SACHRP Minutes March 12-13, 2013

Jeffrey Botkin (Chair), Albert J. Allen, Gary L. Chadwick, Carl H. Coleman, Thomas Eissenberg, Owen Garrick, Steven Joffe, Susan Krivacic, Pilar Nicole Osorio, Suzanne M. Rivera, Lainie Friedman Ross

Tuesday, March 12, 2013

Welcome: Opening Remarks

Jeffrey R. Botkin,, M.D., SACHRP Chair

Dr. Botkin welcomed attendees to the 30th meeting of SACHRP and reviewed the agenda. He expressed his thanks to OHRP, especially the Director, Dr. Menikoff, and the Executive Secretary of SACHRP, Ms. Gorey, for their contributions to the demanding work of preparation for the meeting. He then welcomed fellow new members Dr. Garrick, Dr. Eissenberg, and Dr. Osorio. He noted that it was a daunting task to pick up the role of Chair from Dr. Bierer, who guided SACHRP through a period of substantial productivity.

The Chair introduced himself as having a background in bioethics and clinical practice. He oversees a human research protection program at the University of Utah but said he did not have the detailed knowledge of the regulations that many SACHRP members possess. His approach will be to look from a broad perspective and rely on other members to fill in gaps.

Dr. Botkin said he saw the most significant ethical issue in medical practice as the insufficient volume of clinical research. He noted that doctors often offer care that is “eminence-based” rather than “evidence-based.” The result is an economic burden to the health care system and a threat to the welfare of patients who trust that their medical care is guided by a body of evidence. He hopes to help remove unnecessary roadblocks to research and enhance efficiency. At the same time, he is an advocate for the human subjects protection system now in place; while there are serious lapses on occasion, the systematic set of problems that once existed have been mitigated by peer review and regulatory standards, resulting in increased trust in the integrity of investigations. He sees a need to enhance the working relationship between IRBs and investigators by improving communication throughout the course of research.

The Chair suggested informed consent as a possible focus for SACHRP. Other issues of concern are participants’ need to know what happened as a result of their participation in research. Data collection and use are also important issues, including facilitating the use of data collected and analyzed to improve patient welfare.

The minutes for October 2012 were unanimously approved.

Report of Issues

Jerry Menikoff, M.D., J.D., Director, Office for Human Research Protections (OHRP), U.S. Department of Health and Human Services (HHS)

Dr. Menikoff welcomed everyone and highlighted changes in the composition of SACHRP. It will be the last meeting for Dr. Joffe and Mr. Coleman. The Director said it had been a pleasure to work with each of them and that they had both done important work as leaders in the field of human subjects protection. He hoped to looked forward to their continuing contributions to SACHRP’s work. He thanked them both.

Dr. Menikoff then welcomed Dr. Botkin, Dr. Osorio, Dr. Eisenberg, and Dr. Garrick. He noted that Dr. Osorio brings critical expertise on genetics and the use of related information, Dr. Eisenberg offers much-needed expertise on socio-behavioral research, and Dr. Garrick represents the world of Contract Research Organizations (CROs) and has a special concern for minority involvement in research. The success of SACHRP, Dr. Menikoff stressed, depends on new membership and insights. He thanked all the new members for joining.

In response to a question, the Director said he had no knowledge of specifically how SACHRP might be affected by the sequester. He hoped it would have little impact.

Welcome and Remarks

Howard Koh, M.D., M.P.H., Assistant Secretary for Health (ASH), HHS

Dr. Koh welcomed everyone and thanked them for their service, telling members he was “in awe at the expertise at the table.” He thanked Dr. Botkin and Dr. Menikoff, calling them tireless in their work and leadership. He said his experience as a Principal Investigator (PI) had left him with an appreciation for the importance of human subject protection and a sensitivity to issues such as informed consent, which he hoped will become a better and simpler process. He stressed the importance of SACHRP’s work and expressed appreciation for each of the “tremendous leaders” coming onto and leaving the committee.

The ASH then swore in the Chair and other new SACHRP members.

SACHRP Background and the Rulemaking Process

HHS Staff: Julia Gorey, J.D., DPA, Executive Director of SACHRP; Jerry Menikoff, M.D., J.D., Director, OHRP; Irene Stith-Coleman, Ph.D., Director, DPA; Laura Odwazny, J.D., Office of the General Counsel (OGC); Andrew Zach, J.D., OGC

Note: PowerPoints for all presentations are available upon request to Julia Gorey at julia.gorey@hhs.gov.

At the request of the Chair, SACHRP staff provided background on how HHS responds to SACHRP recommendations, as well as an overview of how guidance and rules are developed.

Remarks by Julia Gorey: SACHRP Background

Ms. Gorey explained that OHRP is divided into three divisions: Compliance Oversight, Policy and Assurances, and Education and Development. OHRP reports to the Secretary of HHS through the Office of the Assistant Secretary of HHS (ASH). OHRP is the successor to the Office for the Protection of Research Risks (OPRR), which was housed within NIH and moved in part due to concerns about conflict of interest. SACHRP’s predecessor was the National Human Research Protections Advisory Committee (NHRPAC), which served from 2000- 2002. SACHRP began advising HHS in 2003 under the authority of the Public Health Service Act. Its charter may be found the SACHRP website: http://www.hhs.gov/ohrp/sachrp/charter/index.html

The Designated Federal Officer (DFO) for SACHRP is Dr. Menikoff, who schedules and approves its meetings and subcommittees and who approves all meeting agendas. Ms. Gorey is the Executive Director. SACHRP subcommittees to date include:

Subcommittee on Accreditation, 2003-2004
Subcommittee on Research Involving Prisoners, 2003-2005
Subcommittee on Research Involving Children, 2003- 2006
Subcommittee for the Inclusion of Individuals with Impaired Decision-making, 2006-2009
Subcommittee on Federal Policy for the Protection of Human Subjects, 2004-ongoing
Subcommittee on Harmonization, 2009-ongoing

Possible outcomes of HHS consideration of SACHRP recommendations include:

Adopt the recommendation as made
Adopt the recommendation with modifications
Defer taking any action regarding the recommendation
OHRP or other HHS agencies revise existing guidance or develop new guidance
Modify existing regulations or implement new regulations, or
HHS convenes conference or workshop.

Remarks by Jerry Menikoff: Impact of SACHRP on OHRP Policy

Dr. Menikoff gave a variety of examples of how Federal policy had been influenced by SACHRP recommendations. These included:

Substantial easing of administrative burdens in the area of Adverse Event reporting,
Development of Frequently Asked Questions (FAQ) regarding prisoners as subjects,
Holding two workshops on central IRB review and issuing an ANPRM to gauge public option regarding IRB accountability,
Issuing new joint guidance (from OHRP and FDA) on continuing review in order to ease administrative burdens,
Addressing a number of SACHRP recommendations in the final OCR rules for HIPAA and HITECH, and
Archiving outdated guidance on local context.

Currently, OHRP is working on revised guidance on local context, minor changes in research, transfers of IRB oversight, and the ANPRM. Dr. Menikoff noted that rulemaking takes time, and media reports that the process of developing new regulations must have died are inaccurate.

The Director referred members to the SACHRP website for resources such as the current list of members, meeting notes and presentations, and Secretarial communications.

In response to a question from Dr. Coleman, Dr. Menikoff said that letters received from the Secretary do not accept or endorse recommendations, but simply acknowledge their receipt. Letters are not always sent and may be missing for some sets of recommendations.

Dr. Menikoff also said that OHRP is open to ideas from SACHRP on changes in the website. He invited members to email their suggestions and OHRP will consider implementing them.

Remarks by Irene Stith-Coleman: OHRP Guidance Development Process

Dr. Stith-Coleman said that OHRP selects guidance topics based on input from a variety of sources, SACHRP being one. The impetus for guidance may stem the research community, existing guidances that are out of date, requests from HHS agencies, or topics identified in collaboration with FDA.

When new guidance is developed, a draft document is prepared by a designated lead writer and reviewed by an OHRP committee chaired by the Director of the Division of Policy and Assurances. FDA input is sought after the OHRP review and may be sought earlier in the process as appropriate. Other HHS agencies, as well as non-HHS Common Rule departments and agencies, have an opportunity to review and comment. With ASH approval, the agency issues a Federal Register Notice announcing the availability of draft guidance and soliciting public comments, generally within a 60-day period. After all input is received and considered, final guidance is announced in the Federal Register and posted on the OHRP website: http://www.hhs.gov/ohrp/policy/index.html

In response to a query from Dr. Chadwick, Dr. Stith-Coleman explained that the lead writer might come from any of OHRP’s three divisions or could be a contractor.

Remarks by Laura Odwazny and Andrew Zacher: Statutes, Regulations, Guidance, and FAQs:
Process for Modification

Mr. Zacher and Ms. Odwazny provided a review of the source of OHRP’s Statutory Authority. Mr. Zacher noted that if SACHRP made a recommendation that did not fall within the bounds of OHRP’s authorization from Congress and HHS decided to pursue it, the agency would need a member of Congress to sponsor a bill to amend the law, which would then require approval of Congress to become law.

Informal” rulemaking generally involves internal clearance of the rule, review by other agencies as appropriate, review by the Office of Management and Budget (OMB) and the White House, publication of a Notice of Proposed Rulemaking (NPRM) in the Federal Register, a 60-day public comment period, review of comments, and publication of a final rule at least 30 days prior to the intended effective date. Alternatively, an agency that decides to request information from the public before proposing a new rule could solicit public comments through the publication of an Advance Notice of Proposed Rulemaking (ANPRM). After reviewing comments on the ANPRM, the agency would develop and request public comments on an NPRM. Typically, several years are required to finalize a new public rule. In the case of amendments to the Common Rule, which affects several Federal agencies, each agency has to duplicate the internal review process.

In the past, most SACHRP recommendations have focused on guidance as opposed to regulations, as the process for developing guidance is much simpler and shorter. Usually, the agency is free to adopt a new interpretation without public comment, though it cannot be “arbitrary or capricious.” Also, courts have held that long-standing or well-established interpretations of regulations that have been relied on by regulated entities cannot be reversed or substantially altered without notice and comment.

Discussion

Dr. Garrick asked about the type of feedback OMB provides during the regulatory process. Staff explained that OMB coordinates an interdepartmental review of draft regulations. OMB also completes its own analysis based on the requirements of the Paperwork Reduction Act, the rights of states, environmental impact, and Executive Orders mandating the consideration of any public benefits or burdens associated with a regulation. Typically, it is hard to argue that OHRP lacks authority to implement a given change in its regulations, because the statutory language related to OHRP is so broad. If OMB indicates that changes to draft regulations are needed, comments will be provided to the agencies that drafted the regulatory language, and they will meet and negotiate changes.

Dr. Joffe noted that many agencies other than HHS are represented at SACHRP meetings. Is it appropriate for SACHRP to make recommendations to those agencies? Staff responded that SACHRP’s charter stipulates that the committee will make recommendations to the Secretary of HHS through the Assistant Secretary of HHS. SACHRP could recommend that the Secretary of HHS work with the Secretary of another agency to accomplish something, and it could also make recommendations to FDA, which is part of HHS. In either case, OHRP would handle communications and follow-up. Dr. Menikoff suggested that agencies outside of HHS are less likely to care about its recommendations.

Dr. Botkin noted that a public letter was critical of how SACHRP handled a particular case, and he wondered to what extent SACHRP’s role includes monitoring ongoing activities of OHRP such as compliance activities and assurances. Ms. Gorey said it would not be appropriate for SACHRP to comment on an oversight issue without a request from OHRP. The Director agreed, adding that SACHRP is most successful in influencing change when it works in partnership with OHRP.

A SACHRP member asked how SACHRP hears what is or is not happening in response to its recommendations and why. Staff responded that OHRP staff will update SACHRP in response to its request for an update or as activities are completed. Silence is not necessarily an indication that nothing is happening.

A SACHRP member asked about SACHRP’s role when OHRP issues an ANPRM. Ms. Odwazny responded that SACHRP members may respond as a committee, as individuals, through their institutions, or all three.

Dr. Botkin suggested that SACHRP members could publish articles based on their work with the committee so long as the publications do not suggest the work represents federal policy. Dr. Menikoff agreed and said that this could be helpful.

A SACHRP member asked which Congressional subcommittees would be relevant to SACHRP’s charge. Staff responded that examples include Labor and Resources and Health in the Senate and Energy and Commerce in the House.

Dr. Eissenberg asked whether issues related to IRBs’ compliance or noncompliance with requirements of their assurances would fall under SACHRP’s charge. Dr. Menikoff said this is a broad issue but suggested topics would be welcome. Dr. Allen clarified that while specific cases would be outside the subcommittee’s purview, process concerns would fall within it. Dr. Menikoff agreed.

Discussion of SACHRP Members’ Priorities

Jeffrey Botkin, M.D., SACHRP Chair

The Chair invited SACHRP members to identify priority concerns they would like to see SACHRP address.

Dr. Joffe expressed concern about “mission creep” among IRBs, noting that research in fields such as oral histories and ethnography are often impeded unnecessarily. He stressed the need to minimize the burden of regulations on very low-risk activities.

Dr. Allen stressed the importance of people trusting the process so that they are willing to participate in research. Whether they sign an informed consent document or not, the quality of protection provided to subjects must preserve that trust. He highlighted the emergence of new technology and new methods of research, which can have risks and benefits IRBs must be prepared to analyze. For example, a recent article in the Journal of the American Medical Association (JAMA) focused on data mining techniques used by the Microsoft search engine. He suggested that SACHRP may wish to make recommendations related to international research and “big data,” adding that some European deliberations related to transparency and privacy could affect U.S. researchers.

Ms. Krivacic noted the emergence of patient-reported outcomes collection in clinical settings and said that an approach was needed to address the regulatory burden of informed consent within this setting. She suggested exploring the issue of payment for participation in trials, especially for life-threatening diseases such as cancer. She highlighted the issue of possible coercion associated with payment, but at the same time she stressed the importance of subjects receiving payment for travel and the use of required technologies. There is also the issue of payment not being made to subjects as promised: what recourse, if any, do they have or should they have? In addition, Ms. Krivacic was troubled by burgeoning consent forms, complex and confusing presentations of oncology studies in which Phase Ia and Ib are combined. Sometimes they even include another study as an addendum to the consent (a Phase II). She also pointed to the need to consider emerging technologies such as Apps and issues surrounding fraud and scams that could affect the security of private health information.

Dr. Chadwick wanted to ensure follow-up on SACHRP’s recommendations regarding investigator responsibilities. He would like to look back at the committee’s past recommendations and understand why some have not been addressed and whether they need to be revisited. He is interested in the issue of subject compensation for injury, which other groups have addressed, and which SACHRP should keep “on the shelf” as something to address at an appropriate time. He sees consent issues as critical, especially in light of new technology that may “surpass our regulations.” Finally, Dr. Chadwick raised the question of how members could get broad input from constituents so they know that subjects they take up are important to the research enterprise.

Mr. Coleman expressed concern about the effectiveness of the review process. He wanted to reach a better understanding of what actions actually lead to improved protection of human subjects and which do not. The focus on compliance may not really be producing the intended results. He supported the proposed focus on informed consent, which is a central protection.

Dr. Garrick also supported the idea of focusing on informed consent, noting that documents are typically a combination of material related to the clinical study and material that is included strictly for protection from liability. He was interested in ways of making the process more effective, such as the use of videos to explain risks and benefits clearly. Dr. Garrick highlighted the issue of inclusion in research. Subject populations need to be involved in policy decisions that affect the study’s safety and efficacy. He expressed a concern about overexpression in certain populations.

Dr. Osorio was interested in online research and stressed the need for guidance from OHRP. This includes “big data research” that collects online data. Researchers will increasingly approach accumulators of datasets such as Facebook and Google, and the need for appropriate agreements to access data raises new issues. She would also like to see more guidance related to nonmedical research, including a clearer distinction between what is and what is not research that is subject to the Common Rule. Dr. Osorio observed that people in fields such as education and computer science are often not trained in the regulatory requirements that may apply to their research. She joined with others in expressing concern about consent forms that do not communicate well to subjects.

Dr. Eissenberg said he was particularly interested in international research and sociobehavioral research. Although many countries subscribe to similar ethical principles, they may apply them differently in different cultures. He asked how we can appreciate and learn from diversity in the application of research ethics. In regard to sociobehavioral research, regulations are often applied inappropriately. This is a huge constituency that accounts for a significant percentage of protocols, and their concerns should be addressed. Often, the research done in these fields does not require review and should be exempt, but IRBs fail to recognize this.

Dr. Ross felt that SACHRP should return to the issue of genetics and whether researchers are obliged to return results, including incidental findings. The implications for the cost of research should also be considered. She was also concerned with “large data” and the need for boundaries to protect information contained in electronic health records. Finally, Dr. Ross underlined the importance of addressing group risks, such as the possibility of results that cause members of a group to be stigmatized.

Dr. Botkin stressed that the issue of informed consent requires more time. He agreed with SACHRP members that “big data” is a concern. He also saw a need to clarify the concept of “deidentified” data, given technological advances and the existence of large data bases. New ways of collecting data, including via the Internet, are of interest. The Chair also suggested exploring the subject of how best to generate and share data related to financial conflicts of interest, including what subjects really want to know and what should be addressed in the consent process. Issues related to cluster randomized trials, on which SACHRP has heard presentations (October 2012), are challenging. In general, ways to minimize administrative requirements related to minimal risk research should be explored.

Dr. Menikoff said he appreciated all these ideas and looked forward to working with SACHRP and the Chair.

Dr. Botkin noted that, regarding the issue of compensation for injuries that occur in the research context, a Presidential Commission has made recommendations to the HHS Secretary and OHRP is awaiting the Secretary’s direction. SACHRP is ready to respond to any request from the HHS Secretary to address the issue, but for the present it is taking no action.

