The Institutional Review Board: A Necessary Bureaucracy

This article outlines the origin, purpose, procedures, and importance of the internal Kaiser Permanente (KP) committees that ensure KP's compliance with federal ethical standards for research. The article has been modified from material distributed widely to SCPMG physicians because IRBs and their federal regulatory basis are widely misunderstood.

Introduction
Bureaucracy and its associated features--filling out forms, following rules, seeking reviews and approvals--do not inspire enthusiasm. Whether its purpose is to ensure that houses are built to code, that marriages are legal, or that everyone pays their share of taxes, bureaucracy is unpopular. Indeed--and of particular relevance to those of us who seek to improve health care by conducting research--the federal requirement that research be reviewed by an Institutional Review Board (IRB, sometimes called a Committee on Human Subjects) seldom prompts the response, "Oh, good! Another bureaucracy doing its job for society!"

This article is meant to demystify IRBs by explaining their purpose, background, and the federal regulations that govern them.

Role and Composition of the Institutional Review Board
The IRB is charged with protecting the rights and welfare of people who participate in research as subjects. The IRB reviews plans for research that involves human subjects as well as the documents (eg, surveys, recruitment materials, medical and administrative records) and procedures used in research. Research reviewed by the IRB may involve use of stored or leftover tissue and blood or examination of health services research, surveys, behavioral research, or other biomedical and clinical topics.

Questions that the IRB asks about the research include:

What will happen that would not otherwise happen?
What will the researcher tell subjects about the research? Is this information accurate?
Are there risks in the research? How big are these risks? What will be done to minimize these risks? What does the researcher plan to say to potential study subjects about the risks? Is this information accurate?
Will subjects derive benefits from participating in the research? What are these benefits? What is the researcher planning to say to potential study subjects about the benefits? Is this information accurate?
Will society derive benefits from the research? How big are these benefits?
Do the benefits of the research (to subjects or to society) outweigh the risks?

According to the federal regulations, the IRB must comprise at least five members and must include at least one scientist, and at least one representative of the community who is neither affiliated with the institution nor a scientist. The IRB must be diverse in terms of ethnicity, gender, and age. Institutions may expand the committee to meet their needs for certain kinds of expertise.

Most Kaiser Permanente (KP) IRBs have more than five members. For example, the current IRB in the KP Southern California Region includes 13 members. Two are attorneys (one of whom is also a physician), five are physicians, one is a pharmacist, two are PhD researchers (one of whom is not affiliated with KP), one is both a nurse and a researcher, one is a non-KP member of the community, and one is an administrator.

Many KP Regions have their own IRB (eg, Southern and Northern California, Northwest, Hawaii, Ohio, Georgia). KP Regions that conduct research but that do not have their own IRBs obtain review from another federally approved IRB.

Why KP Research Must Be Reviewed and Approved by the IRB
All organizations that conduct federally funded research, including KP, must have an IRB-conducted review of all research. That is, IRB review is not only a KP requirement--it is federally mandated.¹ Moreover, the federal regulations are very specific about what IRBs must do to protect human subjects and to document that they are protected. The processes by which IRBs conduct their business are highly circumscribed by the regulations and do not permit much flexibility in their implementation.

Researchers are often surprised to discover that studies involving chart review and use of computerized data involve risk. Physicians are accustomed to reviewing medical records and using computerized data to manage patients without any committee's permission for these activities. However, privacy and confidentiality are at risk in studies that involve review of medical records and computerized data.

To appreciate this risk, we might imagine, for example, the case of a married person whose medical record is being reviewed in a study of syphilis. Were that person's identity to become known to his or her spouse as a result of the spouse seeing the medical record abstraction form on the desk of a researcher--a scenario which may seem improbable, even unthinkable--serious damage could result to the individual participating in the research study.

Why the Federal Government is Involved in Institutional Research Review
The federal requirement for review of research by an IRB stems directly from experiences in what is known as the Tuskegee Study.² In that federally funded study, a large number of poor, black, syphilitic men were studied for several decades to determine the natural history of untreated syphilis. Although the diagnosis of syphilis was made before treatment for syphilis was available, the men were not offered treatment with penicillin even after it became available. Worse, the men were not told that they were subjects in a research study. Many men in the study died from complications of syphilis.

