Shifting paradigms in health services research ethics consent, privacy, and the challenges for IRBs

For decades the use of population-based records has been a fundamental resource for public health researchers. Examples abound, from cardiovascular disease,1,2 cancer,3,4 and infectious disease,5,6 whose findings demonstrated the valuable role that health records of large numbers of people have played in showing the causes of human disease and how this knowledge can help facilitate disease prevention. Health services research can point to an equally impressive (though somewhat more recent) history of success using registries and databases as the basis for important studies into the evaluation of new approaches to prevention, early intervention and treatment, and the evaluation of new methods for delivering health services.7 Databases, registries, and rosters come in varying sizes and complexities, some with historical data from patients long deceased, others that are used to recruit patients for clinical trials not yet designed, and others linked to tissue repositories that offer the prospect of deeper mining of the genetic information contained therein. Innovative and judicious use of these resources offer the prospect of better treatments, better access to health care, and better health care systems. As with all health research sponsored by or conducted in the United States, a three decade-old regulatory regime is in place to protect the rights and welfare of research subjects codified in codified in the “Common Rule” (45 CFR 46, Subpart A), the FDA's regulations for protecting human subjects (21 CFR 50/51), and more recently in the procedures to protect patient privacy detailed in the Health Insurance Portability and Accessibility Act (HIPAA). But increasingly, there are indications that this regime may present unanticipated and worrisome barriers to the conduct of research using databases, repositories, and rosters. A growing literature has emerged that has begun to characterize these barriers, some focusing on the Institutional Review Board (IRB) system generally,8,9 others focus on the challenges for IRBs reviewing health services research protocols or studies involving human biological materials,10,11 and still others on the potential/actual impact of HIPAA on research.12,13 A recurring theme in many of these reports is that impediments exist because of 2 apparently conflicting goals: the first goal is to maximize the use of existing databases (or to construct more comprehensive ones) by collecting more detailed clinical and personal information about the individuals; the second goal is the need to fully comply with existing regulations for the protection of human subjects. These goals may directly conflict in informed consent. Some researchers now wonder (and have openly discussed) the question of whether informed consent is required for database construction,14 the idea being that a reasonable regulatory interpretation of “research involving humans subjects” would entail that research does not begin the moment that people are entered into a database or roster, but rather when a specific project is designed that intends to access those people in the database. For those who believe that the moment of first contact with a patient constitutes a potential research relationship for which permission must be sought, the idea that consent can be forgone entirely would be heretical. Of course these are extremes, but the problem is still very real. Institutional Review Boards are permitted to alter or waive informed consent requirements if certain conditions are met (45 CFR 46.116(d)) but not all researchers are successful at convincing their IRBs to approve a waiver, and not all IRBs should be expected to grant one. In this issue of JGIM Benjamin Littenberg and Charles Maclean detail their experience with the Vermont Diabetes Information System and in a refreshingly insightful way show how they were able to obtain IRB approval for studies arising from this database. Their conclusion is worth noting: “It is possible to recruit a broad and representative population under current law while maintaining appropriate protections for research subjects.” They should be congratulated for recognizing that however flawed the current regulatory system is perceived to be, and however meritorious the criticisms of IRBs may be (I for one think these may be overblown), their approach shows that health services research protocols can be reviewed and approved by IRBs. So is this much ado about nothing? Hardly. There is a growing appreciation that the ethical issues associated with collection of identifiable information (whether from human biological materials for use in genetics studies, or from medical charts/records for use in health services research) are different from the issues associated with a classical randomized clinical drug trial. Our current regulatory system was built in response to the need to protect human subjects from physical harm in clinical drug trials. The “clinical trials paradigm” has, in turn, influenced the way we train and sensitize investigators and IRBs. Indeed, for database research the crucial intervention is not into the human body—with the attendant physical risks of harm—but rather accessing information contained in the database—the risks from which are more likely to be psychological, emotional, social, and economic. At the risk of overusing the word, health services research may require a new “paradigm.” Although Littenberg and Maclean were successful in proposing an approach using what they described as “little-known consent procedures authorized by HIPAA,” who is to say whether other IRBs would have come to the same conclusion to approve a similar protocol? All researchers have experienced the frustration of submitting a protocol for a multi-center study only to have one IRB approve it, another decline to approve it, and a third require extensive modifications that the other two did not. It is understandable that IRBs may reach different decisions about the same project, but the presumption is that they are interpreting the regulations and other guidance from a similar starting point. There are plenty of proposals for reform and there is evidence that federal regulators are listening and trying to accommodate these concerns. But regulatory reform can only take us so far. What may be needed is a fresh look at whether health services research is sufficiently different from traditional clinical drug trials to warrant a new approach.