Dr. Osorio observed that the issue of return of research results to subjects is “hot” and many groups are working on it. NIH has funded research on the topic. She asked whether SACHRP should also make recommendations on the topic or wait. Dr. Botkin said his view was that the topic was not yet ripe for a definitive statement from SACHRP, unless an agency such as the National Cancer Institute asked SACHRP to collaborate with them to address related issues.

HIPAA/HITECH Rulemaking Changes

Christina Heide, J.D., Senior Health Information Privacy Policy Specialist, Office for Civil Rights, HHS

For information on Omnibus Rules, see: http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/index.html

Ms. Heide reported that the HHS Office for Civil Rights (OCR) has issued its omnibus rule comprised of four final rules that contain provisions of interest to SACHRP. She noted that the committee had given input to OCR that is reflected in the rules. These rules include:

Final Rule on HITECH Privacy, Security, & Enforcement Provisions (and certain non-HITECH changes)
Final Rule on new HITECH Civil Money Penalty (CMP) Structure
Final Rule on HITECH Breach Notification, and
Final Rule on GINA Privacy Provisions.

The omnibus rule may be reviewed at this site:

www.hhs.gov/ocr/privacy/

The compliance date is September 23, 2013. A transition period up to September 22, 2014, is provided for regulated entities to bring existing business associate agreements into compliance with the new rules.

Research authorizations. Under the old rule, authorizations had to be study-specific and separate authorization forms were required regarding the use or disclosure of Protected Health Information (PHI) in a clinical trial and the storage of PHI in a biorepository. SACHRP provided detailed comments regarding the old rules and suggested changes and asked for clarifications that would be helpful to researchers.

Regarding compound authorizations for research, the new rule permits the use of a single form to authorize use/disclosure of PHI for conditioned (e.g., clinical trial) and unconditioned (e.g., storage of PHI in a repository) research activities, with a clear opt-in for the voluntary (unconditioned) component. Researchers have some flexibility in how they differentiate components.

In regard to authorizations for future research, the new rule permits these authorizations so long as the authorization for future research purposes includes an adequate description (such that it would be reasonable for the individual to expect his or her PHI could be used or disclosed for the future research). The new provision better aligns with Common Rule and helps to streamline the authorization process.

In response to a question regarding how broad the description of the future research the subject receives can be, and still be adequate, Ms. Heide said IRBs and researchers are expected to make the same kinds of assessments they have been making for Common Rule (CR) informed consents.

Decedent information. Under the old rule, health information about decedents is generally protected in the same manner and to the same extent as that of living individuals. Under the new rule, however, decedent information will no longer be considered PHI after a 50-year period from date of death. Ms. Heide noted that, under the old rule, historians were unable in certain cases to access health information about historical figures. She stressed that this is not a record retention requirement; the Rule just provides that as long as the covered entity maintains PHI for up to the 50-year period, it must be protected. She also stressed that during the 50-year period, researchers are still able to access the information about the decedent without IRB approval so long as required representations are provided.

Selling information. Under the old rule, covered entities were prohibited from “selling” patient information, but there was no general prohibition against covered entities receiving remuneration for disclosures of PHI that would otherwise be permitted by the Privacy Rule. Under the new rule, even where disclosure would otherwise be permitted, the covered entity is prohibited from disclosing PHI in exchange for remuneration unless the individual specifically authorizes the transaction and the authorization states that the disclosure will result in remuneration. There is, however, a limited research exception that allows remuneration for the cost of preparing and transmitting the PHI. Ms. Heide noted that it is not considered a sale of PHI when a covered entity is paid by a trial sponsor to perform a clinical trial using the PHI.

Breach. The new rule states that an impermissible use or disclosure of (unsecured) PHI will be presumed to require notification, unless the covered entity or business associate can demonstrate that there is a low probability that PHI has been compromised based on at least these four elements: the nature and extent of PHI involved, who received/accessed the information, the potential that PHI was actually acquired or viewed, and the extent to which risks have been mitigated.

In response to questions, Ms. Heide clarified that an entity could decide to provide notifications without performing a risk assessment. Ms. Heide said the office gets breach notifications from research entities for such incidents as lost devices and stolen computers containing electronic PHI (ePHI).

Business Associates. This is the “big ticket item” in terms of the rule. With respect to the research community, however, the preamble to the rule clarifies that IRBs are not considered Business Associates (BAs) by virtue of their research review, approval, and oversight functions. In addition, researchers still are not considered BAs by virtue of research activities, but could become BAs if they perform other functions. In general, BAs must comply with the technical, administrative, and physical safeguard requirements under the Security Rule, as well as the use and disclosure limitations in the Privacy Rule (and in their contracts), and BAs are directly liable for violations. Any subcontractors of the BA are now defined as BAs, and BA liability flows to all subcontractors.

Discussion

Ms. Krivacic asked whether an Internet recruitment company working for a Covered Entity (CE) would be considered a researcher or a Business Associate (BA). Ms. Heide responded that it is fact specific. Generally speaking, if a CE were to provide a list of patients to an entity for the entity to obtain the patients’ authorizations for the use of their information in a research study, the entity would be considered a business associate.

A SACHRP member thanked the speaker for the presentation, noting that the changes will be welcome to many in the research community.

Subcommittee on Harmonization (SOH)

David M. Forster, J.D. and Mark Barnes, J.D., SOH Co-Chairs

Co-Chairs reviewed the meetings, membership, and recommendations of SOH to date.

Cluster Randomized Trials

See: Attachment B. SOH Draft Recommendations: Regulatory Issues in Cluster Studies

Co-Chairs noted that at the last SACHRP meeting, Andrew McRae presented on informed consent issues in cluster randomized trials (CRTs). There has been very little guidance or literature on the application of US regulations to CRTs. SOH prepared a draft definition of a cluster randomized trial, examples, and recommendations for review and discussion. They posed a number of questions to SACHRP, including whether a comprehensive definition of CRTs was needed. Questions related to study design, subjects, identifying risks and benefits, the boundaries of engagement in research, and the applicability of Subparts B, C, and D are stated below.

Questions Related to Study Design

When are CRTs either less powerful or more powerful than other study designs?
Are CRTs ever used to avoid the need to obtain informed consent?
How do they Overlap with Quality Improvement activities? (many do qualify)
When does a CRT fall into the definition of a Quality Improvement project as described in the OHRP FAQs on QI activities? See: http://answers.hhs.gov/ohrp/categories/156

Questions Related to Subjects

Who is a subject in a Cluster Randomized Trial?
When you do have subjects, who must provide consent?
Which participants in cluster randomized trials must provide consent?
Which participants are not subjects, and thus do not need to provide consent?
When can a waiver of consent apply for participants who are subjects?
When can deception be used in the consent process to help blinding?

Questions Related to Identifying Risks and Benefits

The risks and benefits in CRTs can be hard to identify, and related questions are “vexing.”

What are the risks to medical providers when data is being collected about their decisions?
What are the risks to patients when their hospital or clinic is randomized to an arm of a study?

Questions Related to Engagement in Research

Which institutions are engaged in research in CRTs?
Should the assessment of engagement differ for CRTs when the randomization is by institution?
Should the assessment of engagement differ for CRTs when the randomization is by community?

Questions Related to Subparts B, C, and D

Are there any unique issues in applying subparts B, C, and D to CRTs?
To what extent do these subparts apply when subjects are randomized by institution or community?

Co-Chairs asked the committee to consider the following questions:

Does SACHRP agree that SOH should move forward on this project?
If so, what is the most useful format for structuring a SACHRP recommendation on the application of US regulations to CRTs?

Discussion

Dr. Osorio asked for clarification of which agencies’ guidelines would need to be harmonized. Co-Chairs responded that to date the committee has focused on OHRP, FDA, and OCR.

Dr. Ross said she thought the subcommittee was on the right track. She noted that this type of study has been occurring for twenty years in a public health context, and there is much to be learned from this experience. This approach is also common in education.

Mr. Barnes agreed, noting that the scale and frequency of this type of trial is increasing. The intensity of the interventions has begun to “attract attention.” Dr. Allen added that applications in pharmaceutical studies are also being discussed, with questions arising about when they are appropriate, as well as which strategies yield the best results from a scientific standpoint.

Dr. Joffe observed that this is a good topic for the subcommittee and asked whether the current membership has the right expertise to address it. Mr. Forster said the subcommittee may need some help with some scientific aspects of the subject but otherwise is well balanced and able to address it.

Dr. Botkin asked whether SOH has a sense of whether IRBs are “muddling through” and basically “getting it right” or whether they are having real difficulty. Mr. Forster reported that feedback from IRBs is that this type of study is really difficult and it would help to have answers to the questions noted above.

A SACHRP member commented that, from the perspective of the investigator, the consent issue is perplexing in such trials. It is not clear who should be consented and through what kind of process. It is not clear how a community can consent and who the intermediaries should be. In some cases, investigators have planned complex trials without understanding that human subjects were involved or recognizing the ethical and regulatory implications of the study. Dr. Allen agreed, noting that these issues never came up in the NIH training he received.

Dr. Botkin raised the question of whether the topic was “ripe” for consideration. Mr. Forster noted that groups that have addressed related issues have focused on them from an ethical rather than a regulatory standpoint. Note: See, for example, the Ottawa Statement on the Ethical Design an Conduct of Randomized Trials: http://www.plosmedicine.org/article/info%253Adoi%252F10.1371%252Fjournal.pmed.1001346

Dr. Menikoff said there is “something to be said” on the topic, and OHRP is especially concerned about the issue of informed consent. It appears that an increasing number of trials are occurring that are similar to individually randomized clinical trials and that are driven by the desire to achieve cost savings and efficiency. He wondered under what circumstances the trial could be done equally well as an individually randomized trial and questioned the justification for waiving informed consent. Dr. Ross responded that this type of trial must be much larger than a traditional trial and it would be difficult to manage recruitment. Dr. Menikoff said he understood the approach was more efficient, but he did not see the justification for failing to do an informed consent process. Core ethical issues are involved. Dr. Osorio agreed, noting that communities involved in such research might include vulnerable or culturally different subjects.

Dr. Allen said the question the study is addressing determines what approach is really most efficient. Dr. Joffe added that this type of trial is not always larger.

Observing that there was obvious enthusiasm for SOH addressing the topic, Dr. Botkin asked Co-Chairs to comment on the scope and timeline for the effort. Mr. Forster said that SOH would try to have draft recommendations by SACHRP’s July meeting.

Certificates of Confidentiality

Co-Chairs presented a review of issues SOH is addressing regarding certificates of confidentiality and asked for feedback from SACHRP. They noted that certificates were originally created in 1970 in order to protect subjects participating in research on substance abuse. The certificates help researchers protect subjects’ privacy in the face of legal demands, such as court orders and subpoenas, which would require them to provide information that could identify subjects. Subjects are entitled to permanent protection. Protected information may be disclosed only in the following circumstances:

Voluntary disclosure of information by study participants themselves or any disclosure that the study participant has consented to in writing.
Voluntary disclosure by the researcher of information on such things as child abuse, reportable communicable diseases, possible threat to self or others.
Voluntary compliance by the researcher with reporting requirements of state laws, such as knowledge of communicable disease, etc.
Release of information by researchers to DHHS as required for program evaluation or audits of research records or to the FDA.

Numerous Federal agencies provide such certificates. Some difficulties include access to Certificates of Confidentiality for non-Federally sponsored research, differences in agency processes and requirements, applications in multi-site research, inconsistent use of the mechanism, use of COCs in low-risk research such as tissue banks, and failure to use COCs when they would be appropriate. There is also some data to suggest that many IRBs do not understand how and when COCs are used. Co-Chairs asked:

Does SACHRP agree that SOH should move forward on a recommendation regarding COCs?
If so, what is the most useful format for structuring a SACHRP recommendation?

Discussion

A SACHRP member noted that NIH has a useful “Kiosk” that supplies web-based information on COCs: http://grants.nih.gov/grants/policy/coc/

Dr. Eissenberg said he felt the subcommittee was on the right track and noted that COCs are still important in certain circumstances in drug abuse research. He said IRBs are sometimes eager to have investigators secure COCs when they are not really needed, and guidance on when they are and are not needed would be helpful. Dr. Osorio added that many people do not understand the purpose of COCs. Dr. Allen saw a need to harmonize the many approaches currently in use by various agencies. An ex officio stated that many smaller agencies would welcome the effort.

Dr. Joffe observed that the notion of informational risk was raised in OHRP’s Advance Notice of Proposed Rule Making (ANPRM), which was published in the Federal Register on July 26, 2011. Regulatory changes related to data security might have implications for the use of COCs.

Dr. Botkin asked whether SOH viewed the proposed work as an opportunity to offer education on the nature of the program and help IRBs use COCs more effectively or whether it envisioned recommendations that might change the structure of the program. Co-Chairs said both are possible directions.

Research Integrity Update

Mr. Barnes reminded members that in July 2011 SACHRP invited Kristina Borror, Director of OHRP’s Division of Compliance, and John Dahlberg, Director of the Division of Investigator Oversight within the Office of Research Integrity (ORI), to discuss their agencies’ approaches to allegations of falsification and fabrication of data. At its February 2012 meeting, SACHRP approved recommendations to address issues related to potential discontinuities in the federal approach that became apparent at that panel. Dr. David E. Wright, Director of ORI, convened a conference of Research Integrity officers with the cooperation of Dr. Menikoff and OHRP to consider some of these issues. Based on these discussions, ORI plans to write guidance for institutions for cases in which there are investigations regarding research integrity in which HHS regulations regarding human subject protection are also applicable. Dr. Menikoff said he was very pleased to work with a sister agency and appreciated ORI’s concern for human subject protection. He appreciated the subcommittee’s work in bringing the subject to both agencies’ attention.

European Medicines Agency

Mr. Barnes noted that the European Medicines Agency (EMA) plans to require all sponsors that submit applications to EMA to make available all data points at the subject/patient level in a deidentified format. This requirement could be in effect as early as this coming January. Many people are concerned about whether privacy will be adequately protected, especially for subjects with rare diseases. This development also means that a vast amount of previously unavailable “big data” will soon be available for access by anyone. The majority opinion within the EPA favors posting the data on a public site. In a related development, the British Medical Journal is requiring investigators who submit articles for publication to make patient-level data available, and other journals may follow suit.

Dr. Allen added that data that would have to be reported to the EMA include not only clinical trial data but also post-marketing reports on adverse events, such as Medwatch reports under the jurisdiction of public health authorities. SOH wants to encourage dialogue between the Office of Civil Rights and the Food and Drug Administration and encourage them to express any concerns before regulations are issued, after which the regulations may not be revised for years.

Mr. Barnes clarified, in response to a question from the Chair, that the purpose of the new EMA requirement is to allow in-depth analysis and verify results. EMA suspects that companies are hiding adverse events. The “alternate reality,” however, is that requests for data are largely coming from competitors rather than public advocates. Dr. Allen observed that with modern statistics programs those with an interest in the data might be academic researchers, competitors or their agents, newspaper reporters, or others.

Dr. Joffe asked if the new strategy would have direct implications for U.S. research practices. Mr. Barnes said that anything that supports an EMA application, regardless of where the research was done, will have to be posted. The new requirement affects clinical studies that are currently enrolling subjects in the U.S.

Corrective Actions and Investigator Sanctions to Remedy Non-Compliance

Co-Chairs presented issues related to investigator sanctions when there are major deviations from approved protocols. Examples of the range of deviations that could occur include:

Intentional non-compliance, such as forged signatures, falsification or fabrication of data, creation of fictitious subjects, failure to obtain consent or assent.
Unintentional or accidental non-compliance, such as missed tests, dosing errors, missed visits, failure to pay subjects to whom compensation has been promised.
Unanticipated problems, such as unanticipated serious adverse events related to drugs, devices or procedures.
Unanticipated problems such as lost laptops, lost data, etc.

Presenters noted that there is confusion and inconsistency in how IRBs mete out sanctions for noncompliance. Issues that must be addressed leading to a more consistent approach include:

What are appropriate types of corrective actions and/or investigator sanctions?
What are appropriate goals of corrective actions and/or sanctions?
How far do prohibitions and requirements extend? Do they extend only to the Principal Investigator or to all who participated in the noncompliance?
What about other sites/investigators in a multi-site study?

Co-Chairs gave numerous of examples of the type of questions SOH might explore:

What is the range of sanctions or corrective actions that IRBs and institutions should consider when faced with an investigator or research team that has seriously violated approved protocols or research regulations?
Are there standards for when each such sanction or corrective action should be imposed?
How should sanctions or corrective actions be calibrated to the seriousness of protocol violations, or injuries or possible injuries to human subjects in an approved protocol?
Is it appropriate, if at all, for IRBs and/or institutions to require investigators to forego research use of data obtained outside of approved protocols or otherwise in violation of research regulations?
Under what circumstances should such a sanction be imposed, if at all?
When an investigator has multiple active protocols, and there has been serious noncompliance in one or more, but not all, of those active protocols, how should sanctions be handled?
Should serious noncompliance in one protocol lead to sanctions – such as suspension of privileges to conduct human subjects research – in all of that investigator’s protocols?
How to determine sanctions on an investigator and corrective actions on a protocol when noncompliance was the result of actions of some, but not all, of the research team? For example, should failure of one investigator to gain informed consent prevent other members of the team who were compliant with the protocol from using data inappropriately obtained?
Other than the procedures set forth in 45 C.F.R. 46.109(d), are there basic requirements of due process for investigators before IRBs or institutions impose any sanction, including suspension or termination of research, or should this be defined by each IRB and its institution, consistent with other institutional policies? One sentence in the CR says the IRB should give the investigator an opportunity to address the accusation directly before sanctions occur.
When a central IRB has assumed responsibility for overseeing research at multiple institutions, how does that central IRB gain authority to impose sanctions other than suspension or termination of research?
Should or must this authority be delegated to a central IRB in a “cede review” IRB When a central IRB (or any IRB) has assumed responsibility for overseeing research that is not based at an institution – such as research that occurs in private physician, psychologist, or psychotherapy practices – how does that IRB gain authority to impose these intermediate sanctions?
Must this authority be included in an agreement entered into between an independent, non-institution-based investigator and an IRB?

