Research Compliance Professional's Handbook, Third Edition

IRB Membership

HHS regulations at 45 C.F.R. 46.107(a) and FDA regulations at 21 C.F.R. 56.107(a) provide, among other things, that each IRB shall have at least five members, with varying backgrounds to promote complete and adequate review of research activities commonly conducted by the institution. In addition, the regulations provide that the IRB be sufficiently qualified through the experience and expertise of its members to promote respect for its advice and counsel in safeguarding the rights and welfare of human subjects and be able to ascertain the acceptability of proposed research in terms of institutional commitments and regulations, applicable law, and standards of professional conduct and practice. If an IRB regularly reviews research that involves a vulnerable category of subjects (i.e., children, pregnant women, prisoners), consideration should be given to the inclusion of one or more committee members who are knowledgeable about and experienced in working with these subjects. Each IRB must include at least one member whose primary concerns are in scientific areas and at least one member whose primary concerns are in nonscientific areas. Additionally, each IRB must include at least one member who is not otherwise affiliated with the institution and who is not part of the immediate family of a person who is affiliated with the institution.

IRB Written Procedures

HHS regulations at 45 C.F.R. § 46.108(a)(3) and (4); and FDA regulations at 21 C.F.R. § 56.108 require that IRBs follow written procedures that adequately describe the following activities:

• Conducting initial review of research;

• Conducting continuing review of research;

• Reporting findings and actions to the investigator and the institution;

• Determining which projects require review more often than annually;

• Determining which projects need verification from sources other than the investigators that no material changes have occurred since the previous IRB review;

• Ensuring prompt reporting to the IRB of proposed changes in a research activity, and for ensuring that such changes in approved research, during the period for which IRB approval has already been given, are not initiated without IRB review and approval except when necessary to eliminate apparent immediate hazards to the subject; and

• Ensuring prompt reporting to the IRB, appropriate institutional officials, any department or agency head and OHRP (for research covered by an institution’s FWA) and the FDA (for FDA-regulated research) of: (a) any unanticipated problems involving risks to subjects or others (“UPs”); (b) any instance of serious or continuing noncompliance with 45 C.F.R. § 46 and/or applicable FDA regulations or the requirements or determinations of the IRB; and (c) any suspension or termination of IRB approval.

Both OHRP and FDA recommend that IRB written procedures be sufficiently detailed so that the procedures provide IRB members and administrative staff with an understanding of how to carry out their duties consistently and effectively in ways that ensure that the rights and welfare of subjects are protected.^[19] Moreover, it is believed that such step-by-step operational details in written procedures will help IRBs operate in compliance with governing regulations. This is why IRB written procedures that simply reiterate the regulations are found insufficient, i.e., such “procedures” do not provide sufficient detail about the IRBs’ operations and how those operations satisfy regulatory requirements.

Research Exempt from IRB Review

HHS regulations permit exemptions from IRB review for research where the only involvement of human subjects falls within one of the following categories:^[20]

• Educational research

• Interactions: educational tests, surveys, observation of public behavior

• Benign behavioral interventions

• Secondary research when informed consent is not required

• Federal research and demonstration projects

• Taste and food quality evaluation and consumer acceptance studies

• Storage or maintenance when broad consent is required

• Secondary research when broad consent is required

Providing an exempt determination is not a requirement of the IRB. In practice, most exempt determinations are made by an IRB chair, IRB administrator, or experienced IRB staff. Exemptions should be granted by knowledgeable individual(s) who have been granted authority through institutional policy. Some categories of exemption require Limited IRB Review.^[21] Limited IRB review must be performed by an IRB member. When conducting limited IRB review, the IRB reviewer must determine that:

• There are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data;

• For exemptions granted under 45 C.F.R. § 46.104(d)(7)(8), limited IRB review must also include a determination that broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens must be obtained and documented in accordance with the applicable regulatory requirements.^[22]

Limited IRB review can be conducted by the expedited procedure and continuing review is not required for research approved by limited IRB review.

