaluation, OHRP proceeds as follows:

(1) OHRP advises institutional officials in writing that our office intends to conduct an evaluation of human subject protections at the institution. OHRP's notice requests that the institution provide to OHRP by a specified date relevant information concerning the institution's human subject protection program, including:

(a) IRB policies and procedures;

(b) minutes from recent IRB meetings; and

OHRP's initial written notice also indicates whether the evaluation will include interviews with institutional officials, IRB members, and research investigators, and whether OHRP intends to conduct an on-site evaluation of human subject protections at the institution.

(2) OHRP may decide as a not-for-cause evaluation progresses that additional information is needed to determine whether there is evidence of noncompliance with the HHS regulations. Hence, not-for-cause compliance oversight evaluations initially based on interviews or mailed documents may subsequently expand to include an on-site evaluation.

(3) OHRP engages external expert consultants to assist in not-for-cause compliance oversight evaluations as needed.

(4) Following the evaluation, OHRP issues a letter to the institution containing OHRP's determinations, concerns and recommendations regarding the institution's compliance with the HHS regulations with respect to its human subject protection program, including its IRB operating policies and procedures. In addition, if OHRP makes determinations of noncompliance, OHRP will describe in the letter any relevant corrective actions proposed or implemented by the institution and the extent to which these corrective actions adequately address the noncompliance. If the institution has not proposed an adequate corrective action plan to address one or more of OHRP's determinations of noncompliance, OHRP will require the institution to develop and submit in writing an appropriate corrective action plan by a specified date. OHRP expects institutions to tailor their corrective actions both to the specific facts under evaluation and to OHRP's conclusions regarding the strength of the institution's program for protecting human subjects. OHRP evaluates all corrective action plans proposed in response to OHRP determinations of noncompliance, and assesses how institutions have progressed with implementation of the corrective action plans before deciding whether to conclude the evaluation. OHRP is available for assistance in developing a corrective action plan.

(5) If OHRP makes no determinations of noncompliance, or if OHRP makes determinations of noncompliance but determines that they have been adequately addressed through corrective action, OHRP concludes the evaluation and informs the institution in writing of this final outcome.

(6) An institution may request that the Director of OHRP reconsider any determinations resulting from a not-for-cause compliance oversight evaluation.

Possible Outcomes of OHRP Compliance Oversight Evaluations:

OHRP for-cause and not-for-cause compliance oversight evaluations will result in one or more of the following outcomes, in accordance with OHRP's authority under 45 CFR 46.103(e):

(1) OHRP does not identify any areas of noncompliance with the HHS regulations.

(2) OHRP recommends improvements to the institution's human subject protection policies and procedures, such as better documentation of actions or communications in IRB protocol records, or clearer description of operational details in IRB written procedures. The institution is free to implement these recommendations or not.

(3) OHRP determines that the institution's policies and procedures for protecting human subjects in general are not in compliance with one or more requirements of the HHS regulations, or that the IRB review (or IRB records related to the review) or conduct of one or more specific research projects are not in compliance with one or more of the requirements of the HHS regulations. In these circumstances, OHRP requires that the institution develop and implement corrective actions. Examples of corrective actions that institutions have undertaken to address OHRP determinations include:

(a) re-review by the IRB of research for which IRB determinations required for approval were not previously made;

(b) implementing a new IRB database management strategy to ensure timely continuing review or review of amendments; and

(4) OHRP determines that there is noncompliance with the HHS regulations and, as a result, restricts or attaches conditions to its approval of the institution's FWA based on the nature and scope of the institution's noncompliance. Despite such restrictions or conditions, OHRP may allow some or all research projects to which the FWA applies to continue while the institution satisfies the terms of the restriction or conditions placed upon OHRP's approval of the institution's FWA.

Examples of such conditions include, but are not limited to:

(a) requiring special reporting (such as quarterly reports) to OHRP;

(b) requiring that IRB members, institutional officials, investigators, or others receive appropriate education and training regarding human subjects research protections;

Examples of such restrictions include, but are not limited to:

(a) requiring prior OHRP review of some or all research projects to be conducted under the FWA; and

(b) suspending the conduct of a specific research project until specified protections or corrective actions have been implemented (in these circumstances, research activities involving subjects already enrolled in the affected project may continue if it is in the best interests of the subjects to do so).

(5) OHRP determines that there is noncompliance with the HHS regulations and, as a result, suspends its approval of an institution's FWA. In these circumstances, all Federally-conducted or -supported research activities to which the FWA applies must be suspended until OHRP approval of the FWA is reinstated, except that research activities involving already enrolled subjects in such research may continue if it is in the best interests of the subjects to do so. If an FWA is suspended, research funded by any other Federal agency that relies on the FWA also must stop unless the other Federal agency issues its own assurance to cover such research.

(6) OHRP determines that there is noncompliance with the HHS regulations and, as a result, recommends to appropriate HHS officials: (a) that an institution or an investigator be temporarily suspended or permanently removed from participation in specific projects, or (b) that HHS scientific peer review groups be notified of an institution's or an investigator's past noncompliance prior to review of new projects.

(7) OHRP determines that there is noncompliance with the HHS regulations and, as a result, recommends to appropriate HHS officials that institutions or investigators be debarred in accordance with the procedures specified at 45 CFR part 76. Debarment is a government-wide sanction.

(8) OHRP refers the matter to another Federal department or agency for further review and action, if appropriate.

Public and Governmental Access to Compliance Oversight Evaluation Documents:

Under HHS regulations at 45 CFR part 5, documents related to OHRP compliance oversight evaluations may be subject to the provisions of the Freedom of Information Act (FOIA). In most cases, such documents are exempt from the disclosure provisions of the FOIA while the evaluation is in progress, and OHRP treats them confidentially. However, determination letters are available for release under FOIA at the time they are provided to the institution. Each determination letter will be made accessible on the OHRP website once a request for the letter under FOIA is received or ten working days after the letter is issued to the institution, whichever occurs first. Sections of determination letters that discuss unresolved concerns, questions, or allegations related to an ongoing compliance oversight evaluation will be redacted from the posted letters. Nonredacted determination letters, and other documents related to OHRP's compliance oversight evaluation, become publicly available once the compliance oversight evaluation is closed.

OHRP routinely advises appropriate HHS agencies and officials (for example, NIH, FDA, CDC) concerning the status of its evaluations and may share compliance documents with other Federal agencies as appropriate. Additionally, OHRP may be required to inform members of Congress about its compliance evaluations, and to provide Congress some or all of the information or documents in its files.

The Privacy Act Is Not Applicable to OHRP Compliance Oversight Evaluation Records:

Under HHS regulations at 45 CFR part 5b, records that are retrieved by an individual's name or other personal identifier are subject to the provisions of the Privacy Act of 1974. OHRP maintains compliance oversight evaluation information in a system of records identifying the institution under evaluation. Records can be retrieved by an institution's name or FWA number, but not by any individual's name or other personal identifier. Therefore, the Privacy Act does not apply to information OHRP obtains in the course of a compliance oversight evaluation.

Questions:

For questions about compliance oversight procedures, please contact OHRP at (240) 453-6900 or 1-866-447-4777 (toll free within the U.S.), or by email at ohrp@hhs.gov.

Compliance Oversight Procedures for Evaluating Institutions (2009)

Sign Up for Email Updates