Speakers reported that there was no current guidance addressing these questions, including the issue of what kinds of compliance violations should be met with particular responses.

Discussion

Dr. Allen noted that sponsors who become aware of this type of problem at a site generally exclude this data from the data presented to FDA. The sponsors generally consider this to be a matter for the IRB and the investigator to address.

Dr. Joffe felt this would be a great topic for SOH to address. He asked Co-Chairs to identify the regulatory basis for any recommendations SACHRP might wish to make. Mr. Barnes said the statute gives OHRP authority to suspend or terminate an assurance, but a range of sanctions short of that might be inferred. Institutions have some power to take actions through their own IRBs. Further, he noted that the Federal government allows the data obtained through government-funded research to be published; this is a concession that is within the government’s purview to control. He felt it was possible to work within the existing regulatory structure and that no new powers were needed.

Mr. Forster saw wisdom in addressing the issue.

Dr. Menikoff said OHRP is on record as indicating that it has no regulatory authority over what happens with data. However, one element of its mission is ethics, and it can make recommendations. Usually, its recommendations result in overcompliance, so it probably has influence. Ms. Heide noted that OCR has the ability to intervene with HIPAA-covered entities that continue to use data obtained improperly.

Dr. Eissenberg said this was a very important issue to address. He recalled that in recent times the powerful resources of the tobacco industry were used to slow down research by making unfounded accusations.

Dr. Osorio observed that the subject of unethically obtained data is addressed in a “huge” literature, and she was not sure what the committee could add through its deliberations. She felt that FDA’s regulations make a lot of sense. Mr. Barnes said that might be value in stating clearly that such data cannot be used in a study submitted for FDA approval and that there are restrictions that apply to HIPAA-covered entities as well. Mr. Forster added that existing literature focuses more on ethical rather than procedural issues. He felt it would be helpful to approach the issue from a regulatory standpoint.

Dr. Botkin suggested that some reflection would probably be helpful. It would address three levels:

What sorts of activities does the IRB have the authority to deal with?
What issues might the institution ask OHRP to address?
What issues are outside OHRP’s domain?

He felt that guidance on the topic might be welcome.

Public Comment

See: Attachment A. Letter from American Association of Neurological Surgeons

Koryn Y. Rubin, the Senior Manager for Quality Improvement for the American Association of Neurological Surgeons’ (AANS) Congress of Neurological Surgeons (CNS), read excerpts from the AANS/CNS joint letter to the HHS Secretary, Kathleen Sibelius. The complete text of this letter is included as Attachment A.

Ms. Ruben expressed AANS and CNS concerns that SACHRP “has yet to address additional exemptions related to quality improvement activities. This lack of guidance poses significant uncertainty for neurological practices as they endeavor to undertake meaningful quality improvement efforts.” She continued:

The informed consent regulations remain confusing and do not reflect the current transformation that is occurring in the healthcare system. With the advent of the Patient Protection and Affordable Care Act (ACA), and the recent passage of the American Taxpayer Relief Act (ATRA), all stakeholders in the healthcare system have dramatically shifted their focus to ways in which we can improve quality and lower the costs of care. For example, the ACA includes numerous statutory changes to the Medicare and Medicaid programs aimed at making healthcare professionals more accountable for cost and outcomes. The ATRA also now allows physicians to satisfy the Medicare’s Physician Quality Reporting System (PQRS) requirements by reporting through a clinical data registry. Likewise, in the private sector, the pressure to collect quality data is just as strong. In fact, some of these efforts, including the Blue Cross Blue Shield Blue Distinction® program, require the collection of long-term clinical outcomes data and continuous patient contact to meet quality program requirements. In this environment, clinical data registries have emerged as a useful and logical mechanism to provide all relevant stakeholders with high quality data related to the safety and value of specific therapeutic interventions.

The speaker stressed that clinical registries have emerged as a source of data for efforts to improve the quality of medical services. While many healthcare providers have embraced these efforts, requirements related to the HIPAA Privacy Rule and the Common Rule have impeded achievement of their goals. As clinical registries rely on the serial analysis of outcomes, investigators have noticed that the process of informed consent can introduce bias and in fact creates “almost insurmountable” barriers to quality improvement.

Dr. Botkin thanked the speaker for highlighting the issue and noticed that it was consistent with earlier comments about the need to clarify boundaries.

Wednesday, March 13, 2013

Opening Remarks

Jeffrey Botkin, M.D., SACHRP Chair; Jerry Menikoff, M.D., J.D., Director, OHRP, HHS

Dr. Botkin introduced the panel on informed consent, noting that challenges related to the informed consent process have been widely recognized for quite a few years. The central issue is the efficacy of the process: what can be done to improve subjects’ understanding and promote a partnership between researchers and subjects? A key question is whether we know enough, after 20 years of research, to make appropriate changes. A second question is how to leverage change. He suggests that SACHRP consider a new subcommittee that would pull in appropriate people and highlight the issue. SOH and SAS might be combined.

Focus: Improving the Informed Consent Process

Jeremy Sugarman, M.D., M.P.H., M.A., Harvey M. Meyerhoff Professor of Bioethics and Medicine, Johns Hopkins Berman Institute of Bioethics

Heather H. Pierce, J.D., M.P.H., Senior Director, Science Policy and Regulatory Counsel, Association of American Medical Colleges

Jeanne M. Adler, R.N., M.P.H., C.C.R.P., Clinical Investigations Branch, Cancer Therapy Evaluation Program, National Cancer Institute

Jeffrey S. Abrams, M.D., Associate Director, Cancer Therapy Evaluation Program, Acting Director for Clinical Research, and Associate Director of the Cancer Therapy Evaluation Program, National Cancer Institute

Note: PowerPoints for all presentations are available upon request to Julia Gorey at julia.gorey@hhs.gov.

Remarks by Jeremy Sugarman: Improving Informed Consent

Dr. Sugarman noted that many policies and practices in common use are not evidence based. It is now possible, however, to use the tools of social science to inform the consent process.

He stressed the importance of considering the decision making capacity of the subject and ensuring that the subject really understands what he or she is agreeing to – not simply that a paper has been signed. Researchers have found that diminished understanding of informed consent information was associated with older age and fewer years of education, though there are strategies that can be used to improve understanding. Incomplete comprehension of informed consent has been documented in multiple settings. He noted that in some settings comprehension of the concepts of placebo controls and randomization is worse among subjects in general than for other aspects of protocols. Data are inconclusive on what really helps, but having a study team member or a neutral educator spend time with the subject seems a promising approach. There is some indication that for low literacy populations, the length of time spent explaining their commitment makes a difference.

Unfortunately, there is no “gold standard” for assessing comprehension of informed consent. Comprehension, he said, is a necessary but insufficient component of the informed consent process. Ideally, the overall quality of informed consent must be assessed.

BICEP – a Brief Informed Consent Evaluation Protocol – was developed initially for use by the Department for Veterans Affairs. A telephone interview is used within a brief period after consent is given. The subject is asked questions such as, “Did you get all the information you needed to make a good decision about participating in [the study]?”

In conclusion, the speaker stressed the need for empirical testing of approaches for improving understanding and the quality of informed consent.

Discussion

Dr. Joffe asked what could be done to improve the quality of subjects’ understanding. Dr. Sugarman said the field has been doing some creative work but has not come to a settled decision. Also, he observed that there may not be a single answer that is the same for all trials. Dr. Joffe noted that the solution must be one that balances respect for autonomy and the subject’s right to say “yes.”

Mr. Coleman asked how one determines what it is most important for people to understand and what will have a meaningful bearing on their decision. Dr. Sugarman said the answer is not “one size fits all.” The characteristics of the work and the participants themselves both weigh in the approach. Dr. Sugarman observed that there are many simple measures that can be put in place. For example, if the researcher offers a subject an upside-down document and the subject leaves it that way, the researcher has learned that the subject is not able to read the document and it will need to be read aloud.

Dr. Allen asked whether Dr. Sugarman agreed that it is critical to be able to identify what information might lead people to a different decision. Dr. Sugarman affirmed this and added that it is also important to understand the goals of providing different types of information and in how much detail. Research suggests that subjects want to know about conflicts of interest but rarely change their decision to participate or not on this basis. He added that one study showed that participants were “ticked off” by HIPAA notifications.

Dr. Menikoff said an important challenge is how to handle alternatives. It would be good to be able to communicate a central concept clearly as opposed to a long list of alternatives. Simply considering what would happen if the person were not in the trial does not get to the issue.

Dr. Eissenberg said he had heard many medically oriented examples and reminded the committee to bear in mind the wide range of human research studies, including socio-behavioral research. Consent and related issues may be very different depending on the type of study. He said models were needed to capture the metrics that are relevant in social science.

Dr. Ross recalled a study that found that when individuals were enrolled in biobanks, even when they were told there would be no return of results, the therapeutic misconception persisted.

A member observed that while the discussion focused on the consent process at the time the subject is accepted into the trial, the subject may not remember what they agreed to 6 months later. For example, the subject may forget that he or she has the right to withdraw from the trial. An ongoing process of communication is needed. As part of this, researchers need to have thought through what subjects really do need to remember. Dr. Sugarman endorsed the concept of ongoing dialogue but he suggested that this not be considered part of the “consent” process. Ongoing communication can reinforce critical information lest it be forgotten.

A SACHRP member noted that some of the questions in the BICEP tool seemed to ask for a “gut” response and the subject might not really know the answer until he or she has gone through the research. Dr. Sugarman said the tool can only capture the experience in the consent process and that developers did not want to confuse this with their experience as subjects.

Remarks by Heather H. Pierce: Improving the Informed Consent Process

Ms. Pierce provided information about the efforts of the Association of American Medical Colleges (AAMC) to improve the informed consent process. She described the AAMC Informed Consent Simplification Project, in which a group of 13 experts were asked to review three existing IRB approved protocols with long, complicated consent forms and try to simplify them. Experts found that the forms could be substantially shortened without loss of vital information. AAMC wants to build the capacity to address the issue in its member institutions throughout the full spectrum of research. She briefly discussed a collaboration between AAMC and the Hastings Center to develop a publication on the ethical oversight of learning health care systems. In this report, invited authors discussed the need for a new approach, including informed consent, suggesting that the distinction between treatment and research may be a less relevant framework for ethical oversight than a risk-based determination.

Ms. Pierce said AAMC has also initiated a project to encourage more and better community-based research. The project includes approaches to informed consent. The project was initiated based on member requests for guidance on internal processes related to community-based research. One investigator at member institution wanted to bring together ministers in a community to help develop an effective intervention for youth, but the IRB was unable to determine whether the ministers were subjects who had to be consented or study team members who required ethics training; further, the project could not move forward without knowing specific outcomes in advance. AAMC has heard frequently that many IRBs have trouble applying the regulations to community-based research. The organization is engaged in bringing together institutions that are doing robust community-based research and inviting them to put together case studies to help others do the same.

The speaker said that AAMC agrees that the informed consent is now wearing many hats, and the one that represents the participant is much smaller than, for example, the one that represents liability. A more engaging process is needed than signing a paper. Ms. Pierce read the following excerpts from AAMC’s comment letter responding to OHRP’s recent ANPRM regarding a possible rewrite of Subpart A:

“While we support the shortening and simplification of informed consent forms and have been involved in efforts to further this goal, we do not believe that imposing specific page limits or other proscriptive formatting requirements is appropriate.”

“Instead, we suggest that the regulations and accompanying guidance stress the flexibility that IRBs have to approve documents that provide all meaningful and relevant information to individuals, including easy access to more information as needed.”

“The regulations should dictate required elements of the process but not the precise manner in which the information is provided. Novel document formats… should be allowed and encouraged by the regulations.”

Discussion

Dr. Garrick asked whether the informed consent documents revised by the experts were sent back to the IRBs and whether they changed their behavior. Ms. Pierce did not believe the forms were sent back.

Dr. Osorio observed that difficulties in improving the informed consent process are in part a “locus of control” problem: IRBs, sponsors, and researchers do not believe they have the ultimate authority to modify the approach to informed consent. It may be helpful to have model consent forms sites can use that they know would be acceptable to regulators. There are also difficulties in allowing the right amount of leeway in multi-site studies so that institutions can address genuine local differences.

Dr. Allen highlighted issues from the sponsor’s perspective, noting that there have been cases in which IRBs insist on changes in informed consent that could negatively affect the scientific integrity of a trial.

Dr. Joffe suggested that as changes in informed consent are contemplated, representations regarding payment for injury and provision of the study drug should be flagged and backed up by contracts so the institution can be held responsible for fulfilling its commitment. The final consent document and the contract should be reviewed together to ensure they are the same. Dr. Chadwick commented that accredited organizations do have to back up their commitments in this way.

Dr. Botkin said it is often challenges for researchers who have a technical background to write in simple, clear terms. Some falsely believe that the more information is in the document, the safer everyone must be. Dr. Osorio observed that there has never been a court case in which the main issue hinged on the language of the consent form.

Remarks by Jeanne M. Adler and Jeffrey S. Abrams: Making Consent Forms More Precise

Ms. Adler and Dr. Abrams described how the National Cancer Institute (NCI) has been working to improve and shorten the consent form. NCI began by establishing an interdisciplinary, interagency working group to develop a template that:

Ensures regulatory compliance,
Standardizes the appearance of the Informed Consent Document (ICD) for easier review by IRBs,
Establishes content expectations for ICDs, and
Ensures that the NIH’s principles of plain language are addressed (see: http://www.nih.gov/clearcommunication/).

While the template accomplished these goals, the literature pointed to deeper problems NCI wanted to address as well. NCI conducted audits of consent documents used for trials, a survey of NIH Institutes to understand their approach to consent, a literature search, and consultations with advocacy groups. Test cases showed that it was possible to reduce consent documents used in Phase 3 trials sponsored by the Cancer Therapy Evaluation Program (CTEP) from 16 pages to 7. NCI then established a Planning Committee to develop an approach that would result in more concise ICDs for cancer trials. The committee established working groups to address different aspects of the problem.

Examples of differences in the new approach that resulted from their efforts included:

Focusing on how the study is different from standard treatment rather than using limited space to describe standard treatment in detail,
Providing informative, optional attachments, but ensuring that there is enough information in the consent document to inform the participant,
Providing text for sections of the document,
Developing resources for conveying technical information,
Describing risks of procedures only if they are part of the research question rather than “usual approach,” and
Standardizing terminology (e.g., “study doctor”).

NCI is now in the process of publicizing the availability of the new template through conferences and publications. Its effective date for use in CTEP trials is May 15, 2013. An outcome evaluation is planned.

Discussion

Dr. Allen asked whether NCI had made an effort to share its work with different sponsors of oncology trials. Speakers responded that the template has been shared with companies that work with CTEP and it has been posted on CTEP’s website for public reference: http://ctep.cancer.gov/protocolDevelopment/default.htm#informed_consent

Key documents, including sample consent documents for Phase 2 and Phase 3 trials, are also posted at: http://ctep.cancer.gov/protocolDevelopment/default.htm#informed_consent

A SACHRP member asked for more information on what it means to describe risks from the participant’s perspective and who decides which risks are “serious.” Speakers responded that FDA’s definition was used to make this determination. Dr. Abrams stated that toxicity criteria are graded 1-5, and events with ratings of 3 or higher are considered serious. Dr. Osorio observed that there are other significant risks besides toxicity. She noted that a consent form she reviewed said that when a pacemaker/defibrillator went into action it “might be uncomfortable,” but patients commonly described the experience as similar to having been “kicked in the chest by a horse.” She stressed the importance of conveying what people should expect honestly. Dr. Abrams agreed, noting that learning to do this well is an “ongoing challenge.”

Dr. Joffe stressed the importance of validating standards. He noted that a study of the previous improved NCI template found that it did result in improvements in understanding. A more recent study found that the majority of sampled consent forms failed to meet decision aid standards.[1] He also asked whether NCI still had a process for input that might result in modifications to the template. Speakers said they anticipated the template would be modified over time and respond to changes in the field.

Dr. Botkin referenced research that found parents of children with leukemia tended to use the consent document as a kind of “owner’s manual” for the trial, consulting it frequently. He wondered if the shortened document would support those who had a higher level of information needs. Ms. Adler said that while the concern is legitimate, the project focused its limited resources and attention on the needs of adults. She noted that the Children’s Oncology Group has its own template for consent, which may be reviewed in the future. Dr. Abrams added that patient advocates were very clear that even a 15-page consent form is too long, though they may need more information later during the trial.

Dr. Chadwick observed that the template is actually quite lengthy. Dr. Abrams responded that while the template itself is 26 pages long, the resulting consent document should be shorter. Dr. Chadwick asked about the notation regarding side effects that “some may be serious,” which seemed to convey little information. Dr. Abrams observed that the same symptoms may be minor or serious in different individuals and template authors wanted to avoid repeating the same symptoms in every category, which would add to its length.

Ms. Krivacic expressed appreciation for the template and the role played by advocacy groups in its development. She said she has passed the template on to IRBs she worked with, and they appreciated the guidance it offered.

Ms. Krivacic asked whether NCI has developed an approach for adaptive design trials or for trials that involve targeted therapies with both a dose escalations and expansion study within one protocol. These may even include an amendment study. These latter described trial designs are largely industry-sponsored and have very lengthy forms, since they combine studies that might otherwise have been separate. Dr. Abrams said this is an emerging approach that should be addressed.

Dr. Botkin thanked all the speakers for their insights.

Discussion of Subcommittee on Informed Consent

The Chair asked SACHRP members for their thoughts on establishing a subcommittee focused specifically on informed consent. Dr. Joffe pointed to the “vexing” question of best practices in regard to low literacy and non-English speaking participants. Dr. Botkin said he had included this in the draft charge for the subcommittee.

Dr. Eissenberg asked how the new subcommittee would affect the work of SAS and SOH. Ms. Gorey suggested that SACHRP focus on the issue of whether or not it is desirable to have a new subcommittee; OHRP will address issues related to cost. Dr. Ross clarified that SACHRP is concerned about resources in the sense of ability to carry out the work.