Review by the Expedited Procedure

HHS regulations at 45 C.F.R. § 46.108(b) and FDA regulations at 21 C.F.R. § 56.108(c) require that the IRB review proposed research at convened meetings at which a majority of the members of the IRB are present, including at least one member whose primary concerns are in nonscientific areas, except where expedited review is appropriate under HHS regulations at 45 C.F.R. § 46.110/FDA regulations at 21 C.F.R. § 56.110. FDA regulations permit the use of expedited review procedures for initial or continuing review to specific research categories published in the Federal Register at 63 FR 60364-60367 ^[23] when the research is determined to involve no more than minimal risk. Expedited review is permitted under HHS regulations for minimal risk^[24] research that fits in types of research that appear on the Secretary’s list, for minor changes in previously approved research, or for research where limited IRB review was a condition of exemption. An expedited reviewer is authorized to exercise all of the authorities of the IRB except that the reviewer may not disapprove the research. Research may only be disapproved after review has been performed in accordance with the non-expedited procedures by the convened IRB. OHRP recommends that the IRB document—for initial and continuing reviews conducted under an expedited review procedure—the specific permissible categories justifying the expedited review. Continuing review of research approved by the expedited procedure is not required.^[25]

IRB Approval Criteria

FDA regulations at 21 C.F.R. § 56.111 delineate that the following criteria must be satisfied before an IRB can approve research:

• Risks to subjects are minimized;

• Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result;

• Selection of subjects is equitable;

• Informed consent will be sought from each prospective subject or the subject’s legally authorized representative, unless waived or altered by the IRB;

• Informed consent will be appropriately documented unless waived or altered by the IRB;

• When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects;

• When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data;

• When some or all subjects are likely to be vulnerable to coercion or undue influence, additional safeguards are included in the study to protect the rights and welfare of such subjects.

In addition to the above, HHS regulations at 45 C.F.R. § 46.111(a)(8) include an additional approval criterion for research approved using the limited IRB procedure.^[26]

Informed Consent

HHS regulations at 45 C.F.R. § 46.116(a) and FDA regulations at 21 C.F.R. § 50.20 set forth requirements for legally effective informed consent. In the context of informed consent process, HHS regulations require that:

• Informed consent should only be obtained under circumstances that provide the prospective participant sufficient time to discuss and consider whether or not to participate;

• Informed consent should only be obtained under circumstances that minimize the possibility of coercion or undue influence;

• The information given during the informed consent process must be in language understandable to the subject or the legally authorized representative;

• The prospective subject or the legally authorized representative must be provided with the information that a reasonable person would want to have in order to make an informed decision about whether to participate, and an opportunity to discuss that information;

• Informed consent may not include exculpatory language; and

• Informed consent must begin with a concise and focused presentation of the key study-related information (except when broad consent is obtained).

Both HHS and FDA regulations require that when seeking informed consent, certain basic and additional elements/information be provided to each subject^[27] unless the IRB approves a consent procedure that waives or alters, some or all of the of the informed consent elements.

Informed consent requirements differ between HHS and FDA regulations. Specifically, FDA regulations do not require that the informed consent process begin with a concise and focused presentation of the key study-related information, nor do they require a reasonable person standard when information is presented to prospective subjects. Moreover, HHS regulations set forth additional requirements for elements of informed consent related to:

• Secondary research use of data and biospecimens;^[28]

• Commercial profit related to biospecimens;

• Return of clinically relevant research results to participants; and

• Whole genome sequencing of biospecimens.^[29]

IRB Approval Actions

An IRB must review (and approve) proposed research, including proposed changes to previously approved research, at convened meetings at which a majority of the members of the IRB are present, including at least one member whose primary concerns are in nonscientific areas, except when expedited review is authorized (45 C.F.R. 46.108(b) and 21 C.F.R. 56.108(c)).

