Two basic approaches exist for ensuring compliance with human subject regulations. The FDA uses a system of inspections and audits; other DHHS components rely prospectively on Assurances of compliance that are negotiated with institutions by OHRP. This divergence in approach reflects the respective agencies' mandates: the FDA is regulatory (it regulates the pharmaceutical, biologic and device industry, whether or not those substances or devices are used for research purposes, as well as the marketing and use of investigational drugs); other DHHS agencies, such as National Institute of Health (NIH), are research-supporting. The FDA’s regulations provide specific administrative action and sanctions for noncompliance. This section deals primarily with compliance under DHHS regulations.
An Assurance is a written document negotiated with OHRP on behalf of the Secretary of DHHS. According to DHHS, the Assurance sets forth the means by which an institution will comply with DHHS regulations. Assurances are given as a condition of receipt of DHHS support for research involving human subjects. An Assurance approved by OHRP commits the institution and its personnel to full compliance with the DHHS human subject regulations.
While recognizing both individual and institutional responsibility for compliance with the regulations, OHRP generally negotiates Assurances only with institutions, which are ultimately responsible for ensuring that the regulatory requirements are met. Investigators and IRBs, however, also retain responsibility for complying with the regulations.
B. IRB Considerations
1. The Regulations DHHS regulations (and those of any other department or agency that has adopted the Federal Policy) require that CSU follow written procedures for ensuring that serious or continuing noncompliance with the regulations or the requirements or determinations of the IRB will be reported to the IRB, appropriate CSU officials and the head of the department or agency supporting the research. The FDA requires that such reports be made to the IRB, appropriate institutional officials and the FDA. CSU is responsible for establishing the mechanism through which instances of noncompliance will be reported to the department or agency. The FDA interprets the law to require that the IRB itself notify the FDA of instances of noncompliance if such reporting would not otherwise occur.
2. Internal Methods for Ensuring Compliance To ensure compliance with the regulations, CSU has adopted internal audit or self-assessment procedures and practices designed to assure proper protocol and consent document preparation, protocol submission, review and approval by the IRB and timely monitoring of protocol implementation. One example is the use of expiration date stamps on consent documents and protocols to ensure that the federal requirement of at least annual IRB review of each protocol is met. A second example is the use of standardized language, endorsed by CSU, which meets the regulatory requirements and which is customized and elaborated upon by the investigator in creating an appropriate informed consent document.
3. External Audits and Site Visits CSU is committed to regulatory compliance that is fostered by routine site visits and audits conducted by federal officials. The IRB cooperates fully with the FDA on-site inspections of IRB minutes and records and OHRP occasional site visits to assess the adequacy of CSU’s IRB procedures for protecting human research subjects. In addition, the IRB cooperates with sponsors of research, such as the National Cancer Institute, and cooperative group research organizations, such as the Eastern Cooperative Oncology Group (ECOG), which regularly audit their research performance sites. IRB minutes and records for conformance with applicable regulations are available for review by the pertinent groups. The IRB shares results of these audits OHRP and the FDA as the on-site assessments are designed principally to instruct and educate.
4. Investigations into Alleged Noncompliance The IRB cooperates with warranted inquiries or investigations into alleged noncompliance with federal regulations by the FDA and OHRP. The need for site visits in connection with inquiries and investigations depends upon the seriousness and urgency of the circumstances, and whether on-site involvement is the most effective means of resolving the questions of noncompliance that have been raised.
Federal inquiries and investigations into alleged noncompliance with the regulations are not undertaken lightly by CSU and the IRB. Because experience has shown that these efforts are usually initiated in response to credible reports of inappropriate involvement of human subjects in research, the IRB facilitates inquiries and investigations into alleged noncompliance. Such reports can come from any source: IRB members, investigators, subjects, institutional personnel or the media.
The FDA follows specific regulatory and administrative procedures regarding its determination of noncompliance, the imposition of sanctions and appeal mechanisms. See for example, FDA Compliance Program Guidance Manual, Chapter 48 - Bioresearch Monitoring.
DHHS regulations do not specify administrative actions for noncompliance with the human subject regulations, except to state that material failure to comply with the regulations can result in termination or suspension of support for department or agency projects, and that DHHS will take terminations or suspensions of funding due to noncompliance into consideration when making future funding decisions. Appropriate OHRP procedures are as follows:
• When OHRP initiates a compliance oversight evaluation, appropriate CSU officials are so advised, and they are informed as to the likely administrative course of events. Activities expected of CSU are carefully explained initially and at appropriate times during the course of the evaluation. Except in rare circumstances when sound ethics dictate the need to act immediately, OHRP will take no action against CSU without first affording CSU an opportunity to offer information that might refute or mitigate adverse determinations. In all cases, appropriate CSU officials are afforded an opportunity to comment in writing before OHRP issues its findings.
Under DHHS regulations, documents related to compliance oversight evaluations may be subject to the provisions of the Freedom of Information Act (FOIA). In most cases, such documents are exempt from the disclosure provisions of the FOIA while the evaluation is in progress, and OHRP treats them with confidentiality. However, OHRP routinely advises appropriate DHHS officials concerning the status of its evaluations and may be required to inform members of Congress. Most documents related to compliance oversight evaluations become publicly available under the FOIA when OHRP issues its findings.