Dr. Chadwick said that addressing informed consent issues is an appropriate issue for SACHRP if OHRP is ready to move forward and feels SACHRP could be helpful. Dr. Allen added that everyone agrees the informed consent process leaves a lot to be desired. The Chair stressed that if a new subcommittee were established, it would build on the work SAS has already done on this issue.

Subpart A Subcommittee (SAS)

David K. Nelson, M.S., CIP, SAS Co-Chair; David Borasky, M.P.H., CIP, SAS Co-Chair

Mr. Nelson reviewed the committee’s charge and goals. He also reviewed membership and meetings to date, offering a detailed list of completed activities for the benefit of new members. He explained that SAS works hard to strike the balance between guidance and regulations that provide too much detail and those that leave too much to the imagination.

Informed Consent

Mr. Nelson said that informed consent was identified early on as topic that needed to be addressed. Many members of SAS were involved in development of the AAMC’s simplified form. When SAS first considered the topic, it felt it was too early to weigh in because of all the other projects then underway. Later, it added members with expertise on the subject, reviewed key literature, and brought forward some recommendations. However, SAS found that it was difficult to bring forward recommendations that were appropriate for OHRP. Its efforts fell short of what many people felt was needed. Mr. Nelson said he reserved judgment on whether or not SAS is the best place to hold further discussion of the issues.

Dr. Allen asked what has held SAS back from fully addressing the subject. Mr. Nelson said there are real barriers to change. Federal agencies need to lay out a new approach and provide an approved form that institutions will feel comfortable using. HIPAA requirements, liability concerns, and the entrenched perception that “more is better” are all barriers to the level of change many believe is warranted.

Recommendations for Revisions to the Expedited Review Categories

See: Attachment C. Expedited Review Procedures as Approved Showing Revisions

SAS expressed appreciation to SOH members, who contributed to the development of proposed recommendations regarding expedited review. Mr. Nelson noted that OHRP asked SAS to review the current list of categories and provide suggested revisions to update the categories. The Co-Chair emphasized that the list does not attempt to include research that does not meet the definition of human subjects research.

Evaluating Minimal Risk. Mr. Coleman observed that the examples would typically be considered minimal risk. Dr. Allen said the subcommittee would not have made that assumption. Mr. Nelson agreed. SAS members felt that “being on the list does not end the discussion.” Language was added to the beginning of the section to clarify that inclusion on the list does not mean that all research in the listed categories is minimal risk. Instead, it means only that “research falling within one or more of the categories is eligible for review through the expedited review procedure when it is determined that the proposed research involves no more than minimal risk to subjects.” Mr. Nelson commented that some things that are eligible for expedited review might be exempt.

Dr. Botkin said it is important to consider how much interpretation people should have to do around listed categories. The categories are helpful, but they also need flexibility to deal with specific cases.

Dr. Osorio commented on the paragraph that begins, “In assessing eligibility for expedited review, the IRB should consider….” She noted that this does not explain how to consider these things. Mr. Borasky countered that there are many points within the regulations where IRBs are told to consider various things, but welcomed alternative phrasing. Dr. Osorio said her concern was that IRBs have a consistent approach.

Applicability. Co-Chairs explained that SAS members went back to their institutions to learn what subjects were currently being reviewed by a convened committee because they were not on the list of subjects eligible for expedited review. They heard a need to be more open to biobanks in which there is no subject interaction and were also asked to sort out the “apples and oranges list,” which currently includes some procedures and some research subjects. SAS addressed the latter by focusing as much as possible on methodologies or procedures.

Dr. Joffe asked for clearer language introducing the categories that makes it clear that those listed are not the only ones eligible. The introduction now states: “Research that may be eligible for expedited review includes, but is not limited to, the examples in the categories provided below.”

Research Categories. In regard to the collection of blood specimens (2), Dr. Chadwick was concerned that the new guidance might be difficult for investigators and IRBs to understand, given the need for calculation based on weight. Dr. Joffe felt the calculations were needed, but he suggested that 110 pounds be changed to 50 kg for consistent use of the metric system. Dr. Joffe also noted that 3 ml per kg is not necessarily equal to 5% of blood volume and suggested that the parenthetical clause “5% of blood volume” be deleted. Mr. Nelson added, in response to a question, that the reference is to blood drawn for research purposes only. This was specified.

Dr. Botkin noted that this guidance is intended to apply to healthy adults, but the preamble makes clear that factors related to specific populations must be taken into account.

In regard to prospective collection of biological specimens other than blood (3), Mr. Nelson noted that d,e,f, and g are all new. Some of the new subcategories came from FDA guidance on minimal risk.

Dr. Joffe suggested that some of the items should either be limited to adults or be more exclusive. For example, collection for hands, feet, or genital areas may be problematic. Various members noted that collection from genital areas can be psychologically sensitive, especially for adolescents or children. The committee decided to specify that prospective collection of tissues via skin punch biopsies should be “non-genital” as well as “non-facial” and in adult populations only. In addition, the reference to specimens collected by curettage, urethral, vaginal, or rectal swabs was limited to adults. Tissues collected through pap smears were limited to those collected during procedures already being performed for clinical purposes.

In regard to “collection of data and biological specimens through noninvasive or minimally invasive procedures” (5), Dr. Joffe suggested that “allergy skin-testing” should be qualified as follows: “in subjects not known or suspected to have serious allergies to the allergen being tested.” The committee agreed. The committee also agreed that this category should be limited to data and not cause confusion with (3) by including biological specimens as well.

Dr. Ross was concerned that a single exposure to ionizing radiation equivalent to a chest x-ray might have “huge risks” to a child’s sexual organs. Dr. Joffe differed, noting that a single dose was comparable to flying across the country in an airplane. The committee decided to specify that “appropriate shielding techniques are employed.” SACHRP also voted that the expedited review category for studies involving ionizing radiation be limited to adults.

In regard to secondary use of materials collected for non-research purposes (6), ex officio Dr. Bledsoe asked whether the “use of banked specimens in biorepositories” would include the creation of biorepositories for materials that are collected during routine care. Mr. Borasky explained that it was SAS’s intention to address this type of biorepository in (7). Nelson noted that the key word in (6) is “secondary,” but he agreed this type of research should be expeditable. An ex officio said, however, that not everyone would agree with this – even if it contains only residual tissues.

A member asked why the issue of identifiability would not be relevant here. Mr. Nelson explained that introductory material calls this out as a point to consider. Also, identifiability in itself would not necessarily “kick up” the research such that it would not be minimal risk. Mr. Nelson added that if there are no identifiers, the use of biomaterials might not even be considered human subjects research.

Dr. Joffe noted that research that goes forward as expedited under the Common Rule is also implicitly being identified as eligible for expedited review under HIPAA. Ms. Heide said HIPAA contains language related to waivers, as well as criteria for privacy boards, that specifies what must be included in documentation. Dr. Joffe asked if there were instances in which a study was eligible to be expedited under the Common Rule but not under HIPAA. Ms. Heide responded that HIPAA does not specifically address review of research. The issue is whether authorization requirements have been waived, which is a different concept. Expedited procedures should also satisfy HIPAA requirements.

Dr. Osorio said she would feel more comfortable if language specified that secondary uses would be compatible with the original consent. She noted that some consent forms clearly state that materials will be held only by certain people or institutions, and her IRB would not see other uses as consistent with promise keeping. Noting that OHRP found this troubling as well, Co-Chairs agreed with the proposed change.

In regard to activities at statistical and data coordinating centers “that are not involved in the primary collection of data or specimens, which may be ongoing at other sites,” Dr. Joffe thought that studies in which the PI is located at the center but the work is done elsewhere ought to go to the full board. Dr. Ross said that someone would have to be responsible for the “big picture.” However, if the site that is the prime has done a good review, then other “downstream” institutions should be able to expedite the research. Dr. Osorio said that in cases familiar to her someone, typically the main PI’s sites, will have done a full IRB review. Ms. Gordon (ex officio, NIH) added that this is not an unusual occurrence. New language crafted by SACHRP now describes this category as “activities at statistical and data coordinating centers or repositories that are not responsible for the primary oversight of the study….”

Co-Chairs noted that (8), collection of data from voice, video, digital, or image recordings made for research purposes, is a new category. Mr. Barnes has a list of examples that could illustrate this subcategory.

In regard to (10), establishment of subject recruitment databases, a SACHRP member wanted to be sure that a list of people with conditions such as mental health issues would be treated with sensitivity. Another SACHRP member said this would not usually be considered research. One observed that criteria for a waiver of consent and criteria related to privacy would still have to be met. No one suggested qualifying language.

Continuing Review of Previously Approved Research. A SACHRP member asked why the section specifies that a determination of non-significant risk was made by a “convened” IRB. SAS Co-Chairs felt the emphasis was helpful and noted that the FDA uses this language. No changes were made.

Action

SACHRP unanimously approved the recommendations on expedited review as revised.

Future Work: A New Look at Engagement

Co-Chairs reported that SAS plans to take a look at what “engagement in human subjects research” means and tackle some particularly complex issues. They noted that the current regulations and related guidance are difficult to apply in everyday settings, and exclusions and exemptions make the issue more complex. Harmonization is another layer of complexity. Additional issues pertain to delineating who is engaged in certain multi-site studies; for example, some sites may be engaged only in exempt activities, but are still considered to be engaged in human subjects research.

Internet Research

Elizabeth Buchanan, Ph.D., Director of the Center for Applied Studies, University of Wisconsin-Stout; Dean R. Gallant, A.B., Assistant Dean for Research Policy and Administration, Harvard University

See:

Attachment D. Considerations and Recommendations Concerning Internet Research and Human Subjects Research Regulations, With Revisions

Dr. Buchanan and Mr. Gallant presented draft recommendations regarding Internet research, which incorporated suggestions offered by SACHRP at its previous meetings (July 10-11 and October 9-10, 2012). They noted that one of the major concerns was addressing HIPAA requirements, and they tried to address this concern. They also sought to address a comment from the Department of Education related to data jurisdiction in “cloud” storage (see question 16).

Discussion

Dr. Allen commented that the field is changing rapidly, and while it is possible to “chase the perfect document forever,” it is important to move this one ahead. Dr. Osorio observed that this is a new and growing area of interest, and she is “thrilled” that the authors have come forward with this document; guidance from OHRP is needed and will be welcomed.

Forms and Examples of Internet Research. Authors noted that interventional research that tries to influence people’s behavior is becoming common. After discussion, a separate bullet was added calling attention to this genre of research.

Ms. Krivacic noted that it is common to profile people in order to move them into clusters and get them to an interventional tool. The word “profiling” was added to the first bullet in this section to call attention to this practice.

Dr. Eissenberg stressed that the norms of sites should be respected. Mr. Gallant said the current document addresses this problem as a violation of the terms of service. Dr. Allen said a statement of fundamental principles was added to the document in order to address this type of ethical issue.

Ms. Heide said she viewed the document as falling in the genre of “Points to Consider” rather than one that gives definitive answers to particular scenarios.

Dr. Joffe called attention to the issues of confidentiality raised by emerging practices for getting consent. He was satisfied by the clarifying sentence at the end of the third paragraph.

Question 3. SACHRP added a cautionary sentence regarding the changing nature of what is “private” on the Internet, given possible changes in company policies.

Question 4. A SACHRP member noted that issues regarding identifiable private information raised by the passage appear not to be answered. Authors responded that they do not know the answer. Dr. Osorio agreed that there is no answer and the default position that makes most sense is to treat most information that appears on the Internet as identifiable.

Dr. Allen suggested redefining the question to call attention to the specific challenge. The question was accordingly changed from “what is identifiable private information on the Internet?” to “What are ways that identifiable private information may be conceptualized on the Internet?”

Dr. Botkin suggested that the document recommend further exploration of the questions raised, since definitive answers are clearly unavailable.

Dr. Osorio suggested adding the point that IRBs may be able to minimize the risks of a breach of confidentiality with good software design. Others did not see this as necessary to say.

At Dr. Joffe’s suggestion, SACHRP added closing language regarding the challenge IRBs face, which cannot be resolved with unambiguous guidance at this stage: “Ultimately, IRBs must make the difficult determination as to when a researcher who obtains multiple data points about a person that, although not individually sufficing to identify the person, may in aggregate render the data readily identifiable.”

Dr. Chadwick did not see the reference to private information in the Common Rule as helpful, since the Internet was not thought of when it was written. He also said the question does not seem to address the issue of what is public. Authors said that Question 3 focuses on this issue, while 4 focuses more narrowly on the issue of what constitutes identifiable private information.

Dr. Botkin stressed the importance of highlighting specific recommendations wherever they appear. The words “we recommend” were added to the second recommendation in the paragraph above “Fundamental Principles,” both recommendations were bolded, and the title “Recommendations” was added.

Action

Recommendations related to Internet research were unanimously approved as revised. The Chair congratulated and thanked the presenters.

Consideration of Possible Subcommittee on Informed Consent

The Chair revisited the issue of whether SACHRP should establish a new subcommittee on informed consent. A SACHRP member asked whether the current SAS subcommittee, which has already begun to address issues related to informed consent, has the expertise it needs to develop recommendations. Discussion clarified that subcommittee members are contract employees who are not subject to FACA requirements (as are SACHRP members), and additional members could be added if SACHRP and OHRP agreed to do so. No conclusion was reached at the meeting regarding the best course of action.

Public Comment

The Chair invited public comment, but none was offered.

Closing Remarks

Dr. Allen suggested that SACHRP address the topic of data safety monitoring committees. He said some “fairly open areas” exist that the committee could consider.

An ex officio representative of FDA reported that FDA is amending its regulations to provide additional safeguards for children enrolled in clinical investigations of FDA-regulated products. The new rule finalizes the interim rule published in 2001 to bring FDA regulations into compliance with the Children’s Health Act. It also harmonizes language with the Common Rule, Subpart D. The preamble clarifies some issues around placebo-controlled trials and component analysis. The new rule also addresses how children can be enrolled in research and how they can be provided with emergency treatment. One area of difference between HHS and FDA regulations regarding children enrolled in clinical investigations is that FDA did not adopt the provisions for a waiver of parental permission waiver that exist in the Common Rule.

See: https://www.federalregister.gov/articles/2013/02/26/2013-04387/additional-safeguards-for-children-in-clinical-investigations-of-food-and-drug

Secretary’s Advisory Committee on Human Research Protections

March 11, 2013

Washington, D.C.

Certification of the Summary of Minutes

I hereby certify that, to the best of my knowledge, the foregoing summary of minutes is accurate and complete.

_____________________________________________________________________________

Jeffrey Botkin, M.D., Chair Date

Attachment A. Letter from American Association of Neurological Surgeons

The American Association of Neurological Surgeons (AANS) and Congress of Neurological Surgeons (CNS) appreciate the opportunity to comment on the Secretary’s Advisory Committee on Human Research Protections (SACHRP) letter dated October 9, 2012, which recommends changes to the Department of Health and Human Services’ (HHS) Protection of Human Subjects regulation, also known as the “Common Rule.” We support SACHRP’s proposal calling for the elimination of irrelevant, non-research related information (e.g., standard surgical risks) from the informed consent document. However, we remain concerned that the SACHRP has yet to directly address additional exemptions related to quality improvement activities. This lack of guidance poses significant uncertainty for neurosurgical practices as they endeavor to undertake meaningful quality improvement efforts.

Registries are valuable tools that support evidence development, provider performance assessment and comparative effectiveness studies, among other important quality efforts. Unfortunately, while many healthcare providers have embraced the efforts -- such as registries -- which are designed to improve the quality and value of care, the interpretation of current federal regulations -- particularly the Privacy and Common Rules -- by various institutional review boards (IRBs) has created significant impediments to accomplishing these goals.

Because the standards surrounding research and the protection of human subjects are more developed and specific than those for quality improvement (QI), the latter efforts are often subject to research standards in an effort to ensure the protection of patients. As such, if IRBs are unsure of the relationship between federal guidelines and quality efforts, there appears to be a bias towards classifying certain quality programs as “research.” This situation is complicated by a fundamental lack of consistency in local interpretations of Common and Privacy Rules provisions relevant to clinical registries.

As clinical registries rely on serial evaluation of patient outcomes, the requirement for informed consent undermines QI efforts and compromises the validity of data assessments. Various investigators have noted that the requirement for informed consent can introduce significant selection bias into quality analyses. This problem was also highlighted in the recent Agency for Healthcare Research and Quality’s (AHRQ), “Registries for Evaluating Patient Outcomes: A User’s Guide.” Simply put, when a requirement for informed consent exists, patients who are willing to give consent often comprise a non-representative subset of the population of interest. Several national groups have now pointed out the extent to which traditional research requirements, such as informed consent, are a significant hindrance to QI efforts.

Clearly, there is a need for regulatory agencies to establish appropriate standards for QI activities that will both adequately protect patients and not unnecessarily burden QI efforts. Until that guidance is forthcoming, it is inevitable that significant variability will persist in the local interpretation of guidelines relevant to clinical quality initiatives. Furthermore, it will be difficult, if not impossible, for clinicians to participate in the full spectrum of quality efforts now mandated by regulatory bodies in the public and private healthcare arenas.

The AANS and CNS share with the public a sense of urgency and responsibility to meet the challenges of creating a sustainable healthcare system. Our organizations have therefore developed, in conjunction with relevant national stakeholders, the National Neurosurgery Quality and Outcomes Database (N2QOD). This project will allow any U.S. neurosurgeon, practice group, or hospital system to contribute to and access national aggregate quality and outcomes data. The N2QOD is primarily designed to serve as a continuous national clinical registry for neurosurgery, along the lines of the very successful Society of Thoracic Surgeons (STS) database. The primary purpose and design of neurosurgery’s registry is to track the quality of surgical care for the most common neurosurgical procedures, as well as provide practice groups and hospitals immediate infrastructure for analyzing and reporting the quality of their neurosurgical care, including risk adjusted benchmarks. The collected data will be used to generate a national network for accurate quality assurance in neurosurgery using patient-centered, non-administrative data.

