Abstract
The entire human research infrastructure is under intense and increasing financial pressure. These pressures may have been responsible for several errors in judgment by those responsible for managing human research and protecting human subjects. The result of these errors has been some terrible accidents, some of which have cost the lives of human research volunteers. This, in turn, is producing both increased liability risk for those who manage the various aspects of human research and increasing scrutiny as to the capability of the human research protection structure as currently constituted. It is the author’s contention that the current structure is fully capable of offering sufficient protection for participants in human research–if Institutional Review Board (IRB) staff and members are given sufficient resources and perform their tasks with sufficient responsibility. The status quo alternative is that IRBs and their members will find themselves at great risk of becoming defendants in lawsuits seeking compensation for damages resulting from human experimentation gone awry.
[See related article: 4]
INTRODUCTION
The market pressure in the healthcare industry is tremendous. Trillions of dollars are available and millions of lives are at risk every year. The healthcare industry, currently a $1.3 trillion industry, is predicted to grow from its current 13% of GNP to 16% by the year 2010.1 The pressure on industry components to get into this marketplace is exceptional, whether you are speaking about physician practices, hospital systems, or pharmaceutical companies. All have various hurdles to overcome in their efforts to win a piece of this market. In general, those facing the pharmaceutical system are no more difficult than those facing other components. However, it is the fact that the pharmaceutical system must use humans as guinea pigs in accumulating the information necessary to place its new products into the market, or reposition existing products, which puts a special slant on the pharmaceutical industry’s product development efforts.
The primary institutional structure that has been placed between the pharmaceutical industry and those very human guinea pigs is the Institutional Review Board (IRB). It is the IRB that is hit with the pressure from both sides. It is hit with the pressure from the industry to get these products to market as soon as is possible with as advantageous as possible of research data. It is hit with the pressure from society to take the time and effort needed to adequately protect the research participants from unrecognized or unreasonable harm. It is at this point of conflict that IRB members will either raise themselves up to meet the challenge or, if they do not, the IRB system will be properly swept away.
There are few other settings in American industry in which volunteers are so necessary for product development. They are, of course, required to participate in pharmaceutical product and medical device development and that participation can expose the participant to the risk of harm or even death. The reason for this participation is the emphasis we have placed on obtaining evidence as to the safety and efficacy of the drug prior to its general use. It is particularly ironic, given tremendous emphasis on proof of safety by the medical regulation bureaucracy, that in several well publicized research deaths, it has been evident that the devices in place help insure the safety of the participant have been ignored.
It is not that the idealized version of the safety techniques was shown to be inadequate, but that portions of it were simply countermanded or blatantly ignored. The deaths of Jessie Gelsinger and Ellen Roche did not point up any inadequacies codified within the federal rules, but instead demonstrated what happens when the rules were not followed and the people whose job it was to maximize the protection of Jesse and Ellen did not do their jobs. Why did they not do their jobs? Undoubtedly because of the pressure that was put on them for the research to go forward.
While these cases may demonstrate the need for IRBs to scrupulously know and have the courage to fully, regularly and completely apply the federal rules to the research that it reviews, they have also opened the door for the plaintiff’s attorney to enter the human research arena. We have seen a number of lawsuits, with some settlements, based on perceived or real harm to research subjects. These lawsuits have been aimed at investigators, manufacturers, research and educational institutions, IRBs and individual members of IRBs.2 With the addition to the pressures already present in the research industry of the growth in genetic technology as a component of the healthcare market with all the concerns and unknowns inherent in genetic research and therapy, the liability risks facing IRBs will only grow. There is no doubt that the plaintiff’s bar knows about human research, its risks, and they know the federal rules.
IRB LIABILITY FOR NEGLIGENCE
In order to understand the liability risks faced by IRBs, one must understand the basics of a lawsuit based in negligence and where the legal duties involved come from.
The basis of a duty
The basic components of a lawsuit for negligence requires that a duty exist, that the person who is to meet that duty fails to do so, and that someone suffers a harm as the direct and foreseeable result of that failure. The first question is whether there is a duty, in a legal sense, which IRBs must meet. A duty is not the same as a responsibility. For example, we may feel that as human beings we have a responsibility to offer assistance when we find someone in danger. However beneficial that sense of responsibility may be, there is, for most of us, no legal duty to rescue someone in danger. Although IRBs have responsibilities under the federal rules and elsewhere, there may not be a legal duty that IRBs must meet. It should be recognized that this is different than for the investigator. The direct relationship between the investigator and the participant allows for a variety of legal duties to be used as the basis for a lawsuit.3
The definition of a duty is an obligation, to which law will give recognition and effect, to conform to a particular standard of behavior or conduct towards another. We are probably all familiar with the duty of physicians to practice to the level of the standard of practice for physicians generally. A failure to practice at that level, if that failure results in harm to a patient, is the basis for a medical malpractice claim. Finding that type of requirement for IRBs in the structure of human research protection is something that the courts are beginning to do. However, there is a substantial difference in their ability to do so depending on whether the matter is in state or federal court.