Under DHHS regulations, records which can be retrieved by an individual's name or other personal identifier are subject to the provisions of the Federal Privacy Act. Information regarding OHRP's compliance oversight activities is maintained only in a system of records identifying the institution under evaluation. Records are retrieved by institutional name or Assurance number. OHRP maintains no system of records related to compliance oversight activities through which records can be retrieved by individuals' names or other personal identifiers.
OHRP's compliance oversight evaluations may result in one or more of the following outcomes: • OHRP does not identify any areas of noncompliance with the DHHS regulations. • OHRP does not identify any areas of noncompliance with the DHHS regulations, but recommends improvements to CSU’s human subject protection policies and procedures, such as better documentation of actions or communications in IRB protocol records, or clearer description of operational details in IRB written procedures. • OHRP determines that CSU’s policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the DHHS regulations and, as a result, requires that CSU develop and implement corrective actions. Examples of corrective actions that institutions have undertaken to address OHRP findings include:
- re-review by the IRB of research for which IRB determinations required for approval were not previously made;
- implementing a new IRB database management strategy to ensure timely continuing review or review of amendments; and
- increasing education and training for investigators and IRB members.
• OHRP determines that CSU’s policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the DHHS regulations and, as a result, restricts or attaches conditions to its approval of CSU’s Assurance based on the nature and scope of CSU’s noncompliance. Despite such restrictions, OHRP allows affected research projects to continue if CSU satisfies the terms of the restriction or conditions placed upon research activities, and if the continuation of those activities is consistent with the best interests of the research subjects. Examples of such restrictions include, but are not limited to:
- requiring special reporting (such as quarterly reports) to OHRP;
- requiring that IRB members, institutional officials, investigators or others receive appropriate education and training regarding human subjects research protections;
- requiring prior OHRP review of some or all research projects to be conducted under the Assurance; and
- suspending all research currently conducted under the Assurance until specified protections or corrective actions have been implemented.
• OHRP determines that CSU’s policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the DHHS regulations and, as a result, withdraws its approval of CSU’s Assurance. CSU’s research projects cannot be supported by any DHHS component until OHRP approval of the Assurance is reinstated. • OHRP determines that CSU’s policies and procedures for protecting human subjects, either for specific research or for all research, are NOT in compliance with the DHHS regulations and, as a result, recommends to appropriate DHHS officials:
- that CSU or an investigator be temporarily suspended or permanently removed from participation in specific projects, or
- that DHHS scientific peer review groups be notified of CSU’s or an investigator’s past noncompliance prior to review of new projects.
• OHRP determines that CSU’s policies and procedures for protecting human subjects under CSU’s Assurance, either for specific research or for all research in general, are NOT in compliance with the DHHS regulations and, as a result, recommends to appropriate DHHS officials or Public Health Service agency heads, that institutions or investigators be debarred in accordance with the procedures specified at 45 CFR part 76. Debarment is a government-wide sanction.
5. Noncompliance by Investigators, IRBs, and Institutions
a. Investigators Research investigators are the most frequent source of noncompliance with human subject regulations. The most common lapses in investigator compliance include unreported changes in protocols, misuse or nonuse of the informed consent document and failure to submit protocols to the IRB in a timely fashion. Problems such as these are often caused by communication difficulties. With investigator goodwill, these cases can be resolved by the IRB without jeopardizing the welfare of research subjects.
Occasionally, an investigator will either avoid or ignore an IRB. Such cases present a more serious challenge to the IRB and to the institution. Regardless of investigator intent, unapproved research involving human subjects places those subjects at an unacceptable risk. When unapproved research is discovered, the IRB and CSU should act promptly to halt the research, assure remedial action regarding any breach of regulatory or CSU human subject protection requirements and address the question of the investigator's fitness to conduct human subject research. Beyond the obvious need to protect the rights and welfare of research subjects, the credibility of the IRB is clearly at stake. In addition, any serious or continuing noncompliance with DHHS human subject regulations or the determinations of the IRB must be promptly reported to OHRP or the department or agency head.
b. IRB’s IRB noncompliance occurs whenever the IRB deviates from the duties imposed upon it by the federal regulations. Such deviations include the inadequate review of research protocols by failing to ensure that the consent document and process provide sufficient information to allow prospective subjects to make an informed decision whether to participate in the research, failing to ensure that the research design includes adequate monitoring of the data and any additional safeguards necessary to protect the welfare of particularly vulnerable subjects and failing to conduct continuing review of research at intervals appropriate to the degree of risk. To meet regulatory responsibilities, the IRB must maintain adequate records of IRB business and hold their meetings with a majority of members present, including a nonscientific member. A demonstrated inability to carry out IRB responsibilities in accordance with DHHS regulations can be cause for the suspension or withdrawal of approval of an institution's Assurance.
c. Institutions Although CSU is accountable for the actions of individual investigators and the IRB, institutional noncompliance is more broadly described as a systemic failure of CSU to implement practices and procedures contained in CSU's Assurance. Prime examples are the failure of CSU to ensure that the IRB is appropriately constituted and functions in accordance with the regulations, that the IRB receives appropriate institutional support and staffing and that investigators meet their obligations to the IRB. Systemic failure to abide by the terms and conditions of CSU's Assurance will result in withdrawal of approval of the Assurance.