At the request of organized neurosurgery and other specialty groups, the Office for Human Research Protections (OHRP) recently issued guidance on current regulations relevant to quality improvement programs such as clinical registries. While helpful, the guidance fails to address a number of important areas in which the current regulatory environment has failed to keep up with the rapidly evolving science of healthcare quality improvement, particularly those areas related to newer forms of clinical data collection. Several of the challenges posed by the current regulatory framework to quality programs were outlined in a multi-specialty communication sent to OHRP as a response to HHS’ ANPRM on Human Subject Protections. Two areas of concern outlined in that communication and in related discussions with OHRP are particularly relevant to the present discussion.

First, the OHRP has indicated that practice sites contributing data to a registry would not be considered to be engaged in research under the Common Rule. However, if the registry itself used the collected identifiable data to establish local or national benchmarks, it would be considered a “systematic evaluation….designed to develop…generalizable knowledge” and would therefore fall under the Common Rule’s definition of “research”. “Research” and the generation of “generalizable knowledge” have unique meanings in the context of quality improvement efforts and do not necessarily pose a risk to patients. In fact, they do just the opposite. Using registry data to establish local or national quality benchmarks, for example, generates new knowledge that can actually benefit patients by ensuring more accurate diagnoses, more appropriate treatments and procedures, and better outcomes overall. Federal regulators and other healthcare stakeholders need to recognize that the generation of “research” and “generalizable knowledge” does not always signal a risk to the patient. Collection and analysis of data derived from patient care has the potential to, and should allow for, the creation of new knowledge for the purposes of enhancing care. In most instances, new knowledge translates into risk-adjusted national benchmarks for allowing a comparison of care in specific care settings. If we are to fulfill the promise of collecting data that will allow us to drive practice improvements that ultimately benefit the patient, we must be able to collect data in the absence of unnecessary regulatory impediments and not be limited by traditional and often narrow definitions of “research.”

Second, the OHRP also recently suggested through direct communications that if a registry avoided the transmission of individually identifiable patient information from one institution to another, it would no longer be considered to be conducting “human subjects research” under the Common Rule. However, we find this interpretation problematic. De-identifying collected data is complicated, is costly for practice sites and for the registry, and does not facilitate the generation of meaningful data. For example, it would be difficult to link de-identified data to Medicare or other claims-based data sources, thereby limiting our ability to evaluate the cost-effectiveness of various treatment options. Furthermore, de-identified data would make it very challenging to conduct long-term follow-up with patients, a critical aspect of evaluating the effectiveness of certain procedures such as total joint replacements. Without unique patient identifiers, it would be virtually impossible to track the outcomes of patients who relocate or switch insurance plans over a 10 or 20 year period. This proposed mechanism for avoiding jurisdiction of the Common Rule would also make it virtually impossible for the registry to ensure meaningful control of the quality of its data.

The difficulties posed by a designation of “human subjects research” to quality efforts cannot be overstated. In particular, the requirement for informed consent creates almost insurmountable barriers to the practical implementation of quality efforts. Since clinical registries rely on continuous, prospective collection of data to produce longitudinal evaluations of patient outcomes, unnecessary application of informed consent and other patient authorizations could significantly compromise the validity of data assessments and create significant impediments to generating data of adequate quality to drive practice improvement. Patient consent forms are usually lengthy, confusing, and intimidating. They are typically written in highly, and often unnecessarily, technical terms that may cause mistrust among patients and often discourage consent. The end result is difficulty achieving serial enrollment, selection bias and tracking of non-representative populations, which produces data that may be of little value.

In summary:

1) Healthcare providers are now being required to produce objective evidence of the quality, safety and value of care to a variety of healthcare stakeholders

2) These quality related efforts necessitate the collection, analysis and reporting of clinical data.

3) Meaningful data collection often relies on the retention of individually identifying patient information (particularly in analyses related to the value or sustainability of treatment interventions) and generally results in the generation of new knowledge. The latter is a necessary and important aspect of quality improvement.

4) The current regulatory structure fails to recognize that data collection for quality improvement purposes (including the retention of PHI) and the generation of “new knowledge” pose no direct physical risk to the patient. In this environment, the only risk that may exist is informational (e.g., unauthorized release or other inappropriate use of personal data).

5) As the HIPAA Privacy Rule already addresses many of these informational risks by imposing restrictions on how certain identifiable health information collected by health plans, healthcare clearinghouses, and healthcare providers (‘‘covered entities’’ and their “business associates”) may be used and disclosed, it would seem extraneous and counterproductive to societal interests to hold quality improvement efforts such as clinical registries to Common Rule consent requirements if they already comply with HIPAA patient protections.

The AANS and CNS strongly believe that the regulatory agencies need to establish appropriate standards for QI activities that will both adequately protect patients and not unnecessarily burden QI efforts. Until that guidance is made available, it is inevitable that significant variability in interpreting and applying the Privacy and Common Rules will persist. Furthermore, it will be difficult, if not impossible, for clinicians to participate in the full spectrum of quality efforts now being mandated by regulatory bodies in the public and private healthcare arenas. Because the HIPAA Privacy and Security Rules provide the same or greater protection for patient data as the Common Rule, there is no need to apply the Common Rule for data collection activities where HIPAA compliant policies, procedures, and waivers are already in place. Therefore, we request:

1) That OHRP issue guidance that the Common Rule does not apply to the collection and analysis of identifiable patient information for quality improvement purposes where the entities collecting and analyzing the data (such as clinicians and a corresponding clinical data registry) are engaged in standard patient care and are in compliance with all applicable HIPAA requirements.

2) That explicit language be included in federal guidance to allow for a clear differentiation between “human subjects research” and the processes related to the essential prospective analyses that will be required to advance our national quality care objectives. In particular, the generation of new knowledge should be recognized as an expected and desired outcome of healthcare quality improvement projects; the processes related to the generation of such knowledge should therefore be exempt from a requirement for informed consent (assuming that all HIPAA related regulations are adhered to in the course of clinical data collection and analysis).Thank you for considering our comments and request. In the meantime, if you have any questions or need additional information, please contact us.

Sincerely,

Mitchel S. Berger, MD, President Ali R. Rezai, MD, President

American Association of Neurological Surgeons Congress of Neurological Surgeons

Enclosure: Neurosurgical Focus paper: “Regulatory considerations for prospective patient care registries: lessons learned from the National Neurosurgery Quality and Outcomes Database”

Attachment B. SOH Draft Recommendations: Regulatory Issues in Cluster Studies

Outline:

Definition of a Cluster Randomized Trial
Scientific validity
Overlap with QI projects as defined in OHRP FAQs
Who is a subject?
When is consent necessary for subjects?
When can deception be used to help blinding?
Identifying the risks and benefits of the research
Which institutions are engaged in research?
Subparts B, C, and D

Definition of a Cluster Randomized Trial

The central defining feature of a Cluster Randomized Trial (CRT) is that randomization occurs on a group level rather than an individual level. In a traditional randomized clinical trial, subjects are randomized sequentially as each subject is identified and then enrolled in a study. In contrast, in a CRT the randomization occurs as a function of being a member of a group. There can be several layers of groupings as well, for instance by school district, school, and class. Another possible model is by health care facility, medical provider, and each medical providers’ patients.

Four examples of cluster studies follow. First is study of a diagnostic device intended to measures biomarkers and through the application of an algorithm, provide a patient’s 5-year risk of developing type 2 diabetes. The study design is a 6-month duration, with 400-500 patients at 40-50 study sites. The investigators will be randomized to either receive education about the test and use the test in their patients with prediabetes (Active Arm) or not have access to the test (Control Arm). The primary endpoint will be the percent of patients that the investigators send to formal diabetes prevention programs and patient completion rates of these programs. The hypothesis that having access to the test will increase referrals to and adherence with prevention programs.

Second is a study of the effectiveness of after-school sports testing-programs for illegal drug use. School districts are randomized to either having an after-school sports testing program for illegal drugs, or not having such a program. Students are tested at regular intervals to determine illegal drug use to determine the effectiveness of the program.

Third is a study of study of community-based distribution of misoprostol for prevention of postpartum hemorrhage in rural Indonesia. One hundred villages will be randomized to either have access to misoprostol or not. In the active arm of the study, pregnant women will be asked to consent to participate in the research, and will receive tablets of misoprostol in a small baggy with directions on use presented in pictures. After they have their children, the women in the active arm will be interviewed to see if they had postpartum bleeding and used the misoprostol. In the control arm of the study, pregnant women will be identified by professional surveyors, but there is no intervention in their care and they will not be asked to provide consent. After they have their children, the women’s level of postpartum bleeding will be determined by professional surveyors.

Fourth is a community intervention trial for smoking cessation. The goal is to evaluate the effect of a multi-modal, community-level cessation intervention, including bill boards, media, and targeted messages. Twenty two communities are randomized to either having the intervention campaign or not.

Fifth is a study of the best use of sedation in children in a ICU setting. Hospitals are randomized to x v y.

In all of these designs, the randomization of subjects occurs at a group level rather than an individual level.

[Do we need more content for the definition section?]

Scientific validity

Provide description of how these trials can be more or less robust than standard clinical designs.

[need a volunteer with knowledge of study design issues to draft this part]

Are CRTs ever proposed in order to avoid the need to consent subjects?

Overlap with QI projects as defined in OHRP FAQs

Often CRTs will meet the definition of “research” in 45 CFR 46[i], and the various definitions of “clinical investigation” in the FDA regulations 21 CFR Parts 50, 56, 312,and 812[ii]. However, CRTs may also meet the definition of a quality improvement project as defined in the OHRP FAQs on quality improvement projects.[iii] Thus, one of the threshold regulatory issues to consider with a given CRT is whether or not it is research or a clinical investigation under the regulatory definitions. If a CRT does not meet those definitions, then as a regulatory matter the project does not meet the requirements for IRB review and informed consent.

[need more analysis here]

Who is a subject?

An essential issue in the application of the regulations to CRTs is determining which participants meet the definition of a human subject under 45 CFR 46[iv] and the FDA regulations[v]. In the first example listed above, the access to the investigational diagnostic device is randomized by physician practice. The outcome is whether the physicians use the device and then encourage their parents to prevent development of diabetes. Are the physicians subjects under 45 CFR 46? [discussion]. Are the physicians patients subjects under 45 CFR 46 in this proposed study? [discussion]. Are the physicians subjects under FDA regulations? [discussion]. Are the physicians patients subjects under FDA regulations in this proposed study? [discussion].

In the fourth example of a CRT above, communities are randomized to be exposed or not to a smoking cessation campaign. Are the members of the communities all subjects under 45 CFR 46. [discussion].

When is consent necessary for subjects?

Under 45 CFR 46.116(d), consent can be waived if four conditions are met. [discussion using examples above]

Consent after randomization

One issue that arises in CRTs is that often subjects have often already been randomized on a group basis before being approached for consent.

Opportunity to decline participation

Another issue that arises with CRTs is that subjects often may not have an opportunity to decline participation after their group has been randomized. For instance, in example four above, subject located in the communities randomized to either have the smoking cessation campaign or not have no choice as to whether to participate. They will either be exposed to the campaign or not. The same issue holds true in the second example, the randomization of the after school drug testing program.

When can deception be used in a CRT to help blinding?

Forty five CFR 46 also allows for partial waivers of consent, and this approach is commonly used to allow deception in certain types of research in order to strengthen the validity of the research.

Identifying the risks and benefits of the research

The criteria for IRB approval[vi] require that IRBs determine that risks are minimized and that the risk/benefit ratio is appropriate. In addition, subjects must be informed of risks and benefits as part of the consent process. There is not uniformity in designating which risks are in fast research risks. The regulations direct that, “in evaluating risks and benefits, the IRB should consider only those risks and benefits that may result from the research (as distinguished from risks and benefits of therapies subjects would receive even if not participating in the research).” This is a clear cut issue when an investigational new product is being tested, but it is not as clear when the research involves a registry, a phase IV study, standard of care arms, and public health interventions. In many RCTs, it is hard to identify the risks of the research, particularly in those arms that involve standard of care interventions.

Which institutions are engaged in research?

When an institution is engaged in research, then the institution is required to oversee the research in compliance with HHS regulations, including issues such as IRB review, informed consent, and registration with OHRP. In cluster randomized trials, it can be difficult to determine which institutions are engaged in research, particularly in studies such as the fourth example involving a community smoking cessation program. An analysis must be performed for each entity involved in the research to determine if they meet the requirements.

Subparts B, C, and D

The application of subparts B, C, and D to CRTs can be difficult, particularly in regard to the extra requirements for risk and benefit findings for the vulnerable populations.

Attachment C. Expedited Review Procedures as Approved, Showing Revisions

§46.110 Expedited review procedures for certain kinds of research involving no more than minimal risk, and for minor changes in approved research.

(a) The Secretary, HHS, has established, and published as a Notice in the FEDERAL REGISTER, a list of categories of research that may be reviewed by the IRB through an expedited review procedure. The list will be amended, as appropriate, after consultation with other departments and agencies, through periodic republication by the Secretary, HHS, in the FEDERAL REGISTER. A copy of the list is available from the Office for Human Research Protections, HHS, or any successor office.

(b) An IRB may use the expedited review procedure to review either or both of the following:

(1) some or all of the research in categories appearing on the list and found by the reviewer(s) to involve no more than minimal risk,

(2) minor changes in previously approved research during the period (of one year or less) for which approval is authorized.

Under an expedited review procedure, the review may be carried out by the IRB chairperson or by one or more experienced reviewers ~~designated by the chairperson~~ from among members of the IRB. In reviewing the research, the reviewer(s) may exercise all of the authorities of the IRB except that the reviewer(s) may not disapprove the research. A research activity may be disapproved only after review in accordance with the non-expedited procedure set forth in §46.108(b).

(c) Each IRB which uses an expedited review procedure shall adopt a method for keeping all members advised of research proposals which have been approved under the procedure.

(d) The department or agency head may restrict, suspend, terminate, or choose not to authorize an institution's or IRB's use of the expedited review procedure.

Categories of Research That May Be Reviewed by the Institutional Review Board (IRB) through an Expedited Review Procedure

Introduction

Research that (1) presents no more than minimal risk to human subjects and (2) involves one or more of the following categories, may be reviewed by the IRB through the expedited review procedure authorized by 45 CFR 46.110 and 21 CFR 56.110. The criteria for IRB approval of research as stipulated in 45 CFR 46.111 and 21 CFR 56.111, including but not limited to requirements for informed consent, apply regardless of the type of review procedure used by the IRB.

Evaluating Minimal Risk

The categories and their examples described below should not be deemed to be of minimal risk simply because they are included on this list. Inclusion on this list means only that research falling within one or more of the categories is eligible for review through the expedited review procedure when it is determined that the proposed research involves no more than minimal risk to human subjects.

In evaluating the risks introduced by the research, an IRB should consider the nature of the study procedures, other study characteristics, and steps taken to minimize risk. In evaluating the risks, the IRB should consider only those risks that may result from the research (as distinguished from the risks of therapies subjects would receive if not participating in the research).

In assessing eligibility for expedited review, the IRB should consider the characteristics of the subject population, including but not limited to their age, health conditions, social or economic vulnerabilities and experience in relation to the anticipated harms and discomforts. The expedited review procedure may not be used, for example, when identification of the subjects and/or their responses would reasonably place them at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, insurability, reputation, or be stigmatizing, unless reasonable and appropriate protections will be implemented so that risks related to invasion of privacy and breach of confidentiality are no greater than minimal.

The categories and their examples, described below, should not be deemed to be of minimal risk simply because they are included on this list. Inclusion on this list means only that research falling within one or more of the categories is eligible for review through the expedited review procedure when it is determined that the proposed research involves no more than minimal risk to human subjects.

Applicability

This list of categories applies only to non-exempt human subjects research. Research that does not meet the definition of research involving human subjects (45 CFR 46.102) or clinical investigation involving human subjects (21 CFR 50.1), or is exempt from the HHS regulations for the protection of human subjects (45 CFR 46.101), does not require IRB review.
The expedited review procedure may not be used for classified research involving human subjects.
Categories one (1) through ten (10) apply to both initial and continuing IRB review of research. Category eleven (11) applies to continuing review of previously approved research.
The categories in this list apply regardless of the age of subjects, except as noted.
Research that may be eligible for expedited review must fit within one or more of the categories below. However such research is not limited to the specific examples provided~~but is not limited to, the examples in the categories provided below.~~

Research Categories

Clinical studies of drugs and medical devices only when condition (a) or (b) is met.
1. Research on drugs for which an investigational new drug application (21 CFR 312) is not required. (Note: Research on marketed drugs that significantly increases the risks or decreases the acceptability of the risks associated with the use of the product is not eligible for expedited review.)
2. Research on medical devices where an investigational device exemption (IDE) application or an abbreviated IDE application for a non-significant risk (NSR) device (21 CFR 812) is not required.¹
The collection of blood specimens for research purposes using techniques consistent with routine clinical practice to minimize pain and risk of infection and within the following limits for volume: (a) from non-pregnant adults who weigh at least ~~110 pounds~~50 kg, the amounts collected should not exceed 550 ml in an 8-week period; or (b) from children² and other adults, the amount of blood to be collected should not exceed the lesser of 150 ml or 3 ml per kg ~~(5% of blood volume)~~ in an 8-week period. Examples:
1. Finger stick, heel stick, or ear stick with reasonable limits on frequency and with volumes consistent with clinical practice employing these methods.
2. Venipuncture with reasonable limits on frequency and with the total volume of clinical and research specimens limited as defined above.
3. Collection of blood from an in-dwelling peripheral venous catheter placed for research purposes with volume limits as defined above.
4. Collection of blood from an in-dwelling catheter already in place for clinical purposes, with the total volume of clinical and research samples limited as defined above.
Prospective collection of biological specimens, excluding blood, for research purposes by noninvasive or minimally invasive means.