State Courts
In Grimes v. Kennedy Krieger Institute, Inc.,4 a Maryland state court, although it has been criticized for doing so, honored the Nuremberg Code as “the most complete and authoritative statement of the law of informed consent to human experimentation”.5 (emphasis added) The court then goes on to cite several authors to support what appears to be its general premise, that the Nuremberg Code should be incorporated into American common law jurisprudence to establish a clear set of duties as to the protection offered the subjects of human experimentation. It even offers various reasons, again citing other authors, as to why it was not so incorporated, clearly suggesting that these reasons are not valid.
This is a critical step, for if other courts accept this reasoning and begin to cite the Nuremberg Code as being incorporated into American common law; this acceptance will create a legal duty for investigators and IRBs to meet the terms of the Code. The establishment of the Code, or the Helsinki accord, or another such declaration as the standard by which IRBs and investigators are going to be measured in their application of the federal or institutional rules can have substantial impact on the risk faced by IRBs for their action.
The court did find that the same duty could arise from the federal regulations themselves, but was not satisfied to find that alone and, instead, went further to find the duty in the broader language of the Code. One likely reason it did so was federalism. A tort action, such as the one heard in Kennedy Krieger is typically heard under state law. There is a conflict of laws in finding that federal law or regulation can establish a duty under state law. That would require forcing one sovereign, a state, to accept the dictates of a second, the federal government. To avoid this, the court, a Maryland state court, had to find something specific in state law, which it could not in the case of Maryland law, so it had to turn to some overarching statement such as the Code. The weakness, and something the court itself noted, is that in reality the Code has no legal standing in the United States. It has never been ratified as an international treaty or otherwise codified in this country. So, to say the least, the court is on soft ground in its determination.
Federal Courts
As a result of this difficulty, several cases have been brought in federal court, arguing various legal theories. Some have examined the role of the Nuremberg Code and have come to the opposite conclusion as the Kennedy Krieger court. In Heinrich v. Sweet,6 the court examined the use of the Nuremberg Code in both the In re Cincinnati Radiation Litigation and a U.S. Supreme Court case entitled U.S. v. Stanley. Both were concerned with military research misconduct. Neither court cited the Code as a basis for a cause of action, but only discussed it in its historical context and, at best, that the Code meant that the Constitutional right to due process of laws guaranteed a right to informed consent for the injured military plaintiffs.7
While several cases have alleged IRB failures but did not directly name the IRB in the action,8 there has only been one case, Robertson v. McGee,9 in which the plaintiff specifically named the IRB as a defendant in the lawsuit. In Robertson, the basis for the complaint is an alleged breach of the duty owed as a result of the federal research regulations. Specifically, the complaint alleges that IRB members failed to examine the design of the protocol, review the operation of the trial, review proposed amendments to the informed consent forms, review amendments to the protocol, and ensure proper reporting.10 All these allegations derive directly from failures to follow the federal rules, something that could be done here because the case is in federal court. In a nutshell, the IRB is alleged to have not done its job, particularly in the too broad use of expedited procedures, and that it did not document sufficient review of the research, which are all duties and responsibilities laid down by the federal rules. Presumably, if the Robertson case is successful, you will see future actions against IRBs in federal courts using the federal rules as the guide to the duties owed.
As an aside, one theory that may be used involves the Federal Wide Assurance (FWA). In the FWA, IRBs–and the institution generally–assure that they will apply the Common Rule standards to all research, regardless of funding. That assurance could be the basis for a suit that is based on a failure to properly apply the federal regulations to a research protocol regardless of the source of the funding for the research. There is no doubt that plaintiffs’ attorneys will continue to seek legal bases for actions against IRBs and will attempt other creative approaches to do so.