When this breach of ethics became publicly known in the mid-1970s, the federal government imposed the legal requirement that federally funded research be subject to an external process of review and approval. The government also applied the same processes and standards in requiring that all institutions accepting federal research funds review all research conducted at or by that institution, regardless of the funding source.

Identifying Activities that Require IRB Review
The definition of research is not as easy to apply in practice as it is to present on paper. The federal regulations define research as "...a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge."³

Studies that involve experimental drugs, devices, and procedures obviously qualify as research, but many other activities also qualify as research under these regulations and therefore must be reviewed by an IRB. For example, studies that involve patient interviews, follow-up contact with patients to determine effectiveness of a program or treatment, chart review, analysis of computer-stored clinical and administrative data, and mailed questionnaires must be reviewed and approved by the IRB if they meet this definition. Moreover, projects require IRB review and approval if information from them will be published in a scientific journal or presented at a scientific meeting. Because publication implies an intent to contribute to generalizable knowledge, such projects qualify as research under the federal definition. Accordingly, an increasingly large number of medical journals require documentation of review by an IRB as a condition of publication. IRB approval cannot be obtained retrospectively, and failure to obtain IRB approval when it is needed can jeopardize publication.

Marketing surveys do not require IRB review and approval, because contracts with member groups specifically allow members to be contacted without such approval and because these surveys do not contribute to generalizable knowledge. For the same reason, surveys that assess patient satisfaction with care do not require IRB review and approval. Surveys of utilization
and quality of care do not require IRB review and approval if the purpose of obtaining the information is to guide marketing decisions and to help make decisions about how to improve quality of care. However, some projects that are done with the intent to improve patient care may qualify as research. The distinction between research study and projects intended to evaluate and improve quality of care is not always clear.

Any project that involves randomization of patients to different interventions must be reviewed by the IRB--even if the project is a quality improvement project--because random assignment is, by definition, an experiment and is thus research.

The distinction between a quality improvement project and a research study can be blurred. When an investigator has doubt about whether a project is research, it is important to consult with a representative of the institution's IRB. Obtaining IRB review for a project prevents future problems and protects not only the investigator but KP and its members. If a project needing review and approval did not obtain them, the consequences could be serious.

Brief Outline of IRB Procedure
Different IRBs choose to implement the federal regulations somewhat differently. At some IRBs (eg, the KPNC IRB), researchers come to the IRB meeting to present their proposal and to discuss approaches to protecting human subjects. Other IRBs (eg, the KPSC and KPNW IRB) conduct their review solely on the basis of written documents. All IRBs require a written description of the study protocol and the researcher's description of how the rights of human subjects will be protected.

Before the IRB reviews the protocol to determine whether human subjects are adequately protected, the IRB obtains an assessment of the scientific merit of the project. This review aids in assessment of overall risk/benefit ratio of the research. (The risk/benefit ratio of research is infinite if the benefit of the research is zero.) Some IRBs (eg, the KPNC IRB) rely on special committees of internal scientific reviewers to conduct scientific review of projects to be conducted in the KPNC Region. The IRB in KPSC solicits scientific review from experts for some protocols and uses standing committees for others. Some IRBs accept federal funding as evidence of scientific merit.

After reviewing the protocol, the IRB assesses level of risk to subjects, the measures that can be taken to minimize these risks, whether the benefits of the research outweigh the risks, and whether the research includes procedures that adequately protect human subjects. If the overall benefits of the research outweigh the risks given the procedures to be used for protecting subjects, the IRB approves the research.

Levels of IRB Review
The risk created by the research determines the level of review for which a study is eligible. Federal regulations recognize three levels of review: full committee review, expedited review, and administrative certification of exempt status.