Examples:
1. Tissues and fluids that the body produces continuously or sheds as a normal process, which are collected in a non-disfiguring manner.
2. Tissues and fluids if routine patient care indicates a need for removal or extraction.
3. Dental plaque and calculus.
4. Tissues from non-facial, non-genital skin punch biopsies in adults that do not require sutures.
5. Specimens collected in adults by curettage, urethral, vaginal or rectal swabs.
6. ~~Tissues collected from pap smears.~~
7. Specimens collected from the external auditory canal or nares.
Collection of additional data and biological specimens, excluding blood specimens, for research purposes during procedures already being performed for clinical purposes, provided the additional collection does not entail more than a minimal increase in risk, pain or discomfort.

Examples:

Collection of additional bodily fluids (e.g., peritoneal fluid, bone marrow or cerebrospinal fluid)
Reasonable extension of anesthesia, sedation or operating room time to allow collection of additional data or specimens.
Tissue collected from pap smears.

Collection of data ~~and biological specimens~~ through noninvasive or minimally invasive procedures (not requiring the addition of general anesthesia or sedation for research purposes) routinely employed in clinical practice.

Examples:
1. Physical sensors that are applied either to the surface of the body or at a distance.
2. Weighing or testing sensory acuity.
3. Magnetic resonance imaging.
4. Electrocardiography, electroencephalography, thermography, detection of naturally occurring radioactivity, electroretinography, ultrasound, diagnostic infrared imaging, doppler blood flow, and echocardiography.
5. Moderate exercise, muscular strength testing, body composition assessment, and flexibility testing.
6. Allergy skin-testing in subjects not known or suspected to have serious allergies to the allergen being tested.
7. Procedures in adults involving a single exposure to ionizing radiation with an effective dose not exceeding 0.1 mSv (the amount typically associated with a chest x-ray) provided appropriate shielding techniques are employed.
Secondary use of materials (data, documents, records, or biological specimens) that have been or will be collected for purposes other than the currently proposed research project. Examples:
- 1. Secondary use of data collected from another research study, provided the use is compatible with the original terms of consent, if any.
  2. Secondary use of clinical or educational records.
  3. Use of banked specimens in biorepositories.
Activities at statistical and data coordinating centers or biospecimen repositories that are not responsible for the primary oversight of the study and are not involved in the primary collection of data or specimens, which may be ongoing at other sites.
1. Multicenter clinical trial where data are gathered under separate IRB approval(s) for the performance sites, but received and managed by a central coordinating center that does not otherwise participate in the clinical intervention or interact directly with subjects.
Collection of data from voice, video, digital, or image recordings made for research purposes.
Surveys, interviews, self-reports, direct and indirect observations of individual and group behavior, other verbal or computer-assisted interactions or assessments, non-invasive physical or behavioral tasks, manipulation of the subject’s environment and similar methods commonly used in cognitive, behavioral, social, ethnographic, educational, health, and epidemiologic research.

Examples:

a. Measures of performance on cognitive, perceptual, neuropsychological, behavioral and other related tasks employing non-invasive technologies (e.g., paper and pencil assessment, computerized tasks, remote data collection using mobile devices).

b. Interviews, questionnaires, surveys, focus groups, and internet-based data collection on personal experience, identity, language, relationships, attitudes, beliefs and practices.

c. Psychiatric diagnostic or symptom assessments in healthy or mentally ill populations conducted by clinicians or trained interviewers (with appropriate mechanisms for clinical back-up or referral).

d. Measures of symptoms, mobility, range of motion, quality of life and activities of daily living in patient and non-patient populations by clinical or other trained personnel (e.g., nurses, physicians, social workers).

e. Methods used in ergonomics and human factors research including cognitive, human-computer, physiological and bio-mechanical measures in consumer, industrial, and biomedical settings.

f. Qualitative and quantitative data collection through observation, participant observation and interaction with groups in naturalistic settings (including the internet).

g. Surveys on personal and family finances, consumer preferences and decision-making.

h. Assessments of compliance with medication or treatment regimens.

i. Surveys to establish effectiveness of public health interventions.

Establishment of subject recruitment databases.

Examples:

Collection of identifiable information for the purpose of establishing subject pools.
Disease-specific patient registries.
Screening protocols including interviews, questionnaires and physical assessments that could be expedited under one of the categories listed above.

Continuing Review of Previously Approved Research

Research previously approved by the convened IRB and now subject to continuing review where one of the following conditions apply:
1. (i) The research is permanently closed to the enrollment of new subjects, (ii) all subjects have completed all research-related interventions, and (iii) the research remains active only for long-term follow-up of subjects; or
2. no subjects have been enrolled and no additional risks have been identified; or
3. the remaining research activities are limited to data analysis; or
4. a non-significant risk (NSR) determination was initially made by a convened IRB for research involving medical devices and the research was determined to present no greater than minimal risk to the subject; or
5. the IRB has determined and documented at a convened meeting that the research involves no greater than minimal risk, and no additional risks have been identified.

_______________________

¹ Circumstances where an investigation device exemption (IDE) application would not be required include those where (i) a non-significant risk (NSR) device is being reviewed by an IRB under 21 CFR 812.2(b); or (ii) the medical device is cleared/approved for marketing and is being used in accordance with its cleared/approved labeling; or (iii) the research is exempt from the IDE submission requirements under 21 CFR 812.2(c).

² Children are defined in the HHS [45 CFR 46.402(a)] and FDA [21 CFR 50.3(o)] regulations as "persons who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction in which the research will be conducted."

Attachment D. Considerations and Recommendations Concerning Internet Research and Human Subjects Research Regulations as Approved, Showing Revisions

Introduction

The purpose of this document is to provide a starting point for the development of FAQs and/or Points to Consider regarding the conduct and review of Internet research. Current human subjects regulations, originally written over thirty years ago, do not address many issues raised by the unique characteristics of Internet research. Some IRBs, concerned about their ability to make appropriate and responsible decisions regarding Internet research, have developed working guidelines for investigators.[2] Many of these guidelines focus on technical questions about data security, but there are other issues to address: basic categorizations of types of Internet research; types of data; data identifiability and subject privacy; appropriate consent and authentication of subjects procedures; jurisdictional authority; data collection, data storage, research administration, and data destruction; data sharing practices and implications; and discussion of what is common, reasonable, and acceptable in a given Internet environment and how these standards relate to current regulations and guidance in the areas of informed consent, recruitment, and risk of harm.

Ethical conduct of Internet research also brings questions of scientific design into high relief: authenticity of subject identity, assurance of comprehension of consent, and verification of data integrity can present significant challenges.

Forms and Examples of Internet Research

There are multiple forms of Internet research. Some experiments are conducted fully in online fora or conditions; some research may include elements conducted through the Internet, for example, using a social media application as a recruitment tool combined with traditional research methods and spaces; some research can only be conducted on the Internet, for example, an ethnography of an online-only forum that has no corresponding geo-physical location; or, the Internet may be a tool underlying data collection. We identify a range of Internet research where human subjects may be involved:

• Research studying information that is already available on or via the Internet without direct interaction with human subjects (harvesting, mining, profiling, scraping[3]—observation or recording of otherwise-existing data sets, chat room interactions, blogs, social media postings, etc.)

• Research that uses the Internet as a vehicle for recruiting or interacting, directly or indirectly, with subjects (Self-testing websites, survey tools, Amazon Mechanical Turk®, etc.)

• Research about the Internet itself and its effects (use patterns or effects of social media, search engines, email, etc.; evolution of privacy issues; information contagion; etc.)

• Research about Internet users—what they do, and how the Internet affects individuals and their behaviors

Research that utilizes the Internet as an interventional tool, for example, invesntions that influence subjects’ behavior

• Others (emerging and cross-platform types of research and methods, including m-research (mobile))[4]

Recruitment in or through Internet locales or tools, for example social media, push technologies

The broad and overarching term "Internet research" includes both the Internet as a tool for research and the Internet as a locale or venue of research. For example, research employing survey instruments, search engines, databases, databanks, or aggregators would constitute using the Internet as a tool for research. Such research may not involve direct interaction with human subjects, but identifiers or personally identifiable information may be generated, collected, and/or analyzed. In contrast, using the Internet as a medium or locale of research entails qualitative or quantitative studies of various Internet “spaces,” such as chat rooms, gaming worlds, virtual environments, or other simulated locales. Internet phoning, video conferencing, or online chat may be both tool and venue; applications such as Skype® or Facetime® may be used to contact subjects or participants, and interviews or focus groups can be conducted via the application. The increasing predominance of social media, defined as a "group of Internet-based applications that build on the ideological and technological foundations of Web 2.0, and that allow the creation and exchange of user-generated content,"[5] is blurring the tool-versus-venue model. Consider, for example, research using a social media application that engages subject recruitment via targeted ads on such platforms as Facebook® or via microblogging tools such as Twitter®, uses online data collection and analytic tools, and disseminates data via other social media applications. A specific example comes from an ongoing exploratory group of the ASCO Integrated Media and Technology Committee, which is reviewing the regulatory, legal, and ethical implications of oncology research and social media usage.[6] Projects using community-based participatory research methods are embracing Internet and m-research to send, receive, collect, and disseminate data synchronously. Other examples include such applications as CenceMe®, which integrates with social media and cellular devices to "infer a person's activity…and social context. This information is shared within the person's social circle….”[7]

Clear boundaries between “grid-enabled” technologies are eroding. For example, mobile applications interface with Internet sites or venues; tablets connect with cloud-based services in the use of survey tools; mobile devices are used in conjunction with Internet-enabled methods such as momentary sampling, reverse RSS data feeds, or synchronous data collection and analysis. With the emergence of such cross-operational research, fundamental aspects of human subjects research (recruitment, informed consent, data identifiability) present new challenges. Consent, for example, may occur in a synchronous setting, where both investigator and subject share a virtual space; or, consent may occur asynchronously, where a consent form is posted and subjects review it in the absence of the investigator. In the latter case, best practices are needed to ensure appropriate comprehension of consent documents and processes.[8]Thoughtful IRB review of emerging forms of cross-platform, cross-operational research may increasingly demand technical expertise in addition to regulatory knowledge, as new methodologies complicate risk/benefit analyses, and raise issues of confidentiality, privacy, and voluntariness.

This document argues for a reasoned and balanced approach to review of Internet research protocols, and does not advocate for more stringent review of Internet research. Nevertheless, in some circumstances researchers/investigators may have additional responsibilities. The ease with which sensitive data can be accessed, shared, hacked, and/or replicated is unique to Internet research, and for this reason, investigator responsibilities for good data stewardship, and heightened awareness of subjects' privacy, confidentiality, and identities, are critical.

Recommendations

This document is based on input from the research and professional literature, multiple years of workshops at Public Responsibility in Medicine and Research (PRIM&R) Advancing Ethical Research conferences, on-site panels at SACHRP in 2010, 2012, and 2013, and meetings with members of the SAS and SOH subcommittees of SACHRP in 2012 and 2013. Based on these experiences, we recommend that OHRP, the Food and Drug Administration (FDA), and the Office for Civil Rights (OCR) jointly commit to producing formal FAQs or Points to Consider for the research and IRB community that address the issues presented below. In developing this joint guidance, OHRP should consult with the HHS Office for Civil Rights (OCR) to address questions and issues related to application of the Health Insurance Portability and Accountability Act (HIPAA) Rules, where appropriate. In addition ~~, it was suggested that~~ we recommend that IRBs be provided with lists of appropriate questions to ask when reviewing Internet research, lists of appropriate or acceptable characteristics of vetted third party tools,[9] terms and phrases to use in protocols and informed consent/information sheet documents, a glossary of terms frequently used in Internet research,[10] as well as a decision-making flow chart that resembles existing models. Most of these are still in development.

Fundamental Principles

Investigators and IRBs should remember that the Belmont Report’s fundamental principles of respect for persons, beneficence, and justice are as applicable to Internet research as they are to any other form of human subjects research. Regardless of how the regulations may be interpreted in individual studies, adherence to these fundamental principles is important to encouraging public trust in the ethical conduct of Internet research.

Regulatory Considerations

Q1: What is “research involving human subjects” on the Internet?

The regulatory definitions of research, human subject, and identifiable private information must be our starting points.

Research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.

Human subject means a living individual about whom an investigator (whether professional or student) conducting research obtains

(1) Data through intervention or interaction with the individual, or

(2) Identifiable private information.

…

Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects.[11]

Use of the Internet as a tool for research and for intervention or interaction with subjects does not, in general, challenge the definition of “human subject.” However, new forms of identity, including avatars or other Internet personae, can be considered as virtual representations of “human subjects” if personally identifiable information about living individuals can be obtained by observing the actions of, or interacting with, the avatars. Investigators should determine if the avatar is a proxy for the individual, and if so, whether the subject's personally identifiable information (PII) is being obtained. Some avatars, for example, are simply computer-generated characters or representations and have no connection to an individual's PII. Other forms of Internet personae, including bots, typically do not display PII. Bots may be programmed to mine or harvest discrete PII from individual profiles, web sites, etc., or they may harvest large collections of data, such as patterns of search behaviors. If a bot’s purpose is to collect and display an individual’s PII, it may itself be a proxy for a “human subject.” If its purpose is to harvest multiple individuals’ PII from multiple sources, its activity might constitute human subjects research (but the bot itself would not be considered a human subject). Depending on the nature of the data and how they are obtained, these entities’ activities may or may not require IRB review. (See also footnote 11)

The issues of “identifiability” and of “private information” are addressed below (see Q3 and Q4).

Q2: What is exempt research involving human subjects on the Internet?

The use of the Internet to deliver educational materials is now common, and the regulatory exemption at 46.101(b)(1) for certain types of education research will often apply. (See Q8 for further discussion of “normal educational practice.”) The exemption at 46.101(b)(2) for certain kinds of tests, surveys, interviews, or observation of public behavior, where the collected information is not sensitive or is not identifiable, is much more complicated; the complications hinge on the issues of “public behavior” and “identifiable.” (See Q3, Q4, Q6, and Q7.) The exemption at 46.101(b)(4) raises similar questions about “publicly available” information and the identifiability of subjects, which are addressed below at Q3 and Q4.

Q3. When, if ever, is information available via the Internet “private information,” and when can subjects “reasonably expect” their private information will not be made public?

Private information as defined in the Common Rule means “information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record)” [45 CFR 46.102(f)].

If individuals intentionally post or otherwise provide information ~~via~~ on the Internet, such information should be considered public unless existing law and the privacy policies and/or terms of service of the entity/entities receiving or hosting the information indicate that the information should be considered “private.” To the extent that terms of service or explicit prohibitions would preclude the use of data on the Internet for research purposes, the determination that such data should be considered “private” is clear. In addition, investigators should note expressed norms or requests in a virtual space, which – although not technically binding – still ought to be taken into consideration.[12]n\ When in doubt about whether to consider data public or private, investigators are encouraged to consult with their IRB about the specific circumstances. IRBs should be aware of changing terms, site security, and information/data use policy. For example, what was once considered private information may change based on the business model of the site.

Are there now, or should there be, consensus standards for privacy of information on the Internet? The regulatory definition of private information cites medical records as an example. Tax records or personal diaries are often also given as examples. Is it possible to define categories of information on the Internet that are, by default, private and others that are, by default, public? For instance, at one extreme, identifiable information that is available only with a subject’s permission, or by using a password or other access mechanism under the subject’s control, could be considered private. At the other extreme, information that is legally available to any Internet user, without special authorization or access permission, could be considered public.
A subject’s own expectation of privacy is not always “reasonable.” A subject may assume—perhaps in ignorance—that his or her information provided or available on the Internet is private, but the first part of the regulatory definition of “private information” specifies that the individual “can reasonably [sic] expect that no observation or recording is taking place.” Information that is archived online has, ipso facto, been recorded. Can it ever be reasonable to expect otherwise, absent an explicit statement that no information will be recorded?
Despite (b) above, the Belmont principle of beneficence may support a more conservative approach. A subject who incorrectly assumed his/her identifiable information was private, or restricted only to a select group, might not have posted the information on some social networking site if s/he thought the information would be widely available, believing that the information could be embarrassing or damaging. Should the investigator and the IRB consider the proposed research to be subject to IRB review, even if under existing regulations the research is exempt because the information is publicly available? Researchers and IRBs should consider the nature of the study and the sensitivity of identifiable data; more details about the study, and thoughtful institutional policy, taken in consideration with standard professional or disciplinary norms and practices, would help inform such decisions.
The second part of the definition cites a reasonable expectation that information provided for a specific purpose will not be made public. When is an online venue, or social or professional networking site, or other online activity considered “public”? Does it matter if a password is required to join the venue? If the venue is moderated? If the venue is intended for use by individuals who share a particular condition or interest? Are there "shared priorities" by the members that dictate or determine norms?

One suggestion would be to follow the published privacy/confidentiality policy of the site; if there is no policy the site could be considered public. Privacy policies may parallel "anonymous" meeting standards (e.g., Alcoholics or Narcotics or Gamblers Anonymous), where members operate according to a set of shared priorities and there is an expectation of privacy and confidentiality within and outside of the meeting. Investigators should be aware of and respect those shared expectations.

A less nuanced approach would be to say that any venue where membership or participation must be authorized should be considered private. In contrast, venues where any individual can participate without third party approval—even if a password (of the individual’s own choosing) is required—would not be considered private. In addition, sites whose purpose is to present participants’ comments for public review (such as the comment section follow a news article) would be considered public even if participants must be vetted or authorized to participate.

In addition to the above considerations under the Common Rule, a researcher may need to consider whether the entity receiving or hosting the individual’s information is subject to the HIPAA Rules, and whether the information being maintained is protected health information. For example, a HIPAA covered entity may offer a web-based personal health record to individuals. The information entered into the record by either the covered entity or individual would be protected health information under the HIPAA Rules and thus may only be accessed for research or other purposes as permitted by the Rules.

Note that OCR would not consider research solely on information from publicly available sources (even if some health information was included) to be research involving protected health information for HIPAA purposes. However, a HIPAA covered entity that collects information about an individual from the internet and integrates the information into an individual’s medical or other health record must now protect that information as it would the rest of the record.