Lack of truly informed consent
Probably the most obvious place to start with an action against an IRB is with a failure to ensure that truly informed consent was obtained. In both the Gelsinger and Roche matters, the IRBs are susceptible to an argument that they failed to ensure that all known risks were included in the consent form. In Gelsinger, there were allegations that the consent form failed to contain information about animal trials that had seen the death of monkeys and human trials that had demonstrated serious adverse reactions.11 In the Roche matter, it has been documented that there were significant failings to include information about the previous experience with hexamethonium, including a significant risk of side effects. In the Robertson complaint, the plaintiffs alleged a long list of misrepresentations in the consent forms, including false implying FDA approval of the vaccine, falsely claiming support for effectiveness in the animal and human data, and falsely listing potential side effects.12
It is clear from this that IRBs must realize the role they play and the fact that the information received in the protocols may be incomplete or even false. The next step is to decide just how to proceed after that realization is made. Clearly, IRBs have to professionalize their procedures and their review. Expertise must be brought to bear on the review of each and every protocol. Of course, this will cost time, money and leadership by the top levels of management.
Conflict of interest
Another area of risk concerns the proper management of conflict of interest both within the IRB and on the part of the investigator. Although the regulations ban IRB members from participating in the review of a protocol in which there is a conflict of interest, what would constitute a conflict of interest for these purposes is not defined. Traditionally, the obvious conflict that has been managed well by most IRBs is the IRB member who would directly participate in the research as a principle investigator (PI) or sub-investigator. In these situations, most IRBs have been able to identify the PI as having a conflict and have moved to exclude that person from the discussion and voting on the protocol.
Other forms of institutional conflicts have also been relatively well managed by IRBs. These include those members of the IRB who may have an interest in the protocol by dint of being a member of the same academic department. Of course, this type of conflict can be either a conflict in favor of a protocol, or against it, given the realities of the politics within academic institutions. Again, it can be relatively simple to identify this type of conflict and to exclude the conflicted member from the discussion and vote on the protocol. It is essential that these types of conflicts be noted in the minutes and the action taken to protect against the conflict documented.
However, there are less obvious, but probably more critical, conflicts that must also be guarded against, and these involve financial interests. The financial conflicts that may be seen involving investigators or IRB members can be substantial in today’s environment, particularly with cutting edge genetic or other biotechnology. Financial conflicts have been noted at the base of several of the recent research-related lawsuits, including Gelsinger and Berman. These do not simply involve potential financial conflicts involving the investigator or IRB members. In Berman, the plaintiffs alleged an investigator had left the Hutchinson Cancer Center to start the company that would investigate and develop the product. If it were successful, the Center stood to gain $20,000 in stock and a $50,000 licensing fee, which would increase to $100,000, plus a percentage of the sales of the company.13 The dollars potentially available in the gene therapy associated with Jesse Gelsinger’s death were even much greater:
The director of the Institute that conducted the research, James M. Wilson, was identified as having a conflict of interest because he owed stock in Genovo, the company that financed research at the Institute. Both Wilson and the former dean of Pennsylvania’s medical school had patents on some aspects of the procedure. Subsequently, Wilson admitted ‘he would gain stock worth $13.5-million from a biotechnology company in exchange for his Genovo stock’. In addition, the University’s contract with Genovo gave the company rights to gene research discoveries at the Institute in exchange for substantial financial support. The University’s equity interest in Genovo has been valued at $1.4 million dollars.14
These sorts of dollar will create substantial pressure on IRBs to get the protocols through or to just get out of the way. It is this sort of financial conflict that IRBs must be prepared to face. While some of these financial conflicts will be obvious, others may not. One issue for IRBs is to decide when a financial connection creates a conflict worthy of remediation
There is a definition in the federal regulations having to do with research funding from a public health services agency, which includes National Institutes of Health (NIH), which may be useful for IRBs. This regulation defines a conflict of interest as existing when “a Significant Financial Interest could directly and significantly affect the design, conduct, or reporting of ” the research.15 In turn, a “Significant Financial Interest” means “anything of monetary value, including but not limited to, salary or other payments for services (e.g., consulting fees or honoraria); equity interests (e.g., stocks, stock options or other ownership interests); and intellectual property rights (e.g., patents, copyrights and royalties from such rights.”16
These regulations lay out several methods by which to manage this sort of conflict:
-
♦ Public disclosure of financial interest.
-
♦ Monitoring of research by independent reviewer.
-
♦ Modification of the research plan.
-
♦ Disqualification from participation in all or a portion of the research funded by the Public Health Service (PHS).
-
♦ Divestiture of the Significant Financial Interest.
-
♦ Severance of relationships that create the conflict.17
-
♦ Office of Human Research Protection (OHRP) has published a draft interim guidance on financial relationships18 but a final version has not yet been published.