IRBs are not required to use the expedited review process, and the level of review required for any specific proposal is determined by the IRB. The process used for each level of review varies slightly from IRB to IRB. To give readers a general idea of what each level involves, Figure 1 describes the process and timing for each level of review at the KPSC IRB.

Full Committee Review
Studies that involve "more than minimal risk" must undergo full committee review, which is a review conducted by the full IRB at its in-person meeting. These studies include studies of experimental drugs and studies involving devices not approved by the FDA. IRBs may select for full committee review other kinds of studies, including ones that qualify for expedited review under the federal regulations (see next section).

Full committee review by the IRB results in one of the following outcomes:

Approval of the study as submitted;
Approval of the study contingent on changes in study protocol or in procedures for protecting human subjects;
Deferral of the study to amplify or clarify information contained in the protocol, procedures for protecting human subjects, or both;
Disapproval of the project for conduct in KP because the balance of risks and benefits is not appropriate, because subjects are not adequately protected, or because of concerns about conflict of interest.

IRB approval is faster if time is taken to consult with experts to be sure that everything needed by the IRB has been received. When research involves physical risks (for example, when an experimental drug will be used), it is worthwhile to get opinions from others about the procedures for minimizing risks.

Expedited Review
Studies that involve no more than minimal risk are eligible for review by the expedited mechanism. This review is generally faster than full committee review and may be completed in one month. (Delays occur if the study is referred for full committee review.) Expedited review is done by the Chair of the IRB, his or her delegate, or by a subcommittee of one, two, or three regular IRB members who provide their recommendations about approval of the study outside an official meeting.

Table 1 describes the kinds of research that has been defined as having "no more than minimal risk" and that are therefore eligible for expedited review. Studies that rely wholly on chart review or that use computerized data are examples of studies that usually involve "no more than minimal risk" and that are therefore eligible for expedited review.

Expedited review by the IRB Subcommittee results in one of the following outcomes:

Approval of the study as submitted;
Approval of the study contingent on changes in study procedures, consent process, or both;
Deferral of the study to amplify or clarify information contained in the protocol, for protection of human subjects, or both;
Referral of the study to the full IRB for full committee review.

The IRB Subcommittee does not disapprove studies (this provision is specified in the federal regulations). Studies that the IRB Subcommittee believes should be disapproved are submitted to the full IRB for a decision.

Administrative Exemption from IRB Review
Some research studies are exempt from IRB review; the process of obtaining administrative certification of exempt status varies from IRB to IRB. Table 2 describes types of studies that federal regulations consider to be exempt from the requirement for IRB review. A study that involves biologic testing done on stored tissue from which identifying information has been removed is an example of a study that is exempt. Exempt studies are certified as such by someone authorized by the IRB to make this determination.

Continuing (Annual) Review
Federal regulations require the IRB to do continuing review of every study it approves at least annually. At the time of annual review, the IRB must make a decision whether the balance of risks and benefits remains reasonable and whether any changes to either the study protocol or the procedures for protecting subjects must be made.

If the researcher does not provide the IRB with information that it needs to decide whether to continue its approval of the research, the IRB will withdraw its approval. Research must cease if the IRB withdraws its approval. This, again, is a federal requirement, not a KP rule.

Role and Requirement of Informed Consent
IRB review recognizes that to protect human subjects, people must freely decide whether they will be subjects in research after having the research and its risks and benefits explained in language they can understand. Not all studies require written consent, but some form of consent to be a research subject is important in all studies.

Researchers should understand the important distinction between requiring IRB review and requiring written informed consent from study participants. Requiring IRB review is NOT the same as requiring written informed consent. Many studies (eg, chart review studies, most surveys and questionnaires, and analyses of computerized data) do not necessarily require written informed consent, although they do require IRB review and approval.

Researchers sometimes go to great lengths to try to convince themselves and others that a project is not research in order to avoid what they believe will be a requirement for written consent. Only the IRB can waive the requirement for written informed consent, and this can be done only after specific "tests" are met.