Q4: What are ways that identifiable private information may be conceptualized on the Internet?

The Common Rule defines private information as “information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).”^[13]

Private information is considered identifiable under the Common Rule if “the identity of the subject is or may readily be ascertained by the investigator or associated with the information.”[45 CFR 46.102(f)].The nature of online data enables mining and matching, raising the potential for partial identifiers to be combined and individuals recognized.[14] Multiple data sets may be aggregated and analyzed, yielding surprising or novel information. (Existing guidance and best practices regarding genetic databases and biospecimen banks may help inform thinking on these issues.[15])

If the identity of the subject cannot be “readily ascertained by the investigator or associated with the information” then the activity is not research involving human subjects. Unfortunately, the phrase “readily ascertained” is not defined, either in regulations or in guidance, and it is unclear whether the modifier “readily” also applies to “associated with the information.” Trying to quantify “readily” in some way, such as “number of clicks needed to get to a name/identity,” seems unlikely to be satisfactory.[16] Ultimately, IRBs must make the difficult determination as to when a researcher who obtains multiple data points about a person that, although not individually sufficing to identify the person, may in aggregate render the data readily identifiable.

Q5: What is intervention or interaction with a subject in research on the Internet?

Intervention as defined by the Common Rule “includes both physical procedures by which data are gathered … and manipulations of the subject or the subject's environment that are performed for research purposes.”[17] Manipulations of subjects can take many different forms, often mimicking “real-world” manipulations,[18] and manipulation of environments may include testing of different website interfaces, provision of different responses to web queries, recording Internet-based activities or behaviors for subsequent analysis, etc., using the Internet as a reminder or interface for the performance of some physical activity (e.g., taking a medication or performing a task), or may be through something as simple as the presence of a researcher.

Interaction includes “communication or interpersonal contact between investigator and subject.”[19] Online interaction may occur in environments that range from virtual worlds or guilds to social media sites to chat rooms, newsgroups, and mobile platforms. Environments can be textual and/or graphical. The interaction itself can include, for example, interviews, focus groups, dialogue across a listserv or newsgroup, or any exchange via social media. Surveys presented online should be considered “interaction” with subjects, even if there is no live individual receiving responses in real time but data are collected by the survey engine for later access by the investigator. Interaction can also take place via mobile devices, tablets, or other devices that are connected to Internet applications or tools.

Q6. What are the characteristics of purely public sites?

The analogies of public parks and public libraries have been invoked in Internet research, with the idea that just as there should be no expectation of privacy in real-world public settings, so should some Internet-based settings be considered public. However, questions of access, logging and storage and transmission of data, and other technical considerations complicate the comparisons. Further, just as eavesdropping may not be considered appropriate behavior (even if the activity being observed occurs in a public setting), so too may the monitoring of some Internet-based activities raise similar ethical concerns.

In general, purely public sites fall into one or more of the following categories.

Sites containing information that, by law, is considered “public.” In most cases information from these sites will be available without restriction, although access to the information may require payment of a fee. Many federal, state, and local government sites are included in this category: property tax records, birth and death records, real estate transactions, certain court records, voter registration and voting history records, etc.
News, entertainment, classified, and other information-based sites where information is posted for the purpose of sharing with the public.
Open access data repositories, where information has been legally obtained (with IRB approval if necessary) and is made available with minimal or no restriction.
Discussion fora that are freely accessible to any individual with Internet access, and do not involve terms of access or terms of service that would restrict research use of the information.

Q7: What is observation of public behavior online?

If an activity (textual, visual, auditory) is legally available to any Internet user without specific permission or authorization from the individual being observed, or from the entity controlling access to the information, the activity should be considered “public behavior.” Examples include “comment” postings on news sites; posting on publicly available hosting sites such as YouTube® or Flickr®; postings on classified sites such as Craigslist®; and postings on unrestricted blog or wiki sites. Information posted on social networking sites such as Facebook®, LinkedIn®, Myspace®, or similar fora, and available without restriction to any authorized user of the site, should also be considered “public behavior,” even though access to the website itself may be restricted to individuals who have established an account to use the site.[20] Note that the mere fact of an activity being considered “public behavior” does not mean that observation of the activity should automatically be considered exempt from the requirement of IRB review. Per 45 CFR 46.101(b)(2), if the information is recorded in a way that permits identification of subjects, and if disclosure of the identifiable information could “reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation,” then the research would not be exempt from IRB review.[21]

Q8: Is online education normal educational practice?

Yes, it often is.The exemption at Section 46.101(b)(1) cites "Research conducted in established or commonly accepted educational settings, involving normal educational practices, such as (i) research on regular and special education instructional strategies, or (ii) research on the effectiveness of or the comparison among instructional techniques, curricula, or classroom management methods." How far beyond the traditional classroom has the widespread use of personal computers and mobile technologies expanded the range of “commonly accepted educational settings”? There are now multiple types of online educational practices ranging from complete degree programs, to individual for-credit classes, to activities that supplement regular classroom instruction, to less formal not-for-credit activities such as instructional videos, online lectures, or TED talks. Considerations include the nature of the “education” being provided; the prevalence of a particular intervention in the learning group under consideration; and the existence of the intervention or teaching process prior to a researcher's involvement. The burden of demonstrating that a particular online educational research activity should be exempt from IRB oversight may have to rest with the investigator, but IRBs should understand that the range of Internet-enabled “normal educational practices” continues to broaden.

Q9: When is information recorded in identifiable manner?[22]

The exemption at 101(b)(2) refers to “Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless: (i) information obtained is recorded in such manner that human subjects can be identified, directly or through identifiers linked to the subjects; and (ii) any disclosure of the human subjects’ responses outside the research could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, or reputation.” Is “recorded” in this context limited to data that the investigator records him/herself? We believe the intent of this section is “recorded by the investigator in such manner….” (See footnotes 20-21).

Q10: When are data, documents, or records publicly available on the Internet?

Publicly available may mean:

- Available at no charge to anybody with a computer
- Available to anybody willing to pay the requisite fee
- Available to anybody who meets the terms of a use agreement

Documents that used to be housed in public courthouses or agencies are now often available in electronic form. Such records as state agency reports, property tax assessments, marriage licenses, real estate transactions, voter registration, and the like are now searchable online. Internet tools and sites have simply made access to such public documents easier, but the essential nature of the data is still public.

With the growing availability of data banks and data repositories, and with established data sharing mandates, investigators have greater access to data and data sets. Many IRBs have established exemptions for data shared through ICPSR, NIH, NSF, the US Census, etc. Research involving publicly available datasets, with or without identifiers, does not require IRB review under 45 CFR 46.

We may consider these criteria from the United Kingdom's Data Archive, for example,[23] which controls investigator access and the extent to which they are "publicly available":

"For confidential data, the Archive, in discussion with the data owner, may impose additional access controls which can be:

needing specific authorisation from the data owner to access data
placing confidential data under embargo for a given period of time until confidentiality is no longer pertinent
providing access to approved researchers only
providing secure access to data by enabling remote analysis of confidential data but excluding the ability to download data."

Each of the above bullets would constitute a limitation on public availability and the first three would often preclude applicability of the exemption at 46.101(b)(4).

There have been situations where data are under the control of an individual (or entity) who is unaware of regulatory or statutory restrictions on the sharing of data, or who is aware of the restrictions but nevertheless makes the data available (incidents involving WikiLeaks, for example). Investigators and IRBs should ensure that data represented as “publicly available” are, indeed, available without restriction that would limit the proposed use.

Q11: How do investigators obtain the informed consent/parental permission/assent of subjects for research on the Internet?

As with other forms of research, the consent/assent process for Internet research should be tailored to the risks and complexities of the research. The absence of direct, in-person contact can add complications to the consent process.

Three oft-cited concerns with consent in Internet research are verifying identification, ensuring comprehension, and obtaining appropriate documentation when needed. Adequate identity verification may in some cases be handled by the hosting survey provider; in other cases, with minimal risk research, it may not be a critical issue. (See Q 15, below.) Comprehension of the consent materials may be addressed by a checkbox (“I understand and agree”) for low risk research, or by mandatory quizzes as a comprehension check. The federal ESIGN law authorizes electronic signatures in certain contexts. In other contexts, state law may control. (Note: OHRP is currently working on issues of e-signatures; see Q14)

The consent process for non-exempt online surveys may include a statement that the subject gives evidence of agreement to participate in the research by the fact of his/her completing the survey. This is permissible even if the consent document does not include all the elements prescribed at 45 CFR 46.116(a), so long as the IRB approves a waiver or alteration of some elements under 46.116(c) and (d).[24]

When obtaining consent in more than minimal risk research, many steps may be necessary. In one example, an industry-sponsored online Phase IV clinical trial, subjects informed of and interested in participation had to meet eligibility criteria; those who qualified underwent ID/age verification. Consent documents were then emailed, faxed, or made available on a web site, with additional information provided in audio or video format. Subjects were required to take a comprehension quiz after reviewing the consent materials and had to score 100% to move ahead. A designated contact for questions and to provide additional information was available to subjects at all times. Applications such as Skype® or LiveChat® have also been used to enable direct communication between researcher and subject during the consent process.

Research with minors raises particular concerns. There are age verification software products available, which may be of use to researchers. Verification of age can take place through less formal fact-checking embedded in the research instruments (for instance, cross-validating multiple age and birthdate questions). Researchers may advertise only on sites that are age-limited to begin with. Coordinating parental consent with child assent can be difficult, and the Children’s Online Privacy and Protection Act (COPPA) mandates parental permission if subjects under the age of 13 are being recruited and they provide identifiable information.[25]

Where the HIPAA Privacy Rule applies, the Rule allows a HIPAA authorization for research to be obtained and signed electronically, provided any electronic signature is valid under applicable law.

Q12: When may investigators seek to waive or alter the informed consent of subjects in research on the Internet?[26]

Per 46.116 (c) and (d), to waive some or all of the required elements, or to waive the requirement for consent in toto, the IRB must find and document:

The research presents no more than minimal risk; the waiver will not adversely affect subjects’ rights and welfare; the research could not practicably be carried out without waiver; and, when appropriate, subjects will be provided with additional pertinent information after participation.[27]

In the absence of a robust identity verification process, some IRBs will only approve an online consent process under circumstances that meet the criteria for alteration/waiver at 46.116(d), and will consider the age/identity verification difficulties as key to the “impracticability” determination. However, if identifiable information may be collected about children under the age of 13, the COPPA requirement for parental consent will apply (there is no waiver provision).

Q13: How do investigators document the informed consent of subjects for research on the Internet?

According to HHS/OHRP,[28] "For most research, informed consent is documented using a written document that provides key information regarding the research. The consent form is intended, in part, to provide information for the potential subject’s current and future reference and to document the interaction between the subject and the investigator. However, even if a signed consent form is required, it alone does not constitute an adequate consent process. The informed consent process is an ongoing exchange of information between the investigator and the subject and could include, for example, use of question and answer sessions, community meetings, and videotape presentations. In all circumstances, however, individuals should be provided with an opportunity to have their questions and concerns addressed on an individual basis."

Appropriate methods for documenting of informed consent in Internet-based research should reflect the risk and complexity of the research. For straightforward minimal risk research, documentation might be in the form of a simple click-through "I agree" statement preceding access to the study materials, where subjects are presented the appropriate consent information and then signal their consent either by checkbox or by completing the survey or experimental materials; this is consistent with OHRP guidance for survey research.[29] When the research protocol is more complicated, or may present more than minimal risk, a signed document, sent via traditional methods or completed via e-signature (see Q 14) may be a necessary component. Investigators can discuss the informed consent process via chat, email, video, or other online venue, such as in a virtual world. Verification of comprehension can be a challenge. Studies may include a "quiz" or survey after the subject reads or listens to the consent script, to confirm their understanding of the presented materials, and only after completion of the comprehension check will a subject proceed to the study site. Other possibilities include a designated chat room or email contact to discuss the consent process and to allow investigators and participants to converse prior to beginning the research.

Also see Q11, Q12 above.

Q14: Can an electronic signature be used to document consent or parental permission?

This question has been answered at http://answers.hhs.gov/ohrp/questions/7249. "Yes, under certain circumstances. First, the investigator and the IRB need to be aware of relevant laws pertaining to electronic signatures in the jurisdiction where the research is going to be conducted.

“Unless the IRB waives the requirement for the investigator to obtain a signed consent or permission form based on the HHS regulations at 45 CFR 46.117(c), a written consent or permission form, which may be an electronic version, must be given to and signed by the subjects or the subjects' legally authorized representatives or the parents of subjects who are children. Some form of the consent document must be made available to the subjects or the parents of subjects who are children in a format they can retain. OHRP would allow electronic signature of the document if such signatures are legally valid within the jurisdiction where the research is to be conducted.

“OHRP does not mandate a specific method of electronic signature. Rather, OHRP permits IRBs to adopt such technologies for use as long as the IRB has considered applicable issues such as how the electronic signature is being created, if the signature can be shown to be legitimate, and if the consent or permission document can be produced in hard copy for review by the potential subject. One method of allowable electronic signatures in some jurisdictions is the use of a secure system for electronic or digital signature that provides an encrypted identifiable “signature.” If properly obtained, an electronic signature can be considered an “original” for the purposes of recordkeeping."

The HIPAA Privacy Rule also allows HIPAA authorizations to be obtained electronically from individuals, provided any electronic signature is valid under applicable law. In addition, FDA has issued guidance regarding electronic signatures and records at 21 CFR Part 11, with updates in 2007,[30] with specific attention to audit trails and monitoring of research and adverse events. Trace data, logs, time stamps, and electronic data capture can be used.[31]

Q15: Are investigators required to confirm the real identities of the subjects of their Internet research?

Investigators and IRBs should be aware that identity verification is a major issue in Internet research. Absent appropriate verification of a subject’s identity, data validity and reliability may be questioned. The need for identity confirmation should take into account:

the importance to the research (i.e., are there critical eligibility criteria? Is there a likelihood of repeat or fraudulent participation, whether for mischief or to collect multiple payments?)
the level of risk to subjects. Low-risk surveys where parental consent could be waived may require only minimal identity verification, perhaps a checkbox. High-risk studies involving the transmission of sensitive information may warrant multiple-factor authentication, such as passwords delivered by mail or telephone, or via an identity verification software or vendor.
There may be a third-party policy or terms of agreement in place that the researcher should acknowledge when considering identity confirmation. For example, Facebook® has a "real-name" only policy, so anonymity is not possible. The norms and expectations of users and venues must be considered.

Online clinical trials, in particular, may include the need for in-person identity verification. Legal jurisdiction should be considered (see Q17). Some IRBs have published suggestions for subject authentication, ranging from sophisticated technical measures such as electronic key exchanges, to less technical personal identification numbers.[32]

Q16: How does legal jurisdiction apply in Internet research?

Jurisdictional authority is complicated by the dispersed nature of Internet subjects and participants. In general, IRBs may assume the jurisdiction of the researcher, not the participants, is controlling. However, in telemedicine, the precedent has held that the jurisdiction of authority is the location of the subjects/patients, consistent with laws regarding the practice and distribution of medicine. This can highlight state and international differences in law and policy. With online clinical trials, for example, state regulations may prevent the enrollment of subjects unless the Investigator is licensed to practice medicine in the state(s) from which subjects are drawn.

If data are stored in “the cloud,” (i.e., at multiple, dispersed sites) additional considerations, including data privacy laws at the local storage site(s) and regulations other than those at the research site, may apply. These include, for example, the European Data Privacy Directive 95/46EC or the Canadian Privacy Act and the Personal Information Protection and Electronic Documents Act. Agreements with data storage and processing entities should acknowledge the investigator’s and any business associates’ responsibilities to comply with relevant requirements, and subjects should be informed of such arrangements as appropriate.[33]

Q17: What is minimal risk in Internet research?

102(i)[34]: Minimal risk: The regulatory definition of “minimal risk” predates use of the Internet as a communications and research tool. Many Internet-related risks such as identity theft, other types of electronic fraud or security breaches, online “addictions,” and electronic monitoring, stalking, or bullying, can have serious consequences, but most were not part of our daily lives—or indeed even contemplated—when the regulations were first written. It is increasingly appropriate to include the risk of computer-related harms, such as hacking, phishing, breach, lack of appropriate security measures, etc., as among those risks encountered in daily life.

As with any form of human subject research, there runs a continuum of risk in Internet research, and the type of IRB review—expedited or full board—should reflect the level of anticipated risk. Categorization schedules such as the University of North Carolina's Data Security Recommendations[35]or the Harvard Research Data Security Policy[36] can help IRBs determine appropriate protections for data of differing levels of sensitivity. Use agreements may be necessary supplements to protocols, especially those in cross-agency, cross-institutional, or multi-site studies. In addition, where appropriate under NIH standards, Certificates of Confidentiality offer protection against compelled disclosure.[37]

Investigators and IRBs must consider both risks related to the specific research protocol and risks related to the technologies in use. How should IRBs think about these risks, and how can they accurately be conveyed to subjects—especially when the full extent of risks might not be known even to the investigator? While subjects may be reassured by being told that appropriate precautions will be taken to ensure the security of their data, the exact nature of “appropriate precautions” (in the absence of published guidelines or established standards) can be difficult to determine or to convey in a meaningful way. IRBs that regularly review Internet research should consider including one or more information technology professionals on their rosters, to assist with determinations of actual risk and to advise on implementation of appropriate security measures.

Since research conducted online may not involve real-time communication with participants, misunderstanding or distress may not be evident to the researcher, which can in turn elevate the risk to subjects. IRBs must be aware of these possibilities; some types of Internet research may not be approvable without assurance that immediate contact with a researcher will be available if necessary.

Q18: How may investigators minimize risk of harm when using sensitive online data?