Dignitary actions
The other basis for a cause of action that has been used in several cases, including Berman, Robertson, Davis and Wright, is a claim for dignitary damages; that is, that the negligence was a failure to treat the individual participants with the proper human respect.19 Although we might all agree that the IRB and the investigator owes the study participants the proper degree of human respect as a matter of course, it remains an open question whether a legal duty exists to do so, what the definition of respect is, and what it means to breach that duty. The plaintiffs in those cases argued that the duty, as was the case in Kennedy Krieger, arose from the various declarations of human rights including Nuremberg and Helsinki. Again, the question is raised as to what is the role of the Nuremberg Code and other such documents in American tort law. It is only by finding a legal duty similar to or from within the Nuremberg Code can the court then move on to find that a breach of this duty of dignity owed is compensable. Again, the aggressive finding of the Kennedy Krieger court could have ramifications here if it’s holding is mimicked by other courts.
HIPAA as a Cause of IRB Liability
Health Insurance Portability and Accountability Act (HIPAA) has created new requirements for the protection of the identifiable health information that is either used in a research project or generated as a part of the human research.20 Covered entities, i.e., health care providers that either use protected health information (PHI)21 for human research or generate PHI in the course of human research must obtain an authorization under HIPAA for the use or disclosure of that information for any use other than treatment, health plan operations or payment. Each authorization must include the components delineated in 45 CFR 164.508(c) and (d) and can be limited or rescinded at any time after initially signed. These new requirements increase the information that IRB is responsible for ensuring is provided to the participant and substantially increases the monitoring responsibilities of the IRB. A failure by an IRB to ensure that the HIPAA guidelines are followed could result in liability for that IRB if unauthorized releases of PHI occurred.
Proposed changes to HIPAA were announced on March 25, 2002, and they do include some changes to the research-related areas of HIPAA. Specifically, under the proposed new regulations, the authorization requirement may be waived entirely if:
-
♦ The research is no more than minimal risk and:
An adequate plan to protect the identifiers from improper use and disclosure and to destroy the identifiers at the earliest opportunity is in place (except that the identifiers need not be destroyed if there is a health or research justification for not doing so, or if retention is required by law).
Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by these regulations.
-
♦ The research could not practicably be conducted without waiver.
-
♦ The research could not practicably be conducted without access to and use of PHI.
Some changes to the form of the authorizations were also included:
-
♦ One form may be used for all authorizations.
-
♦ Research-related treatment may be conditioned on obtaining the requested authorizations.
-
♦ Authorization and consent may be the same document.
-
♦ Expiration dates are needed for authorizations.
“End of research study” is acceptable
“None” is acceptable only if the information will be used to create or maintain a research database or repository
Transition provisions:
-
♦ Covered entities (providers, health plans and clearinghouses) may use and disclose PHI created or received as a result of a treatment-based or records-based research study if one of the following was obtained prior to the entity’s HIPAA compliance date.
An authorization
A signed, express legal permission to use the information for the study
Informed consent
An IRB waiver of the informed consent requirement
-
♦ Covered entities may use and disclose such information regardless of whether the information was created or received before or after the compliance date.
RISK MANAGEMENT
Accreditation
Many IRBs are considering or proceeding with accreditation. The first entity to offer IRB accreditation was the Association for the Accreditation of Human Research Protection Programs (AAHRPP), established in 2001 by a consortium of several academic and research organizations.22 It declared itself open for business and ready to accept applications for accreditation in February 2002 and issued its final standards on February 22, 2002. Its web site is located at www.aahrpp.org and provides a great deal of information about the organization and its standards.
Whether or not accreditation will solve any of the greater issues with IRBs remains to be seen. None of the standards contain any new concepts or break new ground. The question remains whether or not an organization that commits to accreditation will provide its IRB and other structures with the resources needed to meet these standards and whether the IRBs and the investigators will live up to the standards, particularly when under the types of pressure discussed above.
Education of investigator and IRB members
It is obvious from the publicized events discussed above that many persons involved with research either are not aware of their responsibilities to the participants or have chosen to ignore them. One critical factor in risk management is then to assure that all involved have a thorough understanding of what the goals and standards are that they should seek to abide by, particularly the IRB membership. Education of the IRB members should be an ongoing process, not only due to the turnover of membership, but just to remind each member what the obligations of the IRB are. The currently required educational process is a start, but cannot be viewed as adequate in and of itself, particularly if using the OHRP web site training program. This type of program, particularly if investigators are to participate, must be supported and even mandated by the institution. Without this high level commitment, there is little likelihood of adequate investigator participation.
A second aspect to this understanding is the knowledge base contained within the IRB. The IRB must either have the expertise to understand what may be missing from a protocol or consent form, or it must seek that knowledge by the use of outside consultants in particular cases. Each protocol must be reviewed by persons with the particular expertise to fully understand the concepts within the protocol and, what is much more difficult, to understand what is not present and must be added. With the growth of highly technical research, particularly genetic research, it is not unreasonable to consider the use of multiple IRBs for different areas of science.
