The Limits of Review

At this conference, we are examining “Ethics Oversight and the Frontiers of Biomedical Research.” The responsibility for oversight of biomedical research in the United States is widely distributed, from the Office for Human Research Protections (OHRP) in the United States Department of Health and Human Services, to each research institution’s Institutional Review Board (IRB), to the Principal Investigator (PI) of each research project, to the individual physicians, nurses, and technicians who do the hands-on work of research.

The span of scale here is tremendous, as is the scope of responsibility. At the small end of the scale is the individual research assistant, responsible for following the dictates of everyday morality and common decency, as well as adhering strictly to an approved research protocol. At the large end of the scale is OHRP, responsible for defining in broad terms which research projects are acceptable and which are unacceptable, and setting the guidelines under which research protocols are approved and research is monitored.

Near the midpoint of the scale is the IRB, with responsibility for reviewing protocols before research begins and at least annually thereafter. When an IRB determines that a protocol is flawed, it has a duty to withhold approval until the flaws are remedied. In this context, a protocol is flawed if it fails to meet relevant regulations or, in the view of the IRB, fails in some other way adequately to protect human subjects. 

The first of two limits of review I will mention can be dealt with quite briefly: The limit imposed by research at the frontier. I suggest that IRBs are relatively well-designed to scrutinize protocols against a backdrop of accepted practice. They are not, however, well equipped to decide whether research is acceptable in a novel area, like human reproductive cloning or fetal stem cell research.

Right now, Timothy Murphy is leading a session entitled, “What if a Proposal to Clone a Human Being Came before your IRB?” I will not attempt to answer the specific question, but I am convinced that the answer to the general concern is clear. Broad lines of novel and controversial research should be approved or disapproved at the national, or perhaps international, level. IRBs should only be expected to decide whether a specific study within an accepted broad line of research adequately protects human subjects.

Now I turn to the second, and last, of the limits of review mentioned in my title.

Recent cases have raised serious questions about whether human subjects of research are adequately protected by the IRB system. There are two separable issues here.

1.  Are human subjects adequately protected?
2.  Is the IRB system providing all of the protection it can?

I believe that it most cases the answer to question (1) is yes; human subjects, by and large, are well protected in the United States. I do not mean to suggest that protection is perfect or fool proof. The protection of human subjects in research can be improved, and we are morally obliged improve it on an ongoing basis.

The second question – is the IRB system providing all of the protection it can? – begs a prior question: What protection can the IRB system provide? In other words, what can we reasonably expect of a well-working IRB?

A major contributing factor to several recent high-profile cases, including the suspension of all human subjects research here at the University of Illinois-Chicago, has been insufficient resources for the IRB. If an IRB has insufficient staff, if the staff is inadequately trained, if the higher administration undermines its efforts, it cannot be expected to work effectively.  The institution has a responsibility either to provide the necessary resources for adequate review or reduce the amount of human subjects research done at the institution to the level that the IRB can handle.

Insofar as the IRB system is currently operating with inadequate resources, the system is not providing all of the protection it can. At least in broad terms, however, the solution is easy; resources available to IRBs must be increased. How this can be accomplished will vary from institution to institution, and of course the Federal Government has some responsibility to lead the way in ameliorating this problem.

Assuming that an IRB does have the resources it needs, what can we reasonably expect from it?

We can reasonably expect that an IRB will review protocols in a timely fashion; that it will ensure that the protocols it approves adhere to all relevant laws and regulations; and that the protocols approved will provide reasonable protections for human subjects of research, if the protocol is followed.

We cannot reasonably expect that an IRB can prevent all harms to human subjects. The only way to prevent all harms is to abandon all research.

We also cannot reasonably expect that an IRB can prevent all deviance from approved protocols. The IRB is responsible to review protocols, not to undertake research. Only the researchers themselves can prevent deviance from approved protocols.

Responsibility for adverse events stemming from adherence to a flawed protocol can rightly be placed at the feet of the IRB and, perhaps, the IRB system.

Responsibility for adverse events stemming from failure to adhere to a well-designed protocol cannot. The actual conduct of research is outside of the IRB’s control.

An IRB cannot prevent misconduct or adverse events any more than the Department of Motor Vehicles can prevent drunk driving. The DMV can ensure that it provides driver’s licenses only to people who understand that drunk driving is illegal; it can even mount educational campaigns against drunk driving. But it cannot drive every car.

If oversight above and beyond protocol review is needed – as it may well be – another board should be created specifically for this task. For example, it would probably be wise for all greater-than-minimum-risk research to be subject to unannounced and random audits to ensure that the researchers are adhering to the approved protocol. Asking the IRB to undertake these audits is like asking the DMV to take on the duties of the Highway Patrol – a formula for disaster.

It might also be wise to have a third board to investigate the causes of apparent misconduct and adverse events.

To recap:

• The IRB would be responsible for reviewing protocols;
• a second board for ensuring that protocols are followed; and
•  a third for dealing with instances in which protocols are not followed.

It may be that the duties of these two additional boards could be taken up by some existing entity (other than the IRB) common to many institutions.

We can ensure the failure of an IRB if we ask it to do too much, or to undertake tasks for which it is not prepared. Reviewing protocols, auditing research, and investigating violations are substantially different tasks and should be performed by separate, though closely coordinated, boards.

Thank you for your attention.