The definition of minimal risk references both the probability and the magnitude of harm, and investigators and IRBs must consider both dimensions. A risk of significant harm (e.g., identity theft, breach of confidential medical or personal information) that is technically possible, but of small likelihood, may be judged to be minimal if the IRB is satisfied that the investigator’s data security procedures are consistent with best-practice recommendations of the institution’s IT professionals. Common guidance, or reference to established standards, would be helpful.[38]

Sensitive data include personal health, economic, educational, and/or reputational information, and may be more readily available in online venues than in traditional onground research. IRBs should consider changing sections on consent forms from "Confidentiality" to "Limits to Confidentiality" and should ensure accurate use of terms such as “anonymous” and “confidential.”

While the HIPAA standards for protection of data may be extreme for muchsocial/behavioral/educational research, consistent standards for low to minimal risk research should include consideration of how subjects’ data will be collected, transmitted to the researcher, and stored. If a third party venue or processing site is involved, their access to and storage of those data should be specified. The consent process should include explanations of how data are maintained, ranging from individually identifiable forms to aggregate forms, and what linking or reidentification measures are possible. If aggregated anonymized data will be made publicly available, investigators and IRBs should consider whether subjects could be (re)identified and how that likelihood could be minimized.

Whenever possible, identifiable data should be encrypted in transit (for most low to minimal risk studies, basic SSL encryption is acceptable) and while at rest (whole disk encryption is readily available). Data should be unlinked from identifiers and IDs destroyed as soon as they are no longer needed. Researchers should consider provisions for remote locking of devices or remote destruction of data in the event of a lost device. When investigators are entrusted with data and devices, they have a responsibility to minimize risk and to honor their obligations to subjects.

Both data use and data management plans should reflect investigators' and subjects' responsibilities and rights, including any applicable privacy laws and regulations. In addition to standard elements regarding access, longevity, and ownership of data, plans should identify available resources in the event of harms.

Social media sites, search engines, and virtually all online fora retain log data. A shared knowledge base of appropriate characteristics of venues and tools for IRBs and researchers would be helpful to understand the data life cycle on the most commonly used online research sites and tools.

Q19: What forms of online recruitment are used and what is reviewable by an IRB?

Recruitment tools include Web ads, Twitter streams, blog postings, YouTube videos, and “push” methods, such as email solicitations and texts. Links to online recruitment sites (e.g., Patients Like Me, Inspire) may also be provided in other media (television, newspaper, classified, public transit posters, robo-calls,etc.). OHRP considers direct subject recruitment part of informed consent, which is subject to IRB review.

Note that, per FDA guidance, prior IRB review is not necessary for simple listings of clinical trials on websites where the system format limits the provided information to basic descriptive information, including study title, purpose of the study, protocol summary, basic eligibility criteria, study site location(s), and how to contact the study site for further information.[39]Any recruitment plan must receive IRB review and approval prior to initiation if additional information is provided, including description of research risks, potential benefits, incentives (monetary or non-monetary), or where identifiable information is solicited to determine eligibility.

As with other forms of research, introducing an investigator into a forum or study site may be appropriate, and the investigator and IRB should review the introduction process as part of the recruitment plan. A moderator, high-ranking member, or other member of status can provide information to the online site community prior to the researcher's entrance.

Q20: How is deception conducted in Internet research?

Occasionally some aspects of a study are not fully disclosed in advance, to avoid affecting subjects’ responses. Deception in Internet research may be ethically complex; Kraut et al. (2003) note greater difficulty in monitoring adverse effects and in provision of adequate debriefing.[40] Internet research provides many opportunities for deception.[41] Researchers can create "fake" or alternative locales to observe behavior or actions; provide limited or erroneous information to see how subjects respond to a given situation;[42] or send "spam" or "phishing" messages to elicit personal data.[43]Because informed consent in a deceptive study is necessarily limited, the need for appropriate debriefing following participation must be given special consideration, but difficulties abound. Subjects may choose to leave a venue or locale without reading (or even seeing) the debriefing material; may change email addresses; or may fail to respond to electronic communications. Investigators and IRBs should be aware of these potential challenges when considering appropriate debriefing measures.[44]

[1] Brehaut, J.C., et al. (2012). Informed consent documents do not encourage good-quality decision making. Journal of Clinical Epidemiology,65(7):708-24.[2] See for example: http://irb.uconn.edu/Internet_research.html

—http://www.marianuniversity.edu/interior.aspx?id=13714

—http://inside.bard.edu/irb/guidelines/

—http://www.luc.edu/irb/irbonlinesurveys2.shtml

—http://www.research.psu.edu/policies/research-protections/irb/irb-guideline-10

[3] Terms that may be unfamiliar are highlighted in blue bold and included in the Glossary.

[4] Much discussion is occurring around FDA approval of mobile applications for medical research. In July 2011, the FDA released draft guidance for Industry and Food and Drug Administration Staff - Mobile Medical Applications available at http://www.fda.gov/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm263280.htm#5

[5]Kaplan, Andreas M.; Michael Haenlein (2010) "Users of the world, unite! The challenges and opportunities of Social Media". Business Horizons 53(1): 59–68.

[6]Dizon, D. et al. (2012). Practical guidance: The Use of Social Media in Oncology Practice. Journal of Oncology Practice, 000610.

[7]Miluzzo, E. et al. (2010). Research in the App Store Era: Experiences from the CenceMe App Deployment on the iphone." ACM, 978-1-60558-843-8-10/09

[8] For example, electronic comprehension checks (quizzes or short responses) of a consent document may be embedded prior to a subject's entrance into a study site or prior to engaging in any research activities. In some studies, subjects must score 100% accuracy on their comprehension checks to be eligible for the research.

[9] Given the frequency with which commercial tools change their terms of service, this list would of necessity be based on appropriate characteristics, rather than calling out specific companies or products.

[10] See Appendix A (FORTHCOMING)

[11] 45 CFR 46.102(d) and (f)

[12] For example, "Everyone is welcome on PrettyThin. Anorexics, ex-anorexics, people in the health profession….it’s an open forum. The alternative is the closet…is that the society we wish to live in?" (http://www.prettythin.com/category/frequently-asked-questions/). However, a different approach is offered at Ana Boot Camp: "Some images, links text and thinspiration may be considered triggering in nature. As well, if you are looking to get anorexia / bulimia by being here then please leave now. You will not find information contained within this web site, forum, or any site linked to / from this website on how to become anorexic or bulimic.
If you do not accept the condition of anorexia / bulimia / other eating disorders plus the pro-ana pro-mia movement then you must also leave this proana website immediately. Also you will not use this pro-ana pro-mia web site and or forum against anyone in any conceivable manner. You have been forewarned. By entering this proanapromia web site you are signing a digital certificate stating that you have read and understand the above mentioned conditions and you are entering this proanapromia site knowingly and willingly of the aforementioned conditions. Entering by any other circumstance is perjury and can be punishable by law." (http://anabootcamp.weebly.com/)

[13] 45 CFR 46.102(f)

[14] See for example, Sweeny, L. (forthcoming, Connecting Your Dots: What they know from what you leave behind; 2004; Privacy-Enhanced Linking. ACM SIGKDD Explorations 7(2) December 2005.
Earlier version available as Carnegie Mellon University, School of Computer Science Technical Report CMU-ISRI-05-136. Pittsburgh: November 2000); Narayanan, A. and Shmatikov, V. (2008). Robust De-anonymization of Large Sparse Datasets. In Proc. of 29th IEEE Symposium on Security and Privacy, Oakland, CA, May 2008, pp. 111-125. IEEE Computer Society.

[15] See, for example, Report of the Public Responsibility in Medicine and Research (PRIM&R) Human Tissue/Specimen Banking Working Group Part I Assessment and Recommendations, 2007 http://oba.od.nih.gov/policy/Tissue%20Banking%20White%20Paper%203-7-07%20final%20combined.pdf

[16] If an IRB considers the expertise or qualifications of the investigator when considering how “readily” an identity can be ascertained, then depending upon the investigator’s skill and experience, and availability of other data, use of the same information by two different investigators could in one case constitute research involving human subjects and, in the other, not. This apparent inconsistency, based on researcher expertise or qualifications in Internet research, is not unique to Internet research, but is likely to become increasingly relevant as more and more datasets become available. There has been extensive discussion on the IRB Forum (http://www.irbforum.org) on this issue. See, for example, January 11 – January 25, 2012 discussion on “the meaning of anonymity.”

[17] 45 CFR 46.102(f)

[18] See for example, the “Virtual Milgram” at http://www.plosone.org/article/info:doi%2F10.1371%2Fjournal.pone.0000039.

[19] 45 CFR 46.102(f)

[20] If access to a site is restricted to individuals who must meet specified eligibility criteria, in addition to registering for participation (for instance, individuals who suffer from a particular medical condition), activity on the site should not be considered “public behavior.”

[21] The implication of 101(b)(2)—“ information obtained is recorded in such a manner that human subjects can be identified…”—is that the information is recorded by the investigator. Confirmation of this interpretation would be helpful.

[22] 101(b)(2) Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless: (i) information obtained is recorded in such manner that human subjects can be identified, directly or through identifiers linked to the subjects; and (ii) any disclosure of the human subjects’ responses outside the research could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects’ financial standing, employability, or reputation.

[23] http://www.data-archive.ac.uk/create-manage/consent-ethics/access-control

[24] See http://www.hhs.gov/ohrp/ohrp/regulations-and-policy/guidance/faq/index.html

[25] See http://www.coppa.org/comply.htm; also see FTC's August 1, 2012 proposed changes to COPPA, which includes changes to the COPPA definition of "'person information' to include persistent identifiers" (Ropes & Gray, 2012).

[26] See Subpart A Subcommittee, SACHRP Recommendations Regarding the Provisions for Waiver or Alteration of the Informed Consent Requirements Under Department of Health and

Human Services (HHS) Regulations at 45 CFR 46.116(d) (http://www.hhs.gov/ohrp/archive/sachrp/mtgings/mtg07-07/present/WaiverConsentDocSAS.doc)

[27] Similar conditions apply to the alteration or waiver of a HIPAA authorization in the research context. Under the Privacy Rule, before approving a waiver or alteration, an IRB or Privacy Board must determine that the use or disclosure of PHI for the proposed research involves no more than minimal risk to individuals’ privacy; the research could not practicably be conducted without the waiver or alteration; and the research could not practicably be conducted without access to and use of the PHI.

[28] See http://www.hhs.gov/ohrp/ohrp/regulations-and-policy/guidance/faq/index.html

[29] See http://www.hhs.gov/ohrp/ohrp/regulations-and-policy/guidance/faq/index.html

[30] See http://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/ucm072322.pdf

[31] See for example a level 1 clinical trial use of electronic monitoring: Internet-based technology facilitates clinical outcome data collection and adverse event monitoring, Orthopedics Today, February 2012 (http://www.healio.com/orthopedics/business-of-orthopedics/news/print/orthopedics-today/%7B523CD70A-7C15-4B5D-8E54-923E8BF958EE%7D/Internet-based-technology-facilitates-clinical-outcome-data-collectionand-adverse-event-monitoring)

[32] See the Pennsylvania State University's statement regarding recruitment for Internet research: "Investigators are advised that authentication - that is, proper qualification and/or identification of respondents - is a major challenge in computer- and internet-based research and one that threatens the integrity of research samples and the validity of research results. Researchers are advised to take steps to authenticate participants. For example, investigators can provide each study participant (in person or by U.S. Postal Service mail) with a Personal Identification Number (PIN) to be used for authentication in subsequent computer- and internet- based data collection." (http://www.research.psu.edu/policies/research-protections/irb/irb-guideline-10)

[33] For example, many Canadian research ethics boards include the statement "Please note that the online survey is hosted by "Survey Monkey" which is a web survey company located in the USA. All responses to the survey will be stored and accessed in the USA. This company is subject to U.S. laws, in particular, to the U.S. Patriot Act that allows authorities access to the records of internet service providers. If you choose to participate in the survey you understand that your responses to the questions will be stored and accessed in the USA. The security and privacy policy for Survey Monkey can be viewed at http://www.surveymonkey.com/" on their consent documents.

[34] 45 CFR 46.102(i): Minimal risk means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.

[35] See http://help.unc.edu/help/information-security-policy-summaries/

[36]See http://security.harvard.edu/research-data-security-policy

[37] See NIH, "any research project that collects personally identifiable, sensitive information and that has been approved by an IRB operating under either an approved Federal-Wide Assurance issued by the Office of Human Research Protections or the approval of the Food and Drug Administration is eligible for a Certificate. Federal funding is not a prerequisite for an NIH-issued Certificate, but the subject matter of the study must fall within a mission area of the National Institutes of Health, including its Institutes, Centers and the National Library of Medicine." (http://grants.nih.gov/grants/policy/coc/faqs.htm#278)

[38] See, for example, http://cphs.berkeley.edu/datasecurity.html and http://security.harvard.edu/research-data-security-policy

[39] Specifically, refer to clinicaltrials.gov, where study listings that meet the posting criteria of the site need not, in and of themselves, be reviewed and approved by an IRB prior to posting. However,

"Most trials require approval from a human subjects review board. If your study requires approval, you may register your study on ClinicalTrials.gov prior to getting approval if the Overall Recruitment Status of the study is "Not yet recruiting." See Overall Recruitment Status data element on ClinicalTrials.gov .

If a study requires human subjects review board approval, approval must be obtained before the study's Overall Recruitment Status is changed to Recruiting. When board approval is obtained, please update the protocol section of the study record in the Protocol Registration System (PRS) and release the study for processing." (http://clinicaltrials.gov/ct2/manage-recs/faq#board)

[40]See Kraut, R. et al. (2003). Psychological Research Online: Opportunities and Challenges. http://www.apa.org/science/leadership/bsa/internet/internet-report.pdf

[41] See Bachard, K. and Williams, J. (2008). Practical advice for conducting ethical online experiments and questionnaires for United States psychologists.Behav Res Methods. ;40(4):1111-28.

[42] See for example the Virtual Milgram experiment at http://www.plosone.org/article/info:doi%2F10.1371%2Fjournal.pone.0000039

[43] See Finn, P. and Jakobsson, M. (2007). Designing and Conducting Phishing Experiments. IEEE. http://markus-jakobsson.com/papers/jakobsson-ieeets07.pdf

[44] See for example, University of Massachusetts: "Some research requires a debriefing after participants have completed an online survey. Online debriefing forms should be similar to the debriefing process done during in-lab experiments. The debriefing page should come immediately after the last question on the survey. Participants should be thanked for participation and more information as to the purpose of the study should be provided. Also, researchers contact information and information about other resources (IRB info, Health Services, Local Resources) should be provided and participants should be reminded to print a copy of the debriefing form for their records. Participants should also be given the option to withdraw their data at this point (now that they have been fully informed as to the intent and purpose of the study). If they agree to have their data used for the study then they should have an “I Agree” button to click and submit their data online. If they do not agree to have their data used in the study they should have an “I Do Not Agree” button to click so that their data is not submitted and collected online. Please check with the online survey program you are using to ensure that these capabilities are allowed." (http://www.umass.edu/research/online-surveysurvey-research-guidance)

[i] 45 CFR 46.102(d) Research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program which is considered research for other purposes. For example, some demonstration and service programs may include research activities.

[ii] There are four different definitions of clinical investigation found in 21 CFR 50 and 56, 312, and 812:

21 CFR 50.3(c): Clinical investigation means any experiment that involves a test article and one or more human subjects and that either is subject to requirements for prior submission to the Food and Drug Administration under section 505(i) or 520(g) of the act, or is not subject to requirements for prior submission to the Food and Drug Administration under these sections of the act, but the results of which are intended to be submitted later to, or held for inspection by, the Food and Drug Administration as part of an application for a research or marketing permit. The term does not include experiments that are subject to the provisions of part 58 of this chapter, regarding nonclinical laboratory studies.

21 CFR 56.102(c): Clinical investigation means any experiment that involves a test article and one or more human subjects and that either must meet the requirements for prior submission to the Food and Drug Administration under section 505(i) or 520(g) of the act, or need not meet the requirements for prior submission to the Food and Drug Administration under these sections of the act, but the results of which are intended to be submitted later to, or held for inspection by, the Food and Drug Administration as part of an application for a research or marketing permit. The term does not include experiments that are subject to the provisions of part 58 of this chapter, regarding nonclinical laboratory studies. The terms research, clinical research, clinical study, study, and clinical investigation are deemed to be synonymous for purposes of this part.

21 CFR 312.3(b): Clinical investigation means any experiment in which a drug is administered or dispensed to, or used involving, one or more human subjects. For the purposes of this part, an experiment is any use of a drug except for the use of a marketed drug in the course of medical practice.

21 CFR 812.3(h): Investigation is a clinical investigation or research involving one or more subjects to determine the safety and/or effectiveness of a device.

[iii] OHRP FAQs on QI, http://www.hhs.gov/ohrp/ohrp/regulations-and-policy/guidance/faq/index.html

[iv] 45 CFR 46.102(f) Human subject means a living individual about whom an investigator (whether professional or student) conducting research obtains

[v] There are three different definitions of human subject found in 21 CFR 50 and 56, 312, and 812.

21 CFR 50.3(g) and 56.102(e): Human subject means an individual who is or becomes a participant in research, either as a recipient of the test articles or as a control. A subject may be either a healthy human or a patient.

21 CFR 312.3(b): Human subject means a human who participates in an investigation, either as a recipient of the investigational new drug or as a control. A subject may be a healthy human or a patient with a disease.

21 CFR 812.3(p): Subject means a human who participates in an investigation, either as an individual on whom or on whose specimen an investigational device is used or as a control. A subject may be in normal health or may have a medical condition or disease.

[vi] 45 CFR 46.111; 21 CFR 56.111.

SACHRP Minutes March 12-13, 2013

Secretary’s Advisory Committee on Human Research Protections (SACHRP)

Tuesday, March 12, 2013 – Wednesday, March 13, 2013

Minutes

Voting SACHRP Members Present:

Tuesday, March 12, 2013

Wednesday, March 13, 2013

Secretary’s Advisory Committee on Human Research Protections

March 11, 2013

Washington, D.C.

Categories of Research That May Be Reviewed by the Institutional Review Board (IRB) through an Expedited Review Procedure

Subscribe to Email Updates