Compliance auditing
Each organization that manages human research should commit to a regular and routine internal audit of the entire research protection structure with the IRB and the staff at the center. Files must be examined for completeness, documentation must be present and up to date, the membership of the IRB evaluated according to regulation and to the standards of the institution, IRB minutes should be reviewed, the IRB workload examined for adequacy of the staff and committee membership, and the monitoring of ongoing studies should also be monitored. Critical self-examination can serve to highlight shortcomings and other deficiencies before a significant error occurs.
Compliance offices are becoming the norm in most research institutions, so there is a current momentum towards this sort of independent internal review by persons well schooled in regulatory compliance and analysis of conflict of interest. IRBs can hopefully take advantage of this movement to have their own processes included on the compliance officer’s agenda. Not only can compliance programs identify issues for correction and serve to educate staff members on their responsibilities, they can also have a substantial beneficial effect on federal investigators’ penalty decisions. In fact, the origins of compliance programs are found in the federal sentencing guidelines, wherein the existence of a sound compliance program provides substantial reduction in the terms of criminal sentences.
CONCLUSION
The pressure on IRBs is mounting. IRBs are being asked to review more and more research, often of an increasingly complex technical nature, often with little or no increase in staff or other resources. Investigators, under great pressure to move their research along, may view the IRB as little more than a speed bump that must be navigated. Increasingly, financial conflicts shade all these issues green. IRBs are being criticized in the newspaper, on TV and in Congress. IRB members and staff, at the center of this maelstrom, must remember the critical importance of their role and simply do their job to the best of their abilities. The protection of research participants must be the focus of all research and the IRB is the one that must keep that focus on them.
- Received July 9, 2002.
- Accepted September 12, 2002.
REFERENCES
- 1↵Leonhardt D. Healthcare as Main Engine: Is That So Bad? The New York Times, Nov. 11, 2001, at C1.
- 2↵Gelsinger v. Trustees of the Univ. of Pennsylvania, (Philadelphia Co., Penn., Co. Com. Pl.) filed 2000 Term; Robertson v. McGee, No. 4:01CV60 (N.D. Okla.) filed January 29, 2001; Wright v. Hutchinson, No. 01-2-008376 (Kitsap Co., Wash. Sup. Ct.) filed March 29, 2001; Berman v. Hutchinson, No. C01-5217 RSL (W.D. Wash.) filed May 18, 2001; Grimes v. Kennedy Krieger Inst., Inc., 782 A2d 807 (Md. 2001). See also Kolata G, Johns Hopkins Admits Fault in Fatal Experiment, New York Times, July 17, 2001, at A16.
- 3↵These have included negligence, strict product liability, fraud and misrepresentation, intentional and negligent infliction of emotional distress, battery, lack of informed consent, fraud on the FDA, violation of the Common Rule, violation of federal regulations concerning the manufacture and control of investigational biological drugs for clinical use, violations of civil rights, violation of state consumer protection laws, breach of an agreement to abide by the Belmont Report and breach of the right to be treated with dignity. Price E, and Lemons A, “Clinical Trials: Protecting the Subject, Avoiding Liability, and Managing Risk,” Health Law Digest, v.30, n.1, American Health Lawyers Association (January 2002).
- 4↵782 A2d 807 (Ct. App. MD, 2001).
- 5↵Id. at 835 (footnotes omitted).
- 6↵40 F. Supp. 2d 27 (D. Mass. 1999.
- 7
- 8
- 9↵No. 4:01CV60 (N.D. Okla., filed Jan. 29, 2001.
- 10↵Price and Lemons, at p. 5.
- 11↵Price and Lemons, at p. 6.
- 12↵Id.
- 13
- 14↵Goldner J, “Dealing with Conflicts of Interest in Biomedical Research: IRB Oversight as the Next Best Solution to the Absolutist Approach”, The Journal of Law, Medicine and Ethics, Vol. 28:4, Winter 2000, p. 379.
- 15↵42 CFR §50.605(a).
- 16↵42 CFR §50.603.
- 17↵Id.
- 18
- 19↵Priceand Lemons, at p. 7.
- 20↵45 CFR 164.508(f).
- 21↵HIPAA defines “health information” as any information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
- 22↵The Association of American Medical Centers, Association of American Universities, Consortium of Social Science Associations, Federation of American Societies for Experimental Biology, National Association of State Universities and Land-Grant Colleges, National Health Council, and Public Responsibility in Medicine and Research.