Procedure for Surveys, Questionnaires
The requirement that consent be obtained from people who participate in telephone surveys or fill out questionnaires can usually be satisfied by providing the subject with information about the study in the form of a "script" that is read to them when they are contacted, in a cover letter sent with the questionnaire, or in a printed box at the top of the questionnaire. For the person to make an informed decision about whether or not he or she wants to be a research subject, the following information must be provided:

a statement that the study is research;
a description of the purpose of the study;
the name of the person doing the study;
a statement about who is funding the study;
the reason why the person is being asked to participate;
what they are being asked to do;
a description of risks (if any) and benefits of participating in the study;
a statement that they do not have to participate and that a decision not to participate will not affect their medical care.

When a person is being asked to participate in a study because he or she has an illness, the IRB may require permission to contact the person from the attending physician. This permission can often be obtained in the form of departmental or administrative approval to approach all patients in a certain category rather than by permission of individual physicians.

Identifying Studies That Require Written Informed Consent
For studies that involve "more than minimal risk," the federal regulations require written informed consent. That is, the study participant must both read and sign a research consent form. A surgical consent form, even though in writing, cannot be substituted for a research consent form.

A study involves more than minimal risk when it does not fall into one of the categories of research that is considered to involve no risk or minimal risk (Table 1). This definition of when written consent is required is the federal definition--it was not invented by KP.

When written consent from subjects is required, the consent form must include (but need not be limited to) the following:

a statement that the study involves research, explanation of the purposes of the research and expected duration of participation, a description of the procedures to be followed, and identification of any procedures that are experimental;
a description of risks or discomforts to the subject;
a description of benefits;
a description of alternative procedures or courses of treatment;
a statement describing the extent, if any, to which confidentiality of records will be maintained;
an explanation of whether any compensation or treatment will be available if injury occurs and, if so, what this compensation or treatment consists of and where further information can be obtained;
whom to contact with research-related questions, and whom to contact if a research-related injury occurs;
statements that participation is voluntary, that refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and that the subject may discontinue participation at any time.

One of the most serious breaches of ethics in research is failure to obtain consent for research that involves risk. Consent is, however, more than obtaining a signature on a consent inform. Consent involves assuring that the person who is being asked to be a research subject is capable of understanding the research and that this person actually understands what will be done. The IRB must be sure that a written consent form accurately explains the research project and what will happen and that it identifies the risks and benefits of the research fairly. Obtaining truly informed consent for participation in research is ultimately the responsibility of the person requesting the consent. There is never any justification for enrolling a person in a research project that he or she does not want to participate in.

Consequences of Failure to Obtain Required Institutional Research Review
Researchers who do not meet the federal requirements for IRB review can have their ability to participate in research suspended. The federal government can bar them from receiving federal research funds for short periods, long periods, or even for life. Failure to obtain consent when it is required puts a researcher at risk of criminal prosecution.

Media attention to failure of IRBs to scrupulously adhere to federal requirements can be intense and is always negative. When an error is made either in the process or in the content of consent forms, hostile publicity can be expected, even for honest errors and oversights. Institutions that do not follow the federal regulations can have federal research funding suspended.

As serious as the consequences of failure to adhere to these regulations are, the real reason to follow the requirements is because the process helps to assure safer research and better research through independent oversight of procedures to protect human subjects.

Acknowledgments: Stan Watson, JD, reviewed the manuscript. The Medical Editing Department of Kaiser Foundation Research Institute provided editorial assistance.

References
1. National Institutes of Health. Office of Extramural Research. Office for Protection from Research Risks (OPRR). Protection of Human Subjects, 45 CFR § 46.101 (1991).
2. Jones, James H. Bad Blood: the Tuskegee Syphilis Experiment--a Tragedy of Race and Medicine. The Free Press: New York, 1981.
3. National Institutes of Health. Office of Extramural Research. Office for Protection from Research Risks (OPRR). Protection of Human Subjects, 45 CFR § 46.110; 21 CFR56.110 (1991); update November 1998.


	The Permanente Journal 500 NE Multnomah St., Suite 100, Portland, OR 97232 503-813-3286 / fax: 503-813-2348