According to OHRP, approval with conditions means that “at the time when the IRB reviews and approves a research study (or proposed changes to a previously approved research study), the IRB requires as a condition of approval that the investigator (a) make specified changes to the research protocol or informed consent document(s), (b) confirm specific assumptions or understandings on the part of the IRB regarding how the research will be conducted, or (c) submit additional documents, such that, based on the assumption that the conditions are satisfied, the IRB is able to make all of the determinations required for approval under the HHS regulations at 45 C.F.R. 46.111 and, if applicable, subparts B, C, or D of 45 C.F.R. § 46.”

When the IRB grants contingent approval, the IRB should provide the researcher specific modifications required to secure approval. For example, “Participants must be 18 years or older” or “Drop the placebo-controlled arm of the study.” Inappropriate use of contingent approval includes statements like, “Explain why participants younger than 18 years of age will be allowed to participate,” or “Provide additional justification for the use of placebo.”^[30]

Continuing Review of Research

HHS regulations at 45 C.F.R. 46.109(e) and FDA regulations at 21 C.F.R. 56.109(f) require that continuing review of research be conducted by the IRB at intervals appropriate to the degree of risk, but not less than once per year. The regulations make no provision for any grace period extending the conduct of the research beyond the expiration date of IRB approval. Additionally, where the convened IRB specifies conditions for approval of a protocol that are to be verified as being satisfied by the IRB chairperson or another IRB member designated by the chairperson, continuing review must occur no later than one year after the date the protocol was reviewed by the convened IRB, not on the anniversary of the date the IRB chairperson or his or her designee verifies that IRB-specified conditions for approval have been satisfied. Under HHS regulations, continuing review is not required for:

• Research previously reviewed under the expedited procedure;

• Research reviewed under limited IRB review;

• Research that has progressed to the point of data analysis and/or access follow-up clinical data from non-research clinical interventions.

IRB Reporting Requirements

HHA and FDA regulations^[31] require IRBs to establish and follow written procedures to ensure prompt reporting to the IRB, institutional officials, and the appropriate regulatory agency or agencies of, (i) serious and continuing noncompliance, (ii) suspensions or terminations of IRB approval, and (iii) unanticipated problems involving risks to participants and others. Neither set of regulations defines prompt reporting, serious noncompliance, nor continuing noncompliance, and it is left to local institutional policy to create and implement policies that define those specific terms.

IRB Meeting Minutes

HHS regulations at 45 C.F.R. 46.115(a)(2) and FDA regulations at 21 C.F.R. 56.115(a)(2) require that minutes of IRB meetings be in sufficient detail to show attendance at the meetings; actions taken by the IRB; the vote on these actions including the number of members voting for, against, and abstaining; the basis for requiring changes in or disapproving research; and a written summary of the discussion of controverted issues and their resolution. Thus, per regulations these five items must be documented in IRB meeting minutes.

Moreover, a final guidance document, titled “Minutes of Institutional Review Board (IRB) Meetings—Guidance for Institutions and IRBs,” which was prepared jointly by the OHRP and FDA,^[32] describes requirements for developing and maintaining IRB minutes and provides recommendations for meeting the regulatory requirements for developing and maintaining IRB minutes. Thus, in addition to the five regulatory requirements noted above, OHRP and FDA recommend that the following information be contained in IRB meeting minutes:

• IRB findings/determinations regarding whether proposed research satisfies all applicable IRB approval criteria;

• IRB findings/determinations as to whether proposed informed consent form(s) meet applicable regulatory requirements;

• IRB decisions regarding waiver of documentation of informed consent;

• IRB decisions regarding waiver or alteration of informed consent;

• IRB findings/determinations for studies involving children;

• IRB findings/determinations relating to emergency research;

• IRB significant risk/non-significant risk determinations, along with the IRB rationale for its determinations;

• IRB findings/determinations for studies involving pregnant women, human fetuses and neonates;

• IRB findings/determinations for studies involving prisoners; and

• Reports of expedited review activities that occurred outside of the convened IRB.

