IRB: Ethics & Human Research

Informational Risk, Institutional Review, and Autonomy in the Proposed Changes to the Common Rule

In 2011, the U.S. Department of Health and Human Services (HHS) proposed changes to its regulations governing research with humans (the Common Rule), which apply to all federally funded research. The proposed changes represent a valuable step in updating regulatory protections for research participants to reflect challenges that have arisen over the last 30 years.¹Efforts to streamline the research review process by shifting the attention of institutional review boards (IRBs) to the riskiest research and away from low- to minimal-risk studies are necessary in order to reduce unnecessary regulatory burden and to more efficiently expend limited institutional resources.

A key feature of the proposed regulatory change is to have the Health Insurance Portability and Accountability Act’s Privacy Rule (HIPAA Privacy Rule) serve as the policy for protecting research data. Standardizing how data are protected is, on the face of it, a rational and efficient change. As it now stands, there are multiple approaches that vary between the clinical and research settings and that generate additional inefficiency and friction along the already blurred lines between research and treatment. However, it is dangerous to conceptualize risk as largely restricted to the economic or social consequences of having one’s private data made public, or even to the breach of privacy from the release of health-related information alone. We argue that there are negative consequences to adopting the HIPAA Privacy Rule’s narrow focus on informational, rather than participatory, risk to research participants.

As a clinical standard, the HIPAA Privacy Rule conceives of risk to the individual as stemming exclusively from the inadvertent or unwilling release of a patient’s protected health information. Moreover, the Privacy Rule is based on the assumption that by signing an authorization permitting the use and disclosure of their protected health information, individuals have agreed to accept the risk of any harm that flows from disclosure. The idea that risk and harm to research participants are limited to the release of information is reflected in the proposed changes to the Common Rule. For example, the proposed rule would remove the need for ongoing consent from research participants as long as their personal information is maintained in a secure fashion and not returned to them. Thus, biospecimens collected for one study will be available for use in any other study, provided blanket consent for their use has been provided. Ironically, adopting the HIPAA Privacy Rule’s view of risk would exacerbate divergence with the Common Rule because the two rules treat blanket consent differently: whereas blanket consent for biobank research with identifiable information is permitted under the Common Rule, it is prohibited by the HIPAA Privacy Rule.

A second example of the focus on informational risk is the proposed rule change affecting social and behavioral research. The proposed changes would remove the need for IRB review of studies using specific social science methodologies even if information is potentially damaging to the individual and is stored in an identifiable way. The implication is that certain behavioral research methodologies—including surveys, interviews, and focus groups—cannot generate risk as long as the participants are competent adults. Any informational risk that may result from such studies is assumed to be covered by compliance with the standards of the HIPAA Privacy Rule.

It may be true that the primary concern of most individuals who participate in research—particularly when that participation involves the collection and storage of biospecimens—is to avoid stigma or discrimination adhering to the release of incidental information about their health status or that of their family members. But this is not the only concern. As the recent court settlement in the caseHavasupai Tribe v. Arizona Board of Regentsdemonstrated, some research participants have serious concerns about the use of their biospecimens that are not limited to the release of identifiable information.²In this case, the Havasupai tribe sued the University of Arizona for permitting the use of individual tribal members’ stored DNA samples in studies of schizophrenia and ancestral migration. The Havasupai were concerned not just that their tribe may have been identifiable based on supposedly anonymized biospecimens and data, but that their biospecimens had been used, without their consent, for research that ran counter to important cultural and religious tribal values.³Likewise, many parents have raised objections in several lawsuits to research with their child’s residual newborn screening blood sample without their consent. They claim that without consent, research with their child’s sample violates parents’ right to control the use of their child’s biospecimens.⁴

The proposed changes to the Common Rule do not address these problems. Instead, they suggest that the acquisition of blanket consent on collection would permit unlimited use of biospecimens and data for all possible projects. But the effectiveness of blanket consent is contested.⁵As with the Havasupai tribe, many individuals give biospecimens to a specific research project and assume that research with their biospecimens will be limited to that project. Unless individuals have sophisticated knowledge of scientific research, they will be unable to conceive of every possible use of their biospecimens and cannot give informed consideration to whether they are willing to provide their biospecimens for any type of research. At least on a philosophical level, it is possible to violate an individual’s autonomy even if he or she is unaware that the violation has happened, and that it runs counter to the ethical principle of respect for persons.

A further unintended consequence of the proposed regulatory changes is that removing IRB review from studies that do not intend to return individual results to participants creates a strong disincentive to do so. If researchers are given a choice between designing a protocol that returns results and one that is excused from the IRB review process, it seems clear where the incentives lie. In the long term, one can imagine a situation in which a majority of genomic research projects return no results to their participants even if those results reveal information that has life-threatening consequences and are clinically actionable. Creating such incentives runs contrary to the emerging consensus in the research and policy community; several groups have concluded that researchers may be obliged to return at least some results, especially those that may have direct health benefits.⁶