IRB Records

HHS regulations at 45 C.F.R. 46.115(a) and FDA regulations at 21 C.F.R. 56.115(a) provide that an institution, or when appropriate an IRB, shall prepare and maintain adequate documentation of IRB activities, including the following:

• Copies of all research proposals reviewed, scientific evaluations, if any, that accompany the proposals, approved sample consent documents, progress reports submitted by investigators, and reports of injuries to subjects;

• Minutes of IRB meetings, which shall be in sufficient detail to show attendance at the meetings; actions taken by the IRB; the vote on these actions including the number of members voting for, against, and abstaining; the basis for requiring changes in or disapproving research; and a written summary of the discussion of controverted issues and their resolution;

• Records of continuing review activities;

• Copies of all correspondence between the IRB and the investigators;

• A list of IRB members;

• Written procedures for the IRB; and

• Statements of significant new findings provided to subjects.

HIPAA Privacy Board

The Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule establishes the conditions under which protected health information (“PHI”) may be used or disclosed by covered entities for research purposes. Under the Privacy Rule, covered entities are permitted to use and disclose PHI for research in accordance with an individual’s signed authorization, which may be incorporated into a research informed consent form or without individual authorization under limited circumstances.

Commonly, IRBs act as a privacy board for HIPAA-related research issues. The privacy board reviews and approves the proposed access, use, and disclosure of the PHI. As a privacy board, the IRB is responsible for determining whether research subjects are required to sign an authorization for the use and disclosure of their PHI, or if one of the exceptions to the authorization requirements applies. Examples of these exceptions include waivers of authorization and the use of de-identified data or limited data sets.

Harmonization of a Clinical Trial Agreement with IRB Approved Informed Consent

Both FDA and HHS informed consent regulations require IRBs to approve consent forms that, among other things, include information that, (i) describes additional costs that study participants might incur and (ii) describes available compensation for study-related injuries and complications.^[33]

The provisions related to subject injury and costs to participants are set forth in the terms and conditions of the clinical trial agreement (“CTA”) and study budget. To fully understand potential costs that research participants may incur, a coverage analysis or other procedures that document costs to participants should then be performed.^[34] Negotiation of CTAs, budget development, and coverage analysis are procedures performed as part of research administrative pre-award processes. To meet applicable informed consent requirements, procedures should be developed to ensure that the final CTA, budget, and coverage analysis are shared with select representatives from the IRB. IRB staff, pre-award personnel, or others should then reconcile these documents to ensure harmonization of subject injury and cost to participant language with the corresponding sections in the informed consent.

Investigator Training and Education

Although not required by regulation, OHRP recommends that FWA holding institutions establish training and oversight requirements and mechanisms to ensure that investigators maintain continuing knowledge of, and compliance with:

• relevant ethical principles;

• relevant federal regulations;

• written IRB procedures;

• OHRP guidance;

• other applicable guidance;

• state and local laws; and

• institutional policies for the protection of human subjects.^[35]

Most institutions that support human research establish training requirements for investigators. Frequently, institutional responsibility for administrative oversight of these training requirements reside in the IRB office and completion of assigned training is a prerequisite that must be completed prior to submission to the IRB.

Managing Noncompliance

IRBs are frequently relied upon to manage allegations of noncompliance. Specifically, in response to an allegation of research noncompliance the IRB office will coordinate the investigation and then present its findings to the IRB committee for review, determination and management. In essence, IRB committees frequently serve as research compliance oversight committees.

Conflicts of Interest

The purpose of the regulations at 42 C.F.R. § 50 Subpart F, Promoting Objectivity in Research, are to promote objectivity by establishing standards for preventing financial conflicts of interest (COIs) having an impact on the design, conduct, and/or reporting of research funded under Public Health Service grants. These standards are intended to ensure that investigators’ work will be free of bias resulting from COIs. Many institutions that support human research apply the requirements of 42 C.F.R. § 50 Subpart F to all research, regardless of the funding source.

At a minimum, the IRB should receive a copy of COI management plans during its review of research. At some institutions, personnel from the IRB office are required to serve as the COI program administrator, while at other institutions, the IRB committee is required to serve as